Principles
- Lawfulness and transparency: we only process data with a clear legal basis, and we say so in plain language.
- Purpose limitation: we use data only for the purpose it was collected for.
- Data minimization: we collect the least data needed to achieve the purpose.
- Accuracy: we correct and update data when we learn it's inaccurate.
- Storage limitation: we securely destroy data once it's no longer needed.
- Integrity and confidentiality: we protect data from unauthorized access, loss or damage.
Governance and responsibilities
Senior management approves this policy, the company's data protection officer oversees its implementation, and compliance is reviewed annually within the company's integrated management system certified to ISO 9001, ISO 22301, ISO 14001 and ISO 45001. Every employee and contractor is bound by confidentiality and receives periodic data protection training.
Data classification and access rights
- Data is classified as public, internal or confidential; client and payment data are treated as confidential.
- Access is granted on a least-privilege basis, reviewed every quarter, and revoked as soon as it's no longer needed.
- Multi-factor authentication is required for systems holding confidential data, and access to them is logged.
Technical controls
- Data is encrypted in transit (TLS 1.2 or higher) and at rest in the systems that hold it.
- A content security policy prevents any unapproved script from running on the website and payment portals.
- Card data is never received or stored by DIT; it's handled by licensed payment providers certified to PCI DSS.
- Encrypted backups and periodic restore testing in line with the ISO 22301 business continuity plan.
- Regular security updates and event monitoring on critical systems in line with the National Cybersecurity Authority's controls.
Client data in Device-as-a-Service and the platforms
- DIT acts as a processor on behalf of the client for the client's data inside the platforms and devices, under a written data processing agreement.
- The data remains the client's property, and the client may export it at any time and when the contract ends.
- Returned devices are securely wiped and documented with a certificate before reuse or recycling.
- We only use a sub-processor under a contract binding it to the same level of protection, and we inform the client.
Impact assessment and record of processing
We carry out a data protection impact assessment before any new high-risk processing — such as emerging technologies, automated decisions or large-scale monitoring — and keep a record of processing activities updated with every change.
Breach response
- Contain the incident as soon as it's discovered, and assess its impact.
- Notify the Saudi Data & AI Authority within 72 hours of becoming aware of the incident, in accordance with the implementing regulation.
- Notify affected individuals without delay where the incident may harm them, with suggested steps to protect themselves.
- Document the incident, address its root cause and review the controls.
Secure destruction
When the retention period ends, digital data is destroyed in ways that prevent recovery, physical media is destroyed through certified destruction, and the destruction is recorded in a log.
Review
This policy is reviewed at least annually, when amendments are issued to the Personal Data Protection Law or its regulations, or when there's a material change in the company's business.