Drafting & Review of Policies and Regulations

What do we offer in this area?

• Reviewing existing regulations and procedures
• Drafting policies and clarifying responsibilities
• Updating documents in line with the business's needs

The scope of work and required documents are determined after reviewing the matter and agreeing on the engagement.

The Work Organization Bylaw: The Internal Framework for Employee Relations

The Ministry of Human Resources and Social Development sets a standard template for the work regulations, and the employer must prepare its regulations in accordance with it and post it, along with any amendment, in a visible place or by a means that ensures employees are aware of it. The regulations cover working hours, leave, violations, penalties, and grievance procedures. The value of the work lies not in copying the template, but in adapting it to the business's activity, work shifts, and locations, without falling below the minimum set by the law.

• Reviewing the existing regulation and comparing it against the standard template and the 2025 amendments
• Preparing the table of violations and penalties to suit the business's activity
• Organizing investigation and grievance procedures within the regulation
• Aligning the regulation with employment contracts and actual practice

Privacy Policy and the Personal Data Protection Law (PDPL)

The Personal Data Protection Law came into force on September 14, 2023, and requires the data controller to adopt a privacy policy and make it available to data subjects when their data is collected. This covers customer data on the website and applications, as well as employee and job applicant data. The Saudi Data and Artificial Intelligence Authority (SDAIA) publishes guidance for preparing this policy, and the Privacy Policy on the office's website can be viewed as a practical example of a policy addressed to visitors.

• Identifying the data the business collects and the purposes of collecting it
• Drafting the external privacy policy and employee notices
• Policies for data retention, destruction, and disclosure

The code of conduct and internal policies

A code of conduct sets out the standards expected of employees and management regarding conflicts of interest, gifts, confidential information, and the use of the business's assets and communication channels. The code supplements the internal work regulation and does not replace it, and for a breach of it to have disciplinary effect, it must be linked to the table of violations and penalties in the approved regulation. These policies are connected to the business's Governance & Compliance framework.

How are policies and regulations prepared and updated?

The work begins by gathering the existing bylaws and policies and understanding the company's structure and decision-making process, then identifying the gaps between them and the applicable regulations. Drafts are then written in clear language that both the direct manager and the employee can understand, discussed with management before adoption, and a schedule is proposed for periodic review or whenever a statutory amendment is issued, such as the Labor Law amendments effective February 2025. This service integrates with HR Legal Advisory when applying the policies to actual cases.

Frequently asked questions

Must a company prepare a work organization bylaw?

The Labor Law requires the employer to prepare a work regulation for the business according to the standard template set by the Ministry of Human Resources and Social Development, and to announce it to employees in a visible place or by a means that ensures they are aware of it. It is advisable to check the Ministry's current approval requirements on its e-services, as they are updated from time to time.

Does a business need a privacy policy if it does not have a website?

The obligation is tied to collecting and processing personal data, not merely to having a website. A business that collects data on customers, employees, or job applicants by any means needs a policy explaining the purposes and method of collection and the rights of data subjects. The level of detail varies with the volume and sensitivity of the data and the nature of the business's activity.

When should a business's regulations and policies be reviewed?

There is no single period for all businesses, but review is advisable when a significant legal amendment is issued, when the business's activity or structure changes, and when a recurring dispute reveals a gap in the drafting. Some businesses set a fixed annual review within their compliance plan, documenting the date of each version and what changed in it.