Introduction
Data protection and nonprofit governance in the Saudi third sector
This article examines civil associations and foundations within the Saudi third sector as a bounded setting. Data-mediated systems support eligibility assessment, donation management, volunteer coordination, and service delivery (Mayer & Fischer, Reference Mayer and Fischer2023; Xu et al., Reference Xu, Jamil, Mai, Deng, Zhang and Yang2024). Beneficiary-accountability research also shows how dependence, asymmetry, and limited voice can shape nonprofit relationships (Dewi et al., Reference Dewi, Manochin and Belal2019, Reference Dewi, Manochin and Belal2021). In this setting, personal-data practices become part of how organizations exercise discretion and understand stakeholder-facing responsibilities.
Third-sector governance research emphasizes accountability to multiple constituencies and the role of organizational transparency in making nonprofit conduct visible (Cordery et al., Reference Cordery, Belal and Thomson2019; Dewi et al., Reference Dewi, Manochin and Belal2019, Reference Dewi, Manochin and Belal2021; Ebrahim, Reference Ebrahim2003; Gálvez Rodríguez et al., Reference Gálvez Rodríguez, Caba Pérez and López Godoy2012). This literature supports framing data decisions as governance: they shape whose interests are prioritized, whose risks are considered, and how affected groups can understand or contest organizational practices.
Within this governance perspective, lawful basis choices under data protection law become a crucial point where informational power is allocated, and responsibility is structured. Decisions about how to justify processing can affect the degree of control and contestation available to beneficiaries, donors, and volunteers; the obligations of boards and managers to document and review processing; and the organization’s capacity to explain and defend its practices to regulators and the wider public.
These issues are examined here through the Saudi Personal Data Protection Law (PDPL) and its Implementing Regulations (IR) as a bounded legal case. For nonprofit governance analysis, the PDPL’s defined lawful basis structure makes basis selection visible as a governance decision that links legal justification with organizational responsibility, stakeholder accountability, and later review in data-mediated relationships with beneficiaries, donors, and volunteers.
Problem statement and research gap
Third-sector governance research has long examined how nonprofit organizations account to multiple constituencies, including beneficiaries, donors, volunteers, regulators, and the wider public. Yet in data-mediated nonprofit operations, one important governance decision remains undertheorized: how organizations justify the lawful basis for processing stakeholder data. Often treated as a legal or technical compliance step, this choice also affects how responsibility is allocated, how board oversight is exercised, and how affected groups can understand or contest organizational data practices.
The gap is therefore not only that nonprofits need clearer compliance guidance. The deeper problem is that lawful basis decisions have rarely been conceptualized as part of how nonprofit boards and senior managers structure accountability in digitalized third-sector organizations. For beneficiaries, they may shape how eligibility, service delivery, monitoring, or storytelling practices are justified. For donors, they may distinguish donation execution, statutory records, relationship management, and fundraising communications. For volunteers, they may affect scheduling, vetting, safeguarding, and incident-related data. Across these domains, a lawful basis is not merely a label attached to processing; it can organize internal responsibility, explanation of discretionary choices, and review of risks in asymmetric stakeholder relationships.
The Saudi PDPL provides a bounded analytical case for examining this problem. Its defined lawful basis structure makes basis selection a visible point at which legal justification, documentation, and organizational oversight intersect. However, the PDPL and related guidance (Kingdom of Saudi Arabia, 2021; Saudi Data & AI Authority, 2023) do not provide a nonprofit-specific account of how organizations should distinguish among purposes, select one defensible lawful basis, or connect that selection to board-level accountability for beneficiaries, donors, and volunteers. As a result, nonprofit processing may become ad hoc, over-reliant on consent, or organized around broad formulations that blur contractual necessity, statutory duty, public-interest mandates, legitimate interests, and optional communications.
Existing PDPL scholarship has mainly addressed the law’s general architecture, development, relationship to other data-protection regimes, Islamic-privacy principles, and compliance frameworks (Alkhamsi & Alqahtani, Reference Alkhamsi and Alqahtani2024; Kanojia, Reference Kanojia2023; Nusairat, Reference Nusairat2024; Sarabdeen & Ishak, Reference Sarabdeen and Ishak2024). Existing nonprofit governance scholarship has examined accountability, stakeholder influence, transparency, internal controls, and board responsibility. What remains insufficiently developed is the connection between these bodies of scholarship: a conceptual account of basis selection as a nonprofit governance problem. This article addresses that gap by using the Saudi PDPL as a bounded legal case to theorize how these decisions can be structured as board-level governance and accountability choices in digitalized third-sector organizations.
Research question and objectives
This article asks: How can lawful basis selection for processing the personal data of beneficiaries, donors, and volunteers under the Saudi PDPL be conceptualized as a board-level governance and accountability mechanism for nonprofit organizations?
