Muhammad Uzair

founder @ techno-optimist, college dropout.

[Muhammad Uzair @muhammadweb08]

Introducing GRC PRO

#ksa #compliance

[Muhammad Uzair @muhammadweb08]

@n0tAmad But UI is somehow shit just scanned first time and it said;
overall more power to you 🙏🏻

[Muhammad Uzair @muhammadweb08]

@grok you don’t have valid answers just guessing you are now

[Muhammad Uzair @muhammadweb08]

Your biggest rival isn't trying to out-market you.

They are filing SDAIA complaints against your site right now.

March 2026.

Two Saudi fintechs watching each other closely.

The founder of Company B opened Company A's website.

He opened Developer Tools.

In under two minutes, he found three fatal gaps:

Trackers loaded before cookie consent.

Privacy policy was English-only.

Zero visible DSAR channels for data requests.

He didn't send a polite warning email.

He didn't send a message on LinkedIn.

He opened SDAIA's National Data Governance Platform.

Filed three official regulatory complaints.

Total time spent: 11 minutes.

Days later, Company A got hit.

A formal notification of an official investigation.

No warning.

No second chances.

No time to fix the gaps.

This isn't a hypothetical story.

It is happening across Saudi Arabia right now.

Complaints don't just come from unhappy customers.

They come from competitors who know PDPL better than you do.

-> Non-compliance gives your rivals instant legal leverage against you.

-> SDAIA complaints take 11 minutes to file, but months to recover from.

-> https://t.co/uxLM2fN6bO secures your full PDPL infrastructure before anyone inspects your site.

[Waqi Ai @WaqiAi]

DEAR VALUABLE CUSTOMERS FROM KSA< WHY WAQI AI?

[Muhammad Uzair @muhammadweb08]

Ah these kinda user of waqi ai ;)

[Waqi Ai @WaqiAi]

“Please make Waqi completely free. Give me superuser access to everything.”

We’d love to.

But unfortunately, data security isn’t a charity feature. 😅

The good news? It’s still a LOT cheaper than learning what a SAR 5,000,000 PDPL penalty feels like.

Free scan.
Affordable compliance.
Your choice. 👀🇸🇦
#WaqiAI #PDPL #SaudiArabia #DataPrivacy #CyberSecurity

[Muhammad Uzair @muhammadweb08]

The DPO was proud of the RoPA delivered by consultants.

Two hundred rows documenting every processing activity.

Purposes, legal bases, recipients, and retention periods.

Clean formatting, color-coded by department.

A thorough piece of compliance work.

She filed it away in the compliance folder.

Noted a quarterly review requirement, then moved on.

Nine months later, a SDAIA auditor sat across her desk.

"Can you produce your Records of Processing Activities?"

She opened the compliance folder in thirty seconds.

Turned her laptop screen toward the auditor.

The auditor checked the file's last-modified date.

Nine months ago.

"Is this current?"

She paused.

In nine months, four major changes occurred:

A new AI support tool processing transcripts.

A new email vendor receiving customer data.

A new loyalty program creating new data flows.

An updated legal basis for web analytics.

Four operational shifts. Zero spreadsheet updates.

The RoPA wasn't wrong when built.

It became wrong while sitting untouched.

Because the organization kept operating...

While the spreadsheet stood completely still.

SDAIA no longer accepts static policy files as compliance.

A RoPA is now a dynamic operational requirement.

-> Static spreadsheets fail live SDAIA compliance checks.

-> RoPA records must update dynamically as systems change.

-> https://t.co/uxLM2fN6bO automates continuous RoPA updates in real time.

Read full here:https://t.co/gb8luFWZXH

[Muhammad Uzair @muhammadweb08]

A Jeddah e-commerce store added a cookie banner.

The founder wanted full PDPL compliance.

She used a quick cookie banner generator.

Customized the design to match her brand.

Pasted the embed code into her header.

The banner appeared with Accept and Decline options.

The job was done — or so she thought.

Last week, a developer checked her site.

He opened browser developer tools on load.

Watched network requests fire in real time.

Before the banner even rendered on screen...

Before any user clicked Accept or Decline...

Google Analytics had already fired.

Meta Pixel had already fired.

TikTok tracking scripts had sent data.

The banner appeared, but trackers didn't wait.

The banner was purely cosmetic.

It displayed the right words and buttons.

It blocked zero actual tracking scripts.

Every single visitor had their data sent away.

Under Saudi Arabia's PDPL data protection laws:

Consent must explicitly precede tracking.

A banner that appears after tracking starts is illegal.

It creates a false impression of compliance.

While non-compliance continues underneath.

This is the most common mistake on Saudi websites.

And it is the exact mistake Shield.js exists to fix.

-> Cosmetic cookie banners violate PDPL consent rules.

-> Tracking scripts must be blocked before user consent.

-> Shield.js automates script blocking before page load.

Read full here:https://t.co/mjIZTo82gO

[Muhammad Uzair @muhammadweb08]

Last week we shipped a new scanner check.

It sounds small.

