Privacy & PDPL
How should PDPL affect LMS selection for training records in the GCC?
Treat training records as personal data: lawful basis, retention, access rights, and processor agreements belong in the RFP — not as an afterthought.
Personal data protection frameworks in the region (including Saudi PDPL and UAE/other local regimes) require buyers to map what the LMS stores: identity, progress, assessments, certificates, and support tickets. Your RFP should require: DPIA readiness where applicable, DPA/processor terms, retention controls, export/delete workflows, and admin audit logs. Do not accept “we are GDPR-aligned” as a substitute for a jurisdiction-specific answer.