Answering this question requires a framework that is grounded in nonprofit governance while remaining attentive to the legal structure of the PDPL. The analysis therefore pursues five interrelated objectives.
First, it conceptualizes lawful basis selection as a nonprofit governance problem connected to board oversight, stakeholder accountability, organizational discretion, and power asymmetries in relationships with beneficiaries, donors, and volunteers.
Second, it uses the Saudi PDPL as a bounded analytical case to interpret how lawful bases, necessity, proportionality, documentation, and review duties can become governance-relevant decisions within nonprofit organizations.
Third, it develops a criteria-based Decision Standard and seven-step lawful basis reasoning sequence for moving from defined nonprofit purposes to a defensible lawful basis, while making explicit the governance reasons for preferring one basis over available alternatives.
Fourth, it illustrates the framework across three core third-sector stakeholder domains—beneficiaries, donors, and volunteers—as conceptual applications rather than empirical findings.
Fifth, it consolidates the analysis in a Purpose–Basis–Governance matrix that presents lawful basis selection as a conceptual governance device linking defined purposes, board-level oversight, documentation, and review logic.
Contribution and structure of the paper
The article primarily contributes to debates on nonprofit governance in the context of digitalization. It argues that lawful basis selection is one site where boards and senior managers organize responsibility for data-mediated relationships with beneficiaries, donors, and volunteers. This reframing extends nonprofit governance analysis beyond general commitments to transparency, accountability, or internal control by focusing on a specific decision point: how an organization justifies processing stakeholder data for particular purposes. It develops a conceptual account of how basis choices can structure accountability, make organizational discretion reviewable, and reveal governance tensions in asymmetric stakeholder relationships.
A secondary contribution is to PDPL and data-protection analysis. The legal analysis focuses specifically on the PDPL’s lawful basis architecture and its nonprofit-governance implications. Compliance denotes adherence to the PDPL and related regulatory requirements, including selection of an available basis and performance of associated duties. Governance denotes the institutional judgment through which boards and senior managers define purposes, allocate discretion, oversee risk, and make stakeholder-facing accountability reviewable. Lawful basis selection is therefore legally constrained while also requiring institutional judgment.
The article’s conceptual outputs—a criteria-based Decision Standard, a seven-step lawful basis reasoning sequence, and a Purpose–Basis–Governance matrix—organize governance reasoning about lawful basis selection in Saudi nonprofit organizations. Because the intersection of PDPL lawful basis reasoning and nonprofit governance remains underdeveloped, the framework is developed conceptually before later empirical research can examine uptake, feasibility, organizational burden, and effects in practice.
The remainder proceeds as follows. Section “Methodology and scope” explains the conceptual governance analysis and Saudi case boundary. Section “The Saudi PDPL’s lawful basis architecture” analyzes the Saudi PDPL’s lawful basis architecture as a governance-relevant legal structure. Section “Decision Standard for lawful basis governance reasoning” develops the Decision Standard and a seven-step sequence for reviewable lawful basis reasoning. Section “Illustrative stakeholder-domain applications” illustrates the framework across beneficiary, donor, and volunteer domains. Section “Purpose–Basis–Governance matrix and evidence logic” consolidates the analysis in the Purpose–Basis–Governance matrix and evidence logic. Section “Analytical findings and discussion” presents the analytical findings and discussion, including limits of governance formalization and transferability beyond the Saudi case. The conclusion summarizes the conceptual contribution and future empirical research directions.
Theoretical positioning: Nonprofit governance, accountability, and datafication
Nonprofit governance provides the primary theoretical setting for this article. Boards help define how organizational purposes, risks, resources, and stakeholder responsibilities are interpreted and reviewed. Board-governance literature links their roles to monitoring, stewardship, resource dependence, institutional legitimacy, and boundary-spanning functions amid nonprofit missions, stakeholder pluralism, and limited performance measures (Alregab, Reference Alregab2026; Kugel & Mercado, Reference Kugel and Mercado2024; Renz et al., Reference Renz, Brown and Andersson2023). Organizational legitimacy operates here as a governance claim that must be made reviewable. The selected basis can show whether processing remains consistent with mission and stakeholder responsibilities rather than broad mission language or technical compliance. Stewardship denotes boards’ and managers’ responsibility for stakeholder data, donor resources, and mission-related information. Lawful basis selection tests whether data use remains tied to a defined service, donor, volunteer, or other purpose while making authority, risk escalation, and managerial responsibility visible.