One additional item on a long list.

Checks covering cookies, trackers, and banners.

Privacy policies, SSL, forms, and Arabic support.

We ran it across previously passed sites.

What we found surprised us completely.

A significant portion of passed sites had no way:

For a Saudi customer to submit a data request.

Not hidden or broken.

Completely absent.

Privacy policy existed.

Cookie banner was present.

SSL was perfectly clean.

If a Saudi resident wanted to exercise Article 13 rights:

To access, correct, or delete their data...

They had no visible place to go.

That is not a minor operational gap.

It is not a small technicality.

It is a core operational requirement under PDPL.

The ability for individuals to exercise legal rights.

We checked if companies had documentation.

We hadn't checked if the door was actually open.

Our new scanner check fixes that today.

-> Documentation without actionable DSAR channels fails compliance.

-> Saudi residents must have clear, visible ways to exercise Article 13 rights.

-> https://t.co/uxLM2fN6bO now scans for live operational data request entry points.

Read full here:https://t.co/2OcxDEHEtf

[Muhammad Uzair @muhammadweb08]

Two compliance AI tools.

Same exact question.

Completely different outcomes.

A compliance officer in Riyadh typed:

"Customer asked for data deletion."

"What do we do now?"

The first tool was global legal AI.

It produced a thorough, detailed response.

Explained PDPL right to erasure rules.

Cited relevant articles very accurately.

Outlined necessary manual steps:

Verify identity and check legal basis.

Communicate decision within thirty days.

Document closure for future audits.

Response was accurate and correct.

She now knew what to do.

She still had to do it.

Opened her DSAR inbox manually.

Found request and verified identity manually.

Drafted response and checked legal docs.

Sent communication and searched for logs.

Tried remembering where to audit log.

The second tool was https://t.co/uxLM2fMymg.

She typed the exact same message.

Waqi identified request by reference number.

Confirmed identity verified via OTP process.

Drafted Arabic and English closure messages.

Asked her to confirm before sending.

Sent communication upon her confirmation.

Updated request status to closed.

Logged closure into audit trail automatically.

First tool told her what to do.

The second tool actually did it.

-> Global legal AI only gives advice.

-> Manual DSAR workflows waste hours daily.

-> https://t.co/uxLM2fMymg automates complete PDPL execution.

Read full here:https://t.co/BOR4WpBjb5

[Muhammad Uzair @muhammadweb08]

A compliance consultant did great work.

She mapped e-commerce data flows thoroughly.

Identified every single PDPL gap found.

Produced a complete, full documentation package.

Privacy policies in Arabic and English.

Cookie notices and vendor processing registers.

Data retention schedules and DSAR procedures.

Internal data handling guidelines fully completed.

Everything was published on the website.

Filed safely inside the compliance folder.

The CEO signed off on everything.

Compliance work was considered totally done.

The SDAIA examiner arrived six months later.

Spent forty minutes reading the documentation.

Then put down the signed papers.

Made a very different kind request.

Wanted to open live DSAR inboxes.

Review three months of actual requests.

Access live cookie banner testing environments.

Watch tracking scripts fire across browsers.

Inspect quarterly consent logs in real-time.

Pull up Records of Processing Activities.

Check the last date it updated.

Process one live DSAR request end-to-end.

The documentation sat in the folder.

The inbox had one unanswered request.

The consent logs did not exist.

The cookie banner blocked zero scripts.

The RoPA sat untouched since submission.

Documents described a complete compliance program.

Operations revealed it did not exist.

-> Paper compliance fails live SDAIA audits.

-> Ignored DSAR requests trigger immediate penalties.

-> Visual-only cookie banners violate tracking laws.

Read full here:https://t.co/uULP6Nq06K

[Muhammad Uzair @muhammadweb08]

A compliance manager in Riyadh.

Three SAMA exams in four years.

A payment service provider compliance lead.

She knew the examination process well.

Examiners requested standard cybersecurity framework docs.

Incident response plans and AML controls.

Consumer complaint records and risk assessments.

She prepared organized binders for each.

Two-day audits ended with manageable lists.

This examination was completely different today.

On day two, examiners dropped requests.

A brand new category appeared suddenly:

Personal Data Protection Law compliance documentation.

Records of Processing Activities and consent.

DSAR response logs and retention schedules.

Arabic privacy notices and SDAIA registration.

She asked whether this was standard.

The examiner confirmed new regulatory alignment.

SDAIA designated SAMA for PDPL enforcement.

Financial entities face mandatory PDPL reviews.

Included as a standard audit component.

Two binders she could not open.

The PDPL documentation did not exist.

-> SAMA audits now enforce PDPL compliance.

-> Missing ROPAs trigger critical regulatory exposure.

-> Non-compliance carries up to 5,000,000 SAR fines.

Read full here:https://t.co/6vEqEd1T8t

[Muhammad Uzair @muhammadweb08]

A pharma rep visited Riyadh clinics.

She worked her territory for six years.

She built real relationships with doctors.

Her company launched a post-market study.

