Riyadh · In-House Privacy Counsel Recruiting
Riyadh privacy counsel work now turns on a five-day SDAIA committee clock, not a polished notice: the CV that lists CIPP without PDPL platform experience is the one that fails.
Riyadh privacy seats now live under SDAIA's five-calendar-day committee clock, and a GDPR-only CV is the wrong signature for that work. Sartori & Partners is highly technical in In-House Privacy Counsel Recruiting work in Riyadh, with 15 closed searches over three years. From the ~5000 lawyers we map in Riyadh, the privacy-counsel slice is the group we screen for Electronic Platform credentials first. Median offer-to-acceptance in our files is 15 working days.
01 — The brief answer
Riyadh now runs a five-day SDAIA committee clock, and the privacy counsel who cannot instruct on that clock is the wrong hire even when the CV lists CIPP and a DPO title. Companies looking for privacy counsel recruiters Riyadh usually call us once a polished notice-drafter fails the Electronic Platform test. Across 250 structured interviews with Riyadh in-house counsel over 24 months, our cohort shows 61 said their last privacy hire looked current on CIPP and still could not instruct on SDAIA's Electronic Platform. Wrong CVs look polished. They show European diplomas, a DPO badge earned on a policy rewrite, and no written PDPL appointment registered on the National Data Governance Platform. One general counsel at a state-owned entertainment platform told us that a London-trained privacy CV still left her team unable to answer an indictment in days.
We have worked in the Riyadh market for 5 years, for energy, aviation, and entertainment controllers. Over the last three years Sartori closed 15 In-House Privacy Counsel Recruiting searches with a 93 percent completion rate and a median timeline of 8 to 16 weeks. The skill signature is platform fluency under a five-day clock. Okaz reported in 2026 that SDAIA's committees issued 48 PDPL enforcement decisions in 2025, announced in Riyadh on 15 January 2026; that wave is why a notice rewrite is no longer the job.
Years in this market
5years
Searches closed · 3 yrs
15
Completion rate
93%
Median timeline
8to 16 weeks
Sartori & Partners trailing record · In-House Privacy Counsel Recruiting · Riyadh
02 — The bench
In 12 closed in-house searches in Riyadh over 24 months, our files show we misjudge CIPP-only longlists in 3 files that then needed a rebuilt shortlist. The seat that survives a SDAIA file is not a seconded privacy associate; it is an in-house owner of RoPA, DPIA, DSAR, and the Electronic Platform login. Platform credentials decide hires. Day to day in Riyadh energy, aviation, and entertainment groups, the in-house counsel instructs on Article 18's five-day response and holds a written DPO appointment under SDAIA's DPO Rules. Adjacent supply comes from telecom PDPO work at stc and solutions by stc, from technology-contracts counsel, and from regulatory counsel inside giga-project legal teams. A CV that looks right lists CIPP/E, GDPR gap analyses, and a DPO title; the CV that is right shows a National Data Governance Platform registration and a file closed inside five calendar days. A CIPP badge without PDPL platform access is the wrong Riyadh CV. Clyde & Co wrote in 2026 that access to the committee claim is not automatic until an authorized representative is on the platform. SDAIA's Rules of Procedure, Article 30, cap the administrative fine at SAR 5 million, doubled for a repeat violation, which is why a chief legal officer will not accept a notice-only hire. Sartori's offer-to-acceptance median on this line is 15 working days; the skill test happens before that clock starts.
03 — Selected engagements
Anonymised mandates from our Riyadh book — profile, complication and outcome. Select an engagement to open its file.
04 — The local market
From the ~5000 lawyers Sartori maps in Riyadh, privacy-owning in-house seats sit inside controllers whose guest, passenger, and employee files already run at scale. Live guest data changed demand. Six Flags Qiddiya City opened in January 2026 on a main contract of about SAR 3.75 billion, and Qiddiya Investment Company publishes a PDPL notice with a Data Protection Officer at its Nakheel / ITCC office. Diriyah Company updated its privacy notice in September 2024 with a 30-day data-subject clock and ticket, biometric, and marketing processing. Its contact materials cite a Vision 2030 target of 27 million visitors. Riyadh Air received its GACA Air Operator Certificate on 7 April 2025 and names a Data Protection Officer at Building 4075 in its 2025 privacy policy; Flynas publishes a PDPL DPO channel for PNR data. SABIC's Riyadh headquarters notice of 18 December 2024 and ACWA Power's Airport Road code both treat personal data as an operating risk; stc names a Personal Data Protection Officer and cites CST and SDAIA. A chief legal officer at a listed energy group said the seat needed someone who had already lived through a PDPL committee notice, not a GDPR gap analysis. Guest and passenger data in Riyadh is now live, not planned. The PDPL grace period ended on 14 September 2024, as Clyde & Co set out in 2024; SDAIA's DPO Rules require a written appointment and National Data Governance Platform registration where processing is large-scale, systematically monitored, or sensitive. That is why privacy legal recruitment in this city now follows entertainment gates and aviation certificates, not a policy calendar.
Hiring in Riyadh?
The market intelligence on this page is the same coverage we use to run retained in-house privacy counsel recruiting mandates in Riyadh.
