HomeReady-to-use templates and contractsIP and dataData Processing Agreement
Data Processing Agreement Template: A Ready Contract Certified by a Licensed Saudi Lawyer
- Category
- IP and data
- Language
- Arabic + English
- Format
- Editable DOCX
CERTIFICATION RECORD
This template was prepared and reviewed by a licensed Saudi lawyer and is kept current as the Kingdom's regulations change.
Where an Arabic and an English text exist, the Arabic text prevails
An addendum governing the controller and processor relationship: instructions, sub-processors, incidents, and deletion, bilingual.
A data processing agreement is the addendum both sides sign when one party processes personal data on behalf of another: a platform running an HR system for its client, a marketing firm managing its customer lists, a hosting provider holding its users' records. The Personal Data Protection Law rests on the principle that the controller stays responsible for the data even while it sits in someone else's hands, which is why the commercial contract alone is not enough. Sighaty template I-04 attaches to your main contract and fixes what the processor may and may not do, the confidentiality of its staff, the use of sub-processors, notification of data incidents, audit rights, and the fate of the data when the relationship ends, in two parallel languages with the Arabic text prevailing on any difference.
Get the Data Processing Agreement TemplateI-04What this agreement is and when you need it
The practical test is simple: does personal data about your customers or staff reach a third party because of a service it provides to you? If yes, you are the controller and it is the processor, and you both need this addendum. Many organisations now ask for it as a condition of contracting before systems are connected, and having it ready saves weeks of negotiating wording from scratch.
- Contracting a cloud system or hosting provider that holds your customers' data.
- Outsourcing payroll, HR, or customer service to an external firm.
- Engaging a marketing or analytics agency to process customer lists on your behalf.
What the smart-fill asks and what you receive
The smart-fill asks for the controller and the processor in Arabic and English with each one's commercial registration, and the date of the main agreement this addendum supplements, in both Hijri and Gregorian. In the options you then set how sub-processors are authorised: specific prior written consent case by case, or general written consent, along with the period for notifying changes while the processor stays fully liable for them.
It then asks how the data-incident notification is worded and its window, and how audits are arranged: an audit annually or after incidents, or accepting recognised certifications or reports from the processor instead, then the period within which the data is returned or deleted at the controller's choice when the relationship ends. You receive a formatted bilingual Word document, ready to sign and editable before approval, which you attach to the main contract without renegotiating it.
Why a lawyer-certified template beats a free download
Most of what circulates free in this area is translated from European rules, so it carries terms and references with no place here and leaves a business believing it is compliant while relying on a framework other than the one that applies to it. A template certified by a licensed Saudi lawyer is written on the concepts and language of the Personal Data Protection Law and updated as requirements evolve, so it stands up when a client asks for evidence that your processing chain is disciplined, instead of raising more questions than it answers.
Frequently asked questions
Who is the controller and who is the processor?
The controller is the party that decides why and how personal data is processed, and the processor is the party that carries out the processing on its behalf and on its instructions. A store collecting its customers' data is a controller, and the platform provider storing it for the store is a processor. The template assumes this split and builds each party's obligations on it.
Do I need this agreement if the provider is outside the Kingdom?
A controller's responsibility for its customers' data does not fall away because the processing happens at a foreign provider, so documenting the relationship in writing remains the baseline. The template is bilingual, so it can be signed with a non-Arabic-speaking counterparty while the Arabic text stays the governing version on any difference, which is what makes it practical with international providers.
What happens to the data when the contract ends?
The controller chooses between return and deletion, and the processor must carry out that choice within the period set in the agreement. This is one of the most commonly forgotten clauses when a provider relationship ends, and its absence leaves copies of your customers' data in systems you no longer deal with.
The content is general guidance, not legal advice; consult a licensed lawyer for your specific case.