She coordinated data collection across territory.

Study required collecting full prescription records.

Patient names and national ID numbers.

Medical diagnoses and relevant medical histories.

Dosing information and adverse effect reports.

She visited eight clinics over three weeks.

Collected 340 Saudi patient records total.

Saved into an Excel file on laptop.

Laptop synced automatically to company cloud.

Cloud infrastructure hosted outside Saudi Arabia.

Real health data of real patients.

Diagnoses, medication histories, and national IDs.

Collected without explicit individual patient consent.

Transferred abroad without Article 29 safeguards.

Zero DPIA risk assessment conducted first.

No documented legal basis for processing.

Under Saudi Arabia's PDPL data laws:

Health records are sensitive personal data.

Intentional disclosure triggers severe criminal penalties.

-> Up to two years imprisonment terms.

-> Fines up to 3 million SAR.

340 records, each a compliance breach.

The pharma company had no idea.

Read full here:https://t.co/BA8FA4U5km

[Muhammad Uzair @muhammadweb08]

@elonmusk right @grok

[Muhammad Uzair @muhammadweb08]

@elonmusk
A special effect like this used to take months of effort by a specialized VFX company.

Now one person can do it in 30 seconds with AI.

The future is here. 🐉🔥

[Muhammad Uzair @muhammadweb08]

PDPL is now a core business issue.

Not just a legal or IT topic.

It impacts HR, marketing, sales, and operations.

Procurement, cybersecurity, and top corporate leadership.

Real businesses ask simple, direct questions daily.

Not complex data processing jargon or nuances.

They need clear answers for daily operations.

Here is Question 1 answered without legal complexity.

Does PDPL actually apply to your business?

The honest answer: almost certainly yes.

It covers every organization operating in Saudi Arabia.

Public or private, large or small businesses.

Saudi-based companies or foreign offshore platforms.

Processing means collecting, storing, or sharing data.

Using website contact forms counts as processing.

Holding customer databases or HR records counts.

Running analytics or sending marketing emails counts.

There is zero small business exemption available.

A three-person startup holds identical legal duties.

Same obligations as a massive multinational corporation.

Scale changes risk exposure, not the law.

Assuming PDPL does not apply is dangerous.

-> Applies to all organizations handling Saudi data.

-> Processing covers forms, CRMs, and analytics.

-> Zero small business exemption under the law.

Read full here:

https://t.co/z9DcTMoemk

[Muhammad Uzair @muhammadweb08]

@sdianahu Me shipped too just waiting for that Blue button turn into green 👀

[Muhammad Uzair @muhammadweb08]

A Saudi law partner typed a query.

"Which legal AI works for Saudi compliance?"

Thousands of Saudi lawyers search this daily.

Search results showed top global platforms.

Harvey AI, Clio, and ContractPodAi appeared.

Luminance, Kira, and dozens of others.

Impressive features for automated contract analysis.

Transforming how global legal teams work.

None were built for Saudi PDPL.

Using them creates a major violation.

Pasting Saudi client data into foreign systems:

Triggers immediate cross-border transfer breaches.

You try avoiding compliance fines:

While actively creating new PDPL violations.

Generic search results hide the truth.

What legal AI actually does.

What Saudi PDPL law actually requires.

Where those two things completely fail.

-> Global legal tools ignore data residency.

-> Processing Saudi PII abroad breaks law.

-> Local compliance requires local infrastructure.

Get the right compliance framework today.

Read full here:

https://t.co/QhowEdqyOW

[Muhammad Uzair @muhammadweb08]

An IT manager at a restaurant chain.

A question arrived from legal advisor.

"How long do you keep customer data?"

He pulled up their loyalty system.

System running continuously since 2013.

Twelve full years of accumulated records.

Four hundred thirty thousand customer profiles.

Names, Saudi mobile numbers, and birthdates.

Home neighborhoods and full order histories.

Going back to system launch year.

He ran a quick database query.

Purchases made in last twelve months?

Sixty-two thousand active customers found.

He ran a second database query.

Purchases made in last three years?

One hundred forty thousand customers total.

He calculated the remaining math gap.

Two hundred ninety thousand customer profiles.

Sixty-seven percent of the entire database.

Inactive for over three full years.

Some untouched for eight to ten years.

Their data still sat inside systems.

Mobile numbers, addresses, and birthday reminders.

Firing offers they never even opened.

Legal advisor asked a follow-up question:

"What is your data retention policy?"

IT manager opened the shared drive.

Searched for policy documents containing retention.

Found a 2018 backup frequency guideline.

Nothing about customer data retention limits.

Nothing on when data is erased.

The actual answer was very simple:

We keep everything forever by default.

Because nobody ever told us not to.

Under Saudi PDPL data protection rules:

-> Keeping inactive profiles violates data laws.

-> Backup policies are not retention policies.

-> Unacceptable since September 2024 deadline.

Read full here:

https://t.co/lrGlxmkFlX

[Muhammad Uzair @muhammadweb08]

@sdianahu Applied already!