Stakeholder accountability is the second anchor. Nonprofit organizations are accountable to audiences whose interests do not always align: beneficiaries may depend on services, donors may expect integrity in the use of funds and information, volunteers may contribute labor while remaining subject to supervision, and regulators or the wider public may expect lawful and mission-consistent conduct (Cordery et al., Reference Cordery, Belal and Thomson2019; Dewi et al., Reference Dewi, Manochin and Belal2019, Reference Dewi, Manochin and Belal2021; Ebrahim, Reference Ebrahim2003; Gálvez Rodríguez et al., Reference Gálvez Rodríguez, Caba Pérez and López Godoy2012). The beneficiary, donor, and volunteer triad marks three accountability relationships. Beneficiary processing often involves need, dependency, and limited exit; donor processing connects stewardship, communication, and fundraising boundaries; and volunteer processing sits between participation, coordination, safeguarding, and organizational control. The same legal basis may therefore carry different governance implications across stakeholder relationships.
A third anchor is digital governance and datafication. Nonprofit work increasingly depends on data-mediated systems for eligibility assessment, donor management, volunteer coordination, impact reporting, communication, and service delivery (Mayer & Fischer, Reference Mayer and Fischer2023; Xu et al., Reference Xu, Jamil, Mai, Deng, Zhang and Yang2024). Datafication can alter how nonprofit relationships are categorized, monitored, justified, and remembered. Lawful basis selection links a defined purpose to an account of necessity, discretion, and responsibility, while showing how digital operations may blur mission, administration, fundraising, safeguarding, and reporting unless governance distinctions are maintained. The ethical issue is the conversion of stakeholder relationships into administrable data categories. In Saudi nonprofit digitalization, beneficiary need, donor support, and volunteer participation may become eligibility records, donor profiles, coordination data, monitoring information, or retained organizational memory; lawful basis selection therefore tests whether that translation remains necessary, proportionate, mission-tied, and reviewable.
Power asymmetry and vulnerability provide a fourth anchor, especially in civil society settings shaped by regulatory formalization. Beneficiaries may feel unable to refuse data requests; donors may not distinguish donation administration from wider fundraising; and volunteers may accept monitoring or vetting as a condition of participation. Governance formalization can make these relationships more legible through documentation, review, and role allocation, but it can also create burden, symbolic compliance, managerialism, and capacity pressure, particularly for smaller organizations. The article therefore treats formalization as ambivalent: it may support reviewability, but it does not automatically produce accountability or trust.
The Saudi PDPL supplies the bounded analytical case through which these anchors are developed. Its relevance lies in the intersection of nonprofit formalization, digital transformation, regulatory oversight, and a data-protection framework requiring defined legal justifications. The Decision Standard, seven-step reasoning sequence, and Purpose–Basis–Governance matrix function as conceptual governance devices.
Saudi third-sector governance as the bounded analytical setting
Saudi Arabia provides the bounded governance setting because current sector instruments connect organizational form, board responsibility, internal controls, beneficiary policies, donation administration, volunteer records, reporting, and authorized supervision. Read with the PDPL and IR, these rules make data-processing justification a governance question within civil associations and foundations (Kingdom of Saudi Arabia, 2015, 2020, 2024; National Center for Non-Profit Sector, 2023, 2026).
Vision 2030 supplies the bounded policy context for nonprofit-sector development and digital transformation (Kingdom of Saudi Arabia, 2016). Digitalized enrollment, donation management, volunteer coordination, reporting, and communication make personal data part of the infrastructure of nonprofit relationships, so the basis choice allocates responsibility for purpose, discretion, documentation, and review. Islamic charitable traditions supply mission context, while the PDPL governs the justification of particular processing operations.
Formal oversight may clarify roles and create reviewable duties, but it may also raise autonomy, burden, managerialism, symbolic compliance, and capacity concerns. Nonprofit autonomy is therefore treated as bounded rather than absent. Saudi nonprofits retain discretion over service delivery, donor relations, volunteer coordination, and internal governance, but lawful basis selection makes visible when data processing reflects mission-based organizational choice and when it is shaped by sector regulation, Public Entity requests, or PDPL duties. The Saudi case is useful for international third-sector scholarship because it links nonprofit formalization, civil-society governance, datafication, board-level responsibility, stakeholder asymmetry, and the relationship between legal compliance and organizational accountability.
Methodology and scope
Conceptual governance analysis and doctrinal interpretation
This article uses conceptual governance analysis grounded in doctrinal legal interpretation. It asks how the legally structured choice of a lawful basis can be theorized as a board-level governance and accountability decision in digitalized nonprofit organizations. Doctrinal interpretation identifies the PDPL bases, duties, boundaries, and governance implications that structure discretion, documentation, stakeholder risk, and board-visible review.
