PDPL GOVERNANCE
THIQ
ثِق
Personal data protection begins inside your own organisation.
Complete data-privacy governance inside your network, with full national sovereignty and time-stamped evidence ready for audit. It turns the law into documented daily operations.
The product in figures
- 43
- Articles covered
- 5
- Product layers
- 6
- Operational obligations
- 100%
- On-premises sovereignty
- 0
- Data moved to cloud
- 5,000,000
- Maximum penalty
What it solves
Compliance is not optional. The Personal Data Protection Law is in force with forty-three articles obliging every entity to documented, auditable governance, and penalties for breach reach five million riyals — and imprisonment where disclosure causes harm.
Compliance is not a document prepared once and filed. The law imposes six continuous operational obligations: a maintained record of processing activities, an approved privacy policy, responses to individual requests within a defined period, breach notification, retention and destruction on schedule, and verification that external processors comply.
Cloud governance tools contradict the purpose. Global privacy-management products are cloud-based — so they ask you to upload your personal-data inventory to a foreign cloud in order to manage it. That in itself creates a transfer outside the Kingdom, subject to Article 29.
Audit readiness usually begins when the letter arrives. Only then does the search for evidence start — who approved this activity, when, and on what basis for retention — at the moment least suited to searching.
What the product does
Discovery and classification
The product connects to operational databases, scans tables and columns and proposes an automatic classification for each — with the decision remaining human until an owner approves it.
Record of processing activities
Every processing activity documented with purpose, legal basis, data-subject categories, retention period, recipients, and the identity and date of approval.
Policies
A privacy policy built from the record itself rather than a template — so any change to a processing purpose is reflected in the policy immediately.
Data-subject requests
Individual rights as time-bounded workflows, with the clock started at receipt and an alert before it expires.
Breach reporting
A closed five-step path: log the incident, determine scope, notify the competent authority, notify individuals, and preserve the evidence.
Retention and destruction
The system computes the due destruction date for each activity from its collection purpose and retention period, and raises a task to the responsible department when it falls due.
Contracts and processors
A register of every service provider processing personal data, contract clauses linked to statutory obligations, and periodic verification tasks with documented results.
Evidence log
Every action in the first four layers produces a time-stamped record — so audit readiness becomes a by-product of daily operations rather than a separate project.
Compliance dashboard
Record coverage, requests and deadlines, incidents and evidence — in one dashboard ready to show the competent authority.
API integration
A documented interface inside the entity’s own gateway that existing systems connect to — with no data leaving, and every call logged in the evidence record.
Operating model and security
- Operating model
- Fully on-premises — personal data never leaves the entity’s network
- Cross-border transfer
- Running the product itself creates no transfer of data outside the Kingdom
- Development
- Developed entirely at AMAD Information Technology, using the law’s own terminology
- Language
- Arabic and English interface
- Layers
- Discovery · Governance · Policies and operations · Evidence · Administration
- Third parties
- No disclosure to any third party in order to run the product
- Sectors served
- Government · healthcare · financial services · any entity processing personal data in the Kingdom
Frequently asked
- Which articles of the law does the product cover?
- The product covers the law’s obligations through an explicit coverage matrix spanning data-subject rights and responses, the legal basis for processing, processor selection and verification, purpose limitation and data accuracy, the privacy policy and notice elements, correction, retention and destruction, breach notification, cross-border transfer and disclosure, and records of processing activities.
- Does the product upload our data to the cloud?
- No. The product runs entirely on-premises and moves no data to any external cloud. Because it runs internally, operating it creates no cross-border transfer in itself.
- Does automatic classification replace human review?
- No. The product proposes an automatic classification for each column, and every proposal carries a “not yet reviewed by a human” state until an owner approves it — satisfying the requirement for data accuracy and purpose linkage.
- How does the product evidence compliance to the authority?
- Every action produces a time-stamped record in the evidence log, and reports and registers can be exported on demand — so audit readiness is a by-product of daily operations rather than a project that starts when the letter arrives.
See THIQ inside your own environment
One session on your infrastructure as it stands: we install it, show what your team would see on day one, and answer every question in front of your engineers.