Supplied & supported in KSA by Blue Edge
KnowBe4 Compliance Plus Training in Saudi Arabia
A compliance training library your staff will actually finish, delivered on one platform with the completion evidence an assessor asks for — mapped to PDPL, NCA ECC and SAMA CSF obligations by Blue Edge in Dammam.
Blue Edge supplies KnowBe4 Compliance Plus across Saudi Arabia and does the part that matters locally — mapping the library to NCA ECC, SAMA CSF and PDPL obligations, loading your own policies into the platform, and configuring the reporting your assessors will ask for. Handled in-Kingdom from our office in Dammam.
PDPL stopped being a planning exercise in September 2024
Saudi Arabia's Personal Data Protection Law came into force in September 2023 with a one-year grace period. That period ended on 14 September 2024. Enforcement has been active since.
SDAIA's review committees had issued 48 decisions against organisations found in violation as of early 2026. Administrative fines run to SAR 5,000,000 per violation and can be doubled for repeat offences. Unlawful disclosure of sensitive personal data carries criminal liability of up to two years' imprisonment. SDAIA can also suspend an organisation's data processing outright.
Among the most commonly cited enforcement findings are processing personal data without a valid legal basis and failing to honour data subject requests. Both are things ordinary employees do or fail to do — in HR, marketing, sales and support — not things a firewall prevents. That is why training is where PDPL compliance either holds or falls apart.
No international vendor ships a Saudi PDPL module. Including this one.
Compliance Plus is built around a global regulatory picture. Its data privacy content names GDPR, HIPAA, PCI, POPIA and others, and there is a general module covering worldwide privacy regimes. There is no course called "PDPL" in the library, and any supplier telling you otherwise is describing a product that does not exist.
What matters is that PDPL is built on the same foundations as those regimes — lawful basis, consent, data minimisation, purpose limitation, data subject rights, breach reporting. An employee who genuinely understands those concepts is equipped for PDPL. The gap is not the teaching. It is the mapping and the local specifics.
So the platform does two things that close it. You can load your own SCORM content and brand modules with your own policies — which is how your PDPL procedures, your breach reporting route and your DPO's name get in front of staff. And everything reports through one system, so the vendor library and your own material appear in the same completion record.
What Blue Edge does
The mapping is the work. We take the library, match modules to the controls your assessor will test, identify what has no equivalent in the vendor content, and build or source the Saudi-specific pieces to fill it.
A quotation from us includes that mapping. If all you want is a licence key, any reseller can sell you one — you will just be doing this part yourself.
What Compliance Plus actually covers
Over 1,000 items, updated regularly, built as short interactive modules with knowledge checks rather than hour-long videos. Available as an add-on at any KnowBe4 subscription level.
Data privacy & protection
Personal data handling, data subject requests, minimisation, purpose limitation and what to do when data leaks. The core of any PDPL programme.
Business ethics
Anti-bribery and corruption, anti-money laundering, conflict of interest, gifts and hospitality, and code of conduct.
Workplace conduct
Harassment, discrimination, employment law and inclusion — the areas where an unhandled complaint becomes a legal matter.
Safety & governance
Workplace safety, whistleblowing, ESG and internal controls, plus newsletters, documents and posters for reinforcement between modules.
On module length. The library is deliberately built as short modules deployed monthly or quarterly rather than one long annual course. KnowBe4 reports considerably higher on-time completion using that pattern — which matters, because a module nobody finishes produces no evidence at all.
Three frameworks, one training programme
Most Saudi organisations answer to more than one regime at once. One library, one delivery platform, one completion record — mapped so a single module can be evidenced against more than one obligation.
| Framework | What it expects of staff | Where the training answers it |
|---|---|---|
| NCA ECC 1-10 — Cybersecurity Awareness and Training Program | A defined, recurring awareness programme covering the workforce, adapted to identified risk | Compliance Plus on a monthly or quarterly cycle alongside security awareness training, with campaign records and completion data as the evidence |
| NCA ECC 1-9 — Cybersecurity in Human Resources | Cybersecurity obligations addressed through the employment lifecycle | Onboarding assignments, role-based content and records tied to individual employees |
| NCA ECC 2-7 — Data and Information Protection | Staff who handle data correctly in day-to-day work | Data privacy and protection modules on personal data handling, minimisation and leak response |
| SAMA Cyber Security Framework | Staff awareness and training as part of a governed cybersecurity programme | The same programme records, structured for a financial-sector assessment |
| PDPL | Employees who understand lawful basis, consent, data subject rights and breach escalation | Vendor privacy modules for the principles, plus your own PDPL policies loaded into the platform as custom content |
Key takeaway: no training platform makes an organisation compliant on its own. These frameworks cover governance, policy and technical control as well as awareness. What this does is close the people-shaped part of the requirement and produce the record that proves it.
What an assessor asks for, and what you hand over
The awkward moment in most assessments is not the policy. It is the request for proof that the policy reached people. Signed attendance sheets and a slide deck do not survive scrutiny.
Who was assigned what
Module assignment by individual, role and department, showing the programme was scoped to the workforce rather than a willing subset.
Who completed it, and when
Completion records with dates and quiz results, so completion means comprehension rather than a video left playing in a background tab.
That it recurs
A history of campaigns over time. Assessors look for a programme on a cycle, not a single push in the month before the review.
That it responded to risk
Evidence that content changed after an incident, an audit finding or a poor phishing result — the difference between a programme and a subscription.
Start the record before the deadline. Evidence is retrospective. A programme started three months before an assessment produces three months of history, and that is what the assessor sees. Organisations that wait for a formal deadline to begin are already short of the thing being asked for.