The source corpus has three layers. The binding data protection layer consists of the PDPL and IR. The sector-governance layer consists of the Law of Civil Society Associations and Organizations, its current Implementing Regulations and Governance Rules, the Donation Collection Law and its Implementing Regulations, and the Volunteer Work Law (Council of Ministers, 2026; Kingdom of Saudi Arabia, 2015, 2020, 2024; National Center for Non-Profit Sector, 2023, 2026). The interpretive layer comprises selected nonprofit scholarship and non-binding data responsibility guidance on vulnerability, accountability, documentation, and impact assessment (International Committee of the Red Cross & Brussels Privacy Hub, 2020; OCHA Centre for Humanitarian Data, 2021). These materials serve as interpretive benchmarks; Saudi legal and governance sources remain controlling.
The analysis identifies the source corpus, interprets the PDPL, the IR, and nonprofit-governance instruments, organizes relevant provisions into governance categories, and translates those categories into board and senior-management functions. This sequence supports the Decision Standard, seven-step lawful basis reasoning sequence, beneficiary/donor/volunteer illustrations, and Purpose–Basis–Governance matrix.
Table 1 is a qualitative doctrinal protocol that structures the legal reading and its translation into governance functions. It makes the reasoning sequence explicit, surfaces tradeoffs, and links the legal analysis in Section “The Saudi PDPL’s lawful basis architecture” to the Decision Standard, stakeholder illustrations, and matrix.
Doctrinal coding protocol linking PDPL provisions to nonprofit-governance functions
Table 1 Long description
The table consists of two columns titled Category and Brief description/focus.
* Row 1: Lawful bases. Focuses on provisions defining lawful bases for processing under the P D P L and the I R, including scope, conditions, typical misfits, and illustrative examples.
* Row 2: Necessity and proportionality. Focuses on requirements that processing be necessary and proportionate to defined nonprofit purposes, including purpose specification, data minimization, and limits on scope and retention.
* Row 3: Documentation and D P I A duties. Focuses on statutory records of processing; governance documentation of basis selection and exclusions; and screening for, and conduct of, D P I As when I R art. 25 triggers apply.
* Row 4: Processor and transfer governance. Focuses on rules on appointing and overseeing processors and other recipients, contractual safeguards, breach notification, and conditions for cross-border transfers.
* Row 5: Board and senior-management responsibilities. Focuses on governance provisions allocating P D P L compliance and privacy responsibilities to boards and senior management, including oversight of risk management, internal controls, and review triggers.
An abbreviation note at the bottom defines D P I A as data protection impact assessment.
Abbreviation: DPIA, data protection impact assessment.
Scope, limitations, and transferability
The study is bounded institutionally, substantively, and methodologically. It examines Saudi civil associations and foundations through three stakeholder relationships—beneficiaries, donors, and volunteers—and focuses on lawful basis selection and its governance implications. Security, cross-border transfers, enforcement, processor governance, and impact assessment are considered where they directly affect that inquiry. As conceptual governance analysis grounded in doctrinal interpretation, the study develops analytical propositions; empirical evaluation of practice, outcomes, burden, and stakeholder experience lies beyond its design. Transferable elements require adaptation to different legal structures, institutional settings, organizational capacities, and stakeholder relationships.
The Saudi PDPL’s lawful basis architecture
Section “The Saudi PDPL’s lawful basis architecture” focuses on the governance-relevant choices created by the Saudi PDPL’s lawful basis architecture. The PDPL requires processing to rest on a defined legal justification rather than mission, convenience, or organizational benefit. The discussion identifies each Saudi rule, its interpretive boundary, and the governance issue carried into the Decision Standard. PDPL scholarship frames the legal context, while the PDPL and IR control questions of availability, limits, mandate, and documentation (Kanojia, Reference Kanojia2023; Nusairat, Reference Nusairat2024; Sarabdeen & Ishak, Reference Sarabdeen and Ishak2024).
Consent
Under the PDPL, consent must be freely given, purpose-specific, documented, and revocable. Where consent is relied upon for Sensitive Data, Credit Data, or solely automated decisions, it must be explicit; withdrawal must be as easy as obtaining consent (PDPL arts. 5, 7; IR arts. 11–12). Article 7 permits consent to be a condition of a service or benefit only where that service or benefit relates to the processing covered by the consent. Dependency and practical pressure therefore require scrutiny of free will and purpose separation but do not automatically make consent unavailable.
Boards should test whether consent accurately identifies the basis for the defined operation. It can support genuinely optional publicity, image use, and marketing. For initial intake before any relevant previous agreement exists, consent may also be the applicable route if the IR’s free-will, specificity, and documentation conditions are met and no other Saudi law supplies the basis. Optional secondary uses must be unbundled.
Agreement-based processing
PDPL art. 6(2) dispenses with consent where processing implements a previous agreement to which the data subject is a party. The provision does not state a contractual-necessity or indispensability test. The relied-on agreement must exist before the operation, include the data subject as a party, and be implemented by that processing. If the agreement is contractual, formation and content are determined under Saudi law: a contract arises through corresponding offer and acceptance, while negotiation alone creates no obligation to conclude it (Kingdom of Saudi Arabia, 2023, arts. 31–33, 41). A contemplated future relationship cannot support the route, although later performance or reassessment under an existing agreement may. Purpose limitation and data minimization continue independently (PDPL arts. 10–11; IR art. 19).
