Register status
The production subprocessor inventory is not approved in this release. The repository contains local assets and client-side experiences, but that does not establish which host, email provider, storage service, recruitment system, analytics vendor, AI provider, or support platform will process personal data in production.
Before a provider is activated
- Record the provider, service, processing purpose, data categories, data subjects, locations, retention, access, security, deletion, and onward-transfer position.
- Confirm the processor contract, instructions, confidentiality, incident support, audit or assurance evidence, subprocessor change process, and exit assistance.
- Assess whether the service creates a transfer outside Saudi Arabia and document the required safeguards and risk assessment.
- Update the privacy policy, cookie policy, consent categories, and data-flow register when the provider changes the public experience.
Change notice
A future approved register will show an effective date, version, provider name, service, processing location, and the notice period or objection path required by the applicable contract and law. This page is not a live list of vendors yet.
This is an operational draft for review and approval. Do not use it to determine rights or obligations until it is approved by the authorized owner.