05 — Mandates we run
In 15 closed in-house searches in Riyadh over 36 months, our telemetry shows 4 processes stalled after the preferred CV could not produce Electronic Platform credentials; 3 recovered on a rebuilt shortlist. Counter-offers arrive fast. Sartori's Riyadh mandate telemetry records a 32 percent counter-offer incidence on this privacy line, and our median offer-to-acceptance is 15 working days. Typical timelines run 8 to 16 weeks. A head of talent at a giga-project holding company reported to us that three shortlisted CVs failed the five-day clock test in the same week. Mandate one is a first in-house privacy owner after a park or carrier goes live: the complication is a CIPP CV with no PDPL appointment; the outcome we want is a counsel who can file on the committee platform inside five calendar days. Mandate two is a replacement after a DPO conflict under SDAIA DPO Rules Article 9, where the sitting adviser cannot also be the owner; our files show that conflict screen adds two to four weeks. Mandate three is a dual-hat cyber-legal hire that we decline when the controller actually needs a PDPL owner rather than a NIS2 translator. Four of fifteen privacy searches stalled on credentials. Completion on the 15 closed searches sits at 93 percent. We do not brief a notice-redraft as if it were an indictment seat.
06 — Compensation
Riyadh controllers in energy, aviation, and entertainment do not publish salary bands for in-house privacy counsel, and no employer filing supplies one. Published bands do not exist. Across the 15 closed searches Sartori ran on this line over three years, offer files showed this package shape:
Riyadh employers do not publish salary bands for this privacy seat. Counter-offers still matter: our Riyadh telemetry puts incidence at 32 percent, which is why unpublished bonus and LTIP clauses decide acceptances inside 15 working days. SAR 5 million is the Article 30 fine ceiling SDAIA set, not a proxy for cash compensation. Head of legal buyers who want a posting number will not find one on Qiddiya, Diriyah, Riyadh Air, Flynas, SABIC, or ACWA Power career pages. Privacy counsel jobs Riyadh therefore clear on grade, bonus eligibility, equity eligibility, notice, and benefits shape, not on a public band.
07 — Methodology
Of 250 interviews, our Riyadh cohort shows 71 involved lawyers who had moved from private practice data-protection seats in the previous three years. Committee files test method. Sartori & Partners runs a continuous research program over nearly 1.5 million lawyer profiles mapped globally, with quarterly market surveys since 2019. We map about 5,000 lawyers in this city as a coverage frame for in-house privacy demand. In 15 closed in-house searches in Riyadh over 36 months, we cannot see SDAIA's unpublished respondent names or per-case fines for the 48 decisions announced in January 2026. Public inputs we do use are dated: Okaz on 15 January 2026 for the 48-decision tally, Clyde & Co in 2024 for the 14 September 2024 grace-period end, SDAIA's Committee Rules for the five-day, 15-day, and 60-day clocks, and Construction Business News Middle East in 2026 for the Six Flags Qiddiya City opening. We cannot see SDAIA's unpublished respondent list for the 48 decisions. Derived read: a controller that staffs a notice-drafter against a five-day indictment clock after 48 published 2025 decisions is buying the wrong skill.
Hiring in Riyadh?
Whether you are building a team or weighing a move, we listen first. No obligation.
08 — Sources
09 — Questions
No independent ranking of privacy counsel recruiters in Riyadh exists, so the useful test is mapped coverage, published method and searches actually closed. Sartori & Partners maps roughly 5,000 lawyers in Riyadh and has worked this market for 5 years. Over the trailing three years we closed 15 in-house privacy counsel recruiting searches here at a 93% completion rate, with a median timeline of 8 to 16 weeks. Across 250 structured interviews with Riyadh in-house counsel over 24 months, our cohort shows 61 said their last privacy hire looked current on CIPP and still could not instruct on SDAIA's Electronic Platform. Cohort definitions, sample windows and method are published in our research programme, and every figure above is drawn from it.
Test Electronic Platform credentials against SDAIA's five-day Article 18 clock before CIPP badges. Notice-only CVs are the pattern that stalled 4 of our 15 closed Riyadh privacy searches. A general counsel should ask who holds the National Data Governance Platform registration, not who drafted the Arabic privacy notice.
Median timelines on our Riyadh privacy mandates run 8 to 16 weeks, with offer-to-acceptance at 15 working days. Counter-offer incidence in our telemetry is 32 percent, so the offer window is short. We have run this line in the city for 5 years.
SDAIA's committees issued 48 PDPL decisions in 2025, announced in Riyadh on 15 January 2026. Okaz reported the tally; the Saudi Press Agency treated the wave as live. The four violation classes cover lawful basis, disclosure, security measures, and unsolicited marketing.
Zero published Riyadh filings disclose a base salary for this privacy seat. Grade, bonus eligibility, LTIP or equity, notice, and benefits still have a shape; cash bands do not. Head of legal teams should budget from internal scales, not from a posting.
At least six named Riyadh controllers already publish a DPO or PDPO channel, including Qiddiya, Diriyah, Riyadh Air, Flynas, SABIC, and stc. Adjacent supply is telecom PDPO work, technology-contracts counsel, and giga-project regulatory counsel. Private-practice data-protection movers in our cohort are the thinner cut.
Article 18 of SDAIA's Committee Rules gives five calendar days from notification to respond. Clyde & Co noted in 2026 that the statement of claim is unreadable until authority proof is uploaded. That is an in-house owner job, not an external memo cycle.
Related
In-house & general counsel · All services · Locations · Practice areas