For nonprofit governance, this distinction separates initial intake and screening from processing that implements an existing relationship. Post-agreement service delivery, recurring donation execution, and volunteer scheduling may fall within art. 6(2) only when the three statutory elements are satisfied. Statutory records and reporting remain separate under legal obligation; donor cultivation, marketing, profiling, and later analytics require their own basis.
Legal obligation
The “pursuant to another law” limb of PDPL art. 6(2)—described here as legal obligation—requires a specific statutory or regulatory source rather than policy preference, sector custom, or administrative convenience. Processing and retention must remain tied to that source and confined to what it requires (PDPL arts. 18, 31).
Current sector rules illustrate the distinction. The current Implementing Regulations require semiannual updates of registry data concerning workers, volunteers, and beneficiaries; 10-year retention of specified financial, correspondence, and identity records; and cooperation with inspection conducted under written authorization (arts. 114, 118, 122) (National Center for Non-Profit Sector, 2023). The Donation Collection Law separately requires specified receipts, campaign reports, and annual financial documentation (arts. 4, 10, 13) (Kingdom of Saudi Arabia, 2024). Optional analytics, cultivation, and indefinite retention require independent justification.
Public Entity and public-interest routes
The PDPL distinguishes actor- and operation-specific Public Entity routes. Article 6(3) applies only when the controller is a Public Entity, and processing is required for security or judicial requirements; art. 10(3) concerns indirect collection or further processing by a Public Entity for public interest, security, another law, or judicial requirements; and art. 15(3) permits disclosure where a Public Entity requests data for those specified grounds (IR arts. 20–21). A nonprofit’s charitable purpose does not itself make it a Public Entity or create a general public-interest basis.
For nonprofits, analysis should identify the exact route, including processing pursuant to another law or disclosure under art. 15(3). Current sector regulations permit the Center and supervisory body to inspect and obtain records through written authorization; that mandate must be verified and the disclosure minimized rather than treated as unlimited sharing (National Center for Non-Profit Sector, 2023, art. 122). The governance risk is mandate creep where regulatory oversight intersects with service delivery and organizational autonomy.
Legitimate interests
The legitimate-interest basis is one of the most governance-sensitive bases under the Saudi PDPL. It is available to a nonpublic controller only where processing is necessary for a legitimate interest, does not involve Sensitive Data, and does not adversely affect the data subject’s rights and interests; it also requires a documented assessment of the proposed processing, its necessity, its impact on data subjects’ rights and interests, and the safeguards needed to avoid potential risks or harms (PDPL art. 6(4); IR art. 16). Direct Marketing should be kept separate from legitimate interests: PDPL art. 26 excludes Sensitive Data and conditions marketing on direct collection and consent, while IR art. 29 requires consent under IR art. 11 before Direct Marketing processing (PDPL art. 26; IR arts. 11, 29).
Saudi law categorically bars legitimate interests for Sensitive Data. Vulnerability, asymmetry, and high risk are not additional categorical exclusions, but they are central to the required assessment of rights and interests, reasonable expectations, necessity, safeguards, and harm; an adverse assessment requires redesign or another basis (IR art. 16). Legitimate interests may support proportionate non-Sensitive fraud or security monitoring and limited internal analytics. For governance, the basis forces the organization to articulate whose interest is advanced and whose risk is carried.
Actual interest and life-and-health routes
The Saudi PDPL and the IR distinguish Actual Interest from Vital Interest. The Actual Interest basis under PDPL art. 6(1) applies where processing serves the actual interests of the data subject and communication is impossible or difficult; IR art. 14 requires evidence of both the actual interest and the communication difficulty. Other PDPL provisions address life-and-health situations in specific collection, disclosure, and transfer contexts, but these routes should not be collapsed into a broad routine basis or used to bypass consent where communication is feasible (PDPL arts. 10(4)–(5), 15(4), 29(3)). The Actual Interest basis remains residual: it does not cover routine, foreseeable, or administratively convenient processing that can be justified through another basis.
For nonprofits, the basis may be relevant where minimal beneficiary health or location data must be shared with medical responders or search-and-rescue teams. Its governance significance lies in controlling emergency discretion. Boards and senior managers do not need to approve every urgent act in advance, but the governance framework should define emergency thresholds, minimization expectations, time limits, documentation, and post-event review. In the Decision Standard, these routes should remain separate from routine processing and should be assessed through necessity, proportionality, vulnerability, least-intrusive action, and review after the urgent condition has passed.
