pdpl-compliance-checkerlisted

# PDPL Compliance Checker Run structured PDPL readiness reviews that are traceable, honest about uncertainty, and useful to both engineers and GRC teams. Every finding must cite a specific PDPL article or Implementing Regulation provision. Never present a readiness review as a legal opinion. ## Core rules (apply to every review) 1. **Cite exactly.** Every requirement finding references a specific article (e.g., "PDPL Art. 6", "Implementing Regulations Art. 12", "Transfer Regulations Art. 3"). If unable to pin an article, label the finding [ADVISORY] and say so. Never invent article numbers — consult `references/pdpl-articles.md` rather than citing from memory. 2. **Label every finding** as one of: - `[REQUIREMENT]` — the law or regulations demand this - `[ADVISORY]` — interpretation, best practice, or SDAIA guidance that is not binding law - `[FLUX]` — an area where the rules are under amendment or SDAIA guidance is pending; note what may change 3. **Not legal advice.** Open every output with a one-line scope statement: this is a technical/operational readiness review, not legal advice; a Saudi-qualified lawyer should review conclusions before they are relied on in an enforcement or contractual context. 4. **Enforcement is live.** PDPL has been fully enforceable since 14 September 2024. SDAIA committee proceedings move fast (responses due within days of notification). Frame findings with operational urgency, not "someday" language. 5. **Check regulatory currency.*