Compliance training in the language of the obligation
Compliance content carries more legal weight than awareness content. If an employee signs off a module on data handling or anti-bribery, the organisation is relying on that record. A module the employee did not fully understand is weak evidence, and in a dispute it is worse than none.
Arabic is supported for Compliance Plus training specifically, alongside the security awareness library, phishing templates, awareness resources and the learner interface — with more than 34 languages in total.
- One campaign, several languages — Arabic-first and English-first teams assigned together, reported together, no parallel programmes.
- Localised learner interface — the environment staff log into, not just the module contents.
- Your policies in your language — custom modules built from your own PDPL and internal policy documents.
- Comparable records — completion evidence in one report regardless of the language a module was taken in.
What Compliance Plus is not
Compliance is the wrong area to discover a limitation late.
It is not legal advice
Neither is this page. Training explains obligations to staff. It does not interpret how PDPL applies to your specific processing activities — that is work for a lawyer or a privacy consultant, and you should have one.
It does not make you compliant
NCA ECC, SAMA CSF and PDPL cover governance, policy, technical control and process. Awareness is one requirement among many. Anyone selling training as compliance in a box is selling you a false sense of position.
It is a paid add-on
Compliance Plus is licensed separately from security awareness training, though it is available at any subscription level. Your quotation will show both lines rather than surfacing the second one at renewal.
The mapping is done in-Kingdom, not in a support queue
A global vendor cannot tell you which of its 1,000 modules answers NCA ECC subdomain 2-7, or what your SAMA assessor will want to see. That translation between an international library and Saudi regulation is the part that decides whether the investment survives an assessment.
- Control mapping — modules matched to the specific NCA ECC, SAMA CSF and PDPL obligations you are being assessed against.
- Gap identification — an honest list of what the vendor library does not cover for Saudi requirements, and what to do about each item.
- Custom module build — your PDPL policies, breach escalation route and internal procedures turned into branded modules inside the platform.
- Campaign scheduling — a recurring cycle that produces continuous evidence rather than a scramble before a review.
- Reporting configured for assessors — output shaped around what a review actually asks for.
- Local commercial terms — quotation, purchase order and invoicing in Saudi Riyals through a Saudi entity, with support in Arabic and English from Dammam.
Tell us which framework you are being assessed against
Compliance Plus is priced per seat as an add-on to a KnowBe4 subscription, and quoted rather than listed. Tell us your headcount and which regime you are answering to — NCA ECC, SAMA CSF, PDPL, or all three — and we will come back with a written quotation and a first-pass control mapping so you can see what the library covers before you commit.
Compliance Plus in Saudi Arabia — common questions
-
Does Compliance Plus include a Saudi PDPL training module?
No, and no international training vendor currently ships one. The library covers data privacy and protection with content referencing GDPR, HIPAA, PCI, POPIA and a general module on global privacy regimes. PDPL rests on the same principles — lawful basis, consent, minimisation, data subject rights, breach reporting — so the concepts transfer. The Saudi-specific layer comes from loading your own PDPL policies into the platform as custom branded modules, which Blue Edge builds as part of the deployment.
-
Is Compliance Plus included with security awareness training?
No. It is a separately licensed add-on, although it is available at any KnowBe4 subscription level rather than being restricted to the higher tiers. If you already run KnowBe4 security awareness training, this adds the compliance library on top and both deploy through the same platform with combined reporting.
-
Is the content available in Arabic?
Yes. Arabic is supported for Compliance Plus specifically, as well as for security awareness training, phishing templates, awareness resources and the learner interface, with more than 34 languages in total. One campaign can run across several languages simultaneously and report as a single record.
-
What are the penalties for PDPL non-compliance?
Administrative fines reach SAR 5,000,000 per violation and can be doubled for repeat offences. Unlawful disclosure of sensitive personal data with intent to harm or gain carries criminal liability of up to two years' imprisonment. SDAIA can also suspend data processing activities. As of early 2026, SDAIA's committees had issued 48 enforcement decisions. We are not lawyers — treat this as background and take specific advice on your own exposure.
-
Can we upload our own policies and training content?
Yes, and for a Saudi deployment this is the important part. The platform accepts SCORM-compliant training and video content, and vendor modules can be branded and extended with your own policies and procedures. That is how your PDPL documentation, internal escalation routes and DPO details reach staff inside the same system that produces your completion evidence.
-
How often should compliance training run?
Monthly or quarterly, using short modules rather than one long annual course. KnowBe4 reports markedly higher on-time completion with that pattern, and assessors look for a programme running on a defined cycle rather than a single campaign shortly before a review. A recurring schedule is also what builds the history an assessment examines.
-
Does this satisfy NCA ECC and SAMA requirements?
It addresses the awareness and training elements — NCA ECC subdomain 1-10, with supporting evidence for 1-9 on cybersecurity in human resources and 2-7 on data and information protection, plus the staff awareness expectations in the SAMA Cyber Security Framework. It does not satisfy those frameworks on its own, since both cover governance, policy and technical controls as well. No training product does.
-
How is Compliance Plus priced in Saudi Arabia?
Per seat, as an add-on to a KnowBe4 subscription, billed annually and quoted rather than published. The rate moves with seat count and contract term. Blue Edge issues a written quotation in Saudi Riyals with local purchase order and invoicing terms, and includes a first-pass control mapping so you can judge coverage before committing.
Talk to Blue Edge about your compliance programme
Blue Edge has always embraced our clients and partners as part of our team. Every project is performed with open communication, and a mutual respect with our clients provides the groundwork for our success.
Tell us your headcount, the frameworks you are assessed against and when your next review falls. We will come back with a written quotation, a first-pass control mapping and an honest view of what the library covers and what will need building.