Decision standard for lawful basis governance reasoning
Decision standard: Criteria for selecting a defensible lawful basis
The Decision Standard translates the architecture presented in Section “The Saudi PDPL’s lawful basis architecture” into context-sensitive governance judgment. It asks why one PDPL basis is more defensible than available alternatives for a defined nonprofit purpose and how that choice makes responsibility, discretion, stakeholder impact, and later review visible.
The Standard uses six criteria: necessity, proportionality, reasonable expectations, rights impact, statutory or agreement-based duties, and less intrusive alternatives. Necessity and proportionality test whether the data are genuinely needed and whether processing is limited to the defined purpose. Reasonable expectations connect the basis to the beneficiary, donor, or volunteer relationship. Rights impact captures Sensitive Data, vulnerability, power asymmetry, and the possibility that processing may materially affect access, participation, donation, volunteering, or contestation. Statutory or agreement-based duties distinguish processing required by law or by implementation of a previous agreement from discretionary organizational use. Less intrusive alternatives ask whether the same purpose can be achieved with less data, narrower access, shorter retention, or a basis that better reflects stakeholder choice (PDPL arts. 6(1)–(4), 10–13, 18, 22, 31; IR arts. 11, 14, 16, 19, 21, 25, 29, 33).
The six criteria are applied qualitatively. Consent is tested for free will and purpose separation; agreement-based processing for the three elements of art. 6(2); legal obligation for a specific source; Public Entity routes for actor, operation, and mandate; legitimate interests for necessity, expectations, absence of Sensitive Data, and safeguards; and Actual Interest for the limited conditions in Section “The Saudi PDPL’s lawful basis architecture”. The Standard’s governance value lies in explaining the selected basis, rejected alternatives, and resulting accountability.
Seven-step sequence for reviewable lawful basis reasoning
The sequence provides a seven-stage analytical path from purpose definition to a reviewable governance record. Figure 1 shows how the six Decision Standard criteria inform Step 3 and how a material change restarts review.
Decision Standard and seven-step lawful basis reasoning sequence. The six criteria inform Step 3; material changes in purpose, data, stakeholder relationship, or governing law trigger renewed review.
Fig. 1 Long description
The flowchart consists of seven numbered steps connected by downward-pointing arrows.
1. Purpose definition.
2. Legal availability.
3. Qualitative comparison. This step contains six sub-criteria arranged in two columns. The left column includes Necessity, Reasonable expectations, and Statutory or agreement-based duties. The right column includes Proportionality, Rights impact, and Less intrusive alternatives.
4. Primary-basis justification.
5. Excluded-alternative reasoning.
6. Risk-review triggers.
7. Reviewable governance record.
Below Step 7 is a dark blue box labeled Output: Purpose-Basis-Governance matrix. A gold feedback arrow originates from this final output and points back to Step 1. Along this return path, a label states: Material change yields renewed review.
(1) Purpose definition. Define the specific nonprofit purpose, relationship domain, and intended outcome.
(2) Legal availability. Identify legally available bases, excluding those barred by Sensitive Data, lack of mandate, absence of a previous agreement, or defective consent.
(3) Qualitative comparison. Compare candidates against the six criteria, including dependency, vulnerability, and stakeholder expectations.
(4) Primary basis justification. Select the best-fitting primary basis; identify a subsidiary route only for a genuinely distinct operation, such as statutory record retention.
(5) Excluded-alternative reasoning. Explain why each plausible candidate is accepted or rejected for the defined operation.
(6) Risk-review triggers. Screen for the IR art. 25 conditions: Sensitive Data; combining, comparing, or linking two or more datasets from different sources; large-scale or recurrent processing of persons lacking capacity; continuous monitoring; emerging technology; automated decision-making; or a product or service likely to cause serious privacy harm. Vulnerability may warrant governance review even without a statutory data protection impact assessment (DPIA) trigger (PDPL art. 22; IR art. 25).
(7) Reviewable governance record. Record purpose, selected basis, excluded alternatives, DPIA status, and review trigger. This governance note is distinct from the statutory record of processing activities, which controllers maintain during processing and for 5 years thereafter (PDPL art. 31; IR art. 33); privacy notices and DPIAs remain governed by their own requirements (PDPL arts. 12–13, 22; IR art. 25).
The sequence feeds the matrix in Section “Purpose–Basis–Governance matrix and evidence logic” and Supplementary Table S1. Purpose drift, new data, changing vulnerability or scale, a new legal duty, or a Public Entity request returns the analysis to the relevant earlier step.
Illustrative stakeholder-domain applications
This section applies the Decision Standard across three conceptually distinct nonprofit accountability relationships: beneficiaries, donors, and volunteers.
