PDPL and Data Protection
Last updated: 24 August 2026
A statement of the roles O A I Company For Artificial Intelligence holds under the Saudi Personal Data Protection Law, the rights the law gives you, and how to exercise them. Product-level detail for Rushd is on the Rushd PDPL page.
1. Our roles
For data collected through oai.sa — website visits, contact-form submissions, and correspondence — O A I Company For Artificial Intelligence is the controller. The same applies to the account and billing data of firms that subscribe to Rushd.
Client and case data that a law firm stores in Rushd sits under a different arrangement: the firm is the controller, and we process that data as processor, only on the firm's documented instructions. Our processor commitments — confidentiality, security, breach notice to the firm, help with data-subject requests, deletion or return on termination, and advance notice of sub-processor changes — are set out on the Rushd PDPL page.
2. Your rights
Under the PDPL you may ask to be informed about the processing of your data, to access it, to receive a copy in a readable format, to have it corrected, to have it deleted, and to withdraw consent you previously gave.
Write to info@oai.sa. We verify identity first and respond within 30 days.
If a law firm entered your data into Rushd, address your request to that firm — it is the controller — and we will assist it in responding.
3. Complaints
You may escalate any concern to the Saudi Data & AI Authority (SDAIA), the regulator responsible for the PDPL, at any time.
4. Breach notification
If a personal data breach occurs, we notify SDAIA within 72 hours where the law requires it, and we inform affected firms and individuals without undue delay.
5. Contact
Our privacy contact for all PDPL matters is info@oai.sa.