Beneficiaries: Dependency, eligibility, and optional publicity
Beneficiary processing shows why purpose discipline matters in asymmetric relationships. Initial application and eligibility must be separated from post-agreement service delivery or reassessment. A contemplated future service agreement cannot itself support processing used to decide whether to form it. Consent may support initial intake where PDPL and IR conditions are met; the “another law” route applies only to an identified duty; and art. 6(2) applies only where an actual previous agreement exists, and the operation implements it. Optional publicity requires separate consent, while legitimate interests may support limited non-Sensitive secondary analysis where IR art. 16 is satisfied.
Donors: Stewardship, records, and fundraising boundaries
Donor processing illustrates the distinction between stewardship and fundraising discretion. Prospective-donor outreach and predonation intake are separate from execution of an existing donation arrangement. Article 6(2) may support post-agreement execution, including later payments under a recurring arrangement, only where a previous agreement exists, the donor is a party, and the operation implements it. Specified receipts, campaign reports, and annual records fall under the distinct statutory route, while fundraising communications and Direct Marketing are governed by consent-specific PDPL rules (Council of Ministers, 2026; PDPL arts. 25–26; IR arts. 28–29; Kingdom of Saudi Arabia, 2024). Legitimate interests may support proportionate non-Sensitive fraud or security monitoring where IR art. 16 is satisfied.
Volunteers: Coordination, safeguarding, and organizational control
Volunteer processing distinguishes application and selection from coordination after acceptance. The Volunteer Work Law requires beneficiary entities to receive, study, and decide applications and to maintain a volunteer register (arts. 7, 9), so operations confined to those duties may use the “another law” route (Kingdom of Saudi Arabia, 2020). Scheduling may use art. 6(2) only where a volunteer agreement or charter already exists, and the operation implements it. Additional suitability, safeguarding, or incident processing requires operation-specific analysis; legitimate interests remain unavailable for Sensitive Data, and Actual Interest or life-and-health routes remain exceptional.
Purpose–Basis–Governance matrix and evidence logic
The Purpose–Basis–Governance matrix aligns the legal analysis, Decision Standard, and stakeholder applications in a reviewable governance structure. It connects a defined purpose, one selected basis, excluded alternatives, and review considerations within board-visible reasoning.
Illustrative Purpose–Basis–Governance mapping across stakeholder domains
Table 2 presents the Purpose–Basis–Governance matrix as an analytical governance matrix across beneficiary, donor, and volunteer domains, showing how stakeholder purposes, lawful bases, governance reasons, and review considerations are conceptually aligned.
Analytical Purpose–Basis–Governance matrix across stakeholder domains
Table 2 Long description
The table consists of four columns: Domain and purpose, Selected lawful basis, Governance reason, and Governance reasoning made visible. It is divided into eight rows across three stakeholder categories.
1. Beneficiaries: initial application and eligibility. Basis: Consent or legal obligation. Governance: Distinguishes formation from implementation. Visible reasoning: Purpose, consent conditions, requested fields, vulnerability, and review trigger.
2. Beneficiaries: post-agreement service delivery or reassessment. Basis: Agreement-based processing or legal obligation. Governance: Separates relationship performance from intake. Visible reasoning: Agreement details, implemented function, minimization, and review trigger.
3. Beneficiaries: stories, images, and limited non-Sensitive analytics. Basis: Consent for publicity or legitimate interests. Governance: Separates optional exposure from service access. Visible reasoning: Optionality, L I assessment, and safeguards.
4. Donors: post-agreement donation execution and statutory records. Basis: Agreement-based or legal obligation. Governance: Execution and records serve distinct functions. Visible reasoning: Statutory source, receipt fields, and audit visibility.
5. Donors: fundraising, Direct Marketing, and fraud or security. Basis: Consent for marketing or legitimate interests. Governance: Marketing follows consent rules; monitoring requires necessity. Visible reasoning: Suppression routes and less intrusive alternatives.
6. Volunteers: application and selection. Basis: L O for Volunteer Work Law or consent. Governance: Statutory intake precedes agreement. Visible reasoning: Decision impact and safeguards.
7. Volunteers: post-acceptance scheduling and rostering. Basis: Agreement-based processing. Governance: Coordination tied to existing relationship. Visible reasoning: Minimal scheduling data and excluded secondary uses.
8. Volunteers: suitability, safeguarding, and incident data. Basis: Legitimate interests, L O, or emergency routes. Governance: Operations affecting participation require specific legal sources. Visible reasoning: Access limits, escalation, and D P I A screening.
Abbreviations: LI, legitimate interests; LO, legal obligation.
Read in this way, the matrix condenses the article’s claim that lawful basis selection becomes governance reasoning when purpose, basis, excluded alternatives, stakeholder risk, and review considerations remain analytically distinct.
Governance review, triggers, and evidence logic
For each purpose, the matrix connects the selected basis, excluded alternatives, DPIA status where triggered, and review points such as purpose drift, new Sensitive Data, changed scale or vulnerability, a new legal duty, a Public Entity request, or a materially changed arrangement. These points require reassessment of the fit among purpose, basis, stakeholder risk, and governance reasoning.
Governance uses and limitations of the matrix
The matrix assigns boards framework-level oversight while operational assessment remains delegated. Current sector rules require board-approved policies and internal controls and support structured delegation; beneficiary and stakeholder policies, audit, and executive risk reporting provide governance touchpoints (National Center for Non-Profit Sector, 2023, arts. 29, 58; 2026, arts. 21–22, 39–40).
For senior managers, delegated committees, and a data protection officer where IR art. 32 requires one, the Decision Standard supports context-sensitive, reviewable reasoning. It distinguishes service access from publicity, donation execution from fundraising, and volunteer coordination from supervision or safeguarding while keeping delegated judgment tied to purpose, basis, and review.
For regulators and sector supervisors, review can combine documentary evidence with substantive fit: legal duties should remain separate from discretionary uses, Public Entity routes should rest on an exact mandate, and reporting should remain proportionate to nonprofit capacity.
Portable elements include purpose discipline, stakeholder-domain differentiation, basis comparison, excluded-alternative reasoning, board-visible review, and attention to vulnerability and formalization risk. Saudi-specific elements include the PDPL architecture, Public Entity routes, Actual Interest wording, DPIA triggers, and sector-governance setting. Future research can examine how stakeholders interpret and contest the framework.
Analytical findings and discussion
This section presents five conceptual governance claims generated by reading the Saudi PDPL as a bounded legal case within nonprofit accountability theory.
Lawful basis as accountability allocation
The first finding is that lawful basis selection allocates accountability within nonprofit governance. The available bases frame processing in different ways: as optional and prospectively revocable; as tied to implementation of a previous agreement; as based on a specific legal duty; as tied to a legally grounded Public Entity or public-interest route; as justified by necessary legitimate interests with safeguards; or as limited to exceptional Actual Interest or life-and-health situations. Basis selection therefore identifies who justifies the purpose, what discretion is exercised, which alternatives are rejected, and what review follows.
Stakeholder-domain differentiation
The second finding is that nonprofit data governance cannot be reduced to one generic stakeholder relationship. Across beneficiary, donor, and volunteer processing, the same lawful basis may carry different governance implications because service dependence, financial stewardship, participation, safeguarding, and organizational control distribute power and reviewability differently. This stakeholder differentiation shows why broad mission language cannot replace purpose-specific governance reasoning.
Board oversight as reviewability infrastructure
The third finding is that board oversight operates as reviewability infrastructure through approved criteria, delegation, reporting, and escalation, while specialist operational assessment remains delegated. The Decision Standard and seven-step sequence make purpose, feasible bases, qualitative weighting, the primary basis, excluded alternatives, risk review, and the governance record visible without converting board members into data-protection specialists.
Limits and risks of governance formalization
The fourth finding is that governance formalization is ambivalent. Documentation, impact-assessment screening, matrix logic, and review triggers can clarify responsibility, but may also centralize decision-making; encourage symbolic compliance; shift attention from mission-driven stakeholder relationships to administrative control and risk-management routines; and privilege larger or better-resourced nonprofits over smaller organizations with lower legal, technical, or administrative capacity. This centralization may relocate practical discretion toward boards, senior managers, or compliance functions, rather than stakeholder-facing staff or volunteers. Formal tools may encourage organizations to treat documentation as proof of accountability where beneficiaries have limited voice, donors cannot see downstream use, or volunteers may hesitate to contest supervision-related processing. The framework’s narrower claim is conceptual: lawful basis reasoning reveals where nonprofit discretion, stakeholder asymmetry, and legal justification intersect, but that intersection still requires judgment.
International transferability
The fifth finding is that transferability is modular. The framework may inform comparative third-sector scholarship through purpose discipline, stakeholder differentiation, basis comparison, excluded-alternative reasoning, and board-visible review. Use beyond Saudi Arabia requires adaptation to different legal bases, institutional arrangements, sector capacities, and stakeholder relationships.
Conclusion
This article has argued that lawful basis selection is a nonprofit-governance decision as well as a legal one. Using the Saudi PDPL as a bounded case, it theorizes basis selection as a board-level mechanism for allocating responsibility, discretion, documentation, and review in digitalized third-sector organizations. The PDPL’s defined architecture makes visible a governance problem central to data-mediated beneficiary, donor, and volunteer relationships.
The article’s conceptual outputs—the Decision Standard, the seven-step lawful basis reasoning sequence, and the Purpose–Basis–Governance matrix—show how nonprofit organizations can move from a defined purpose to one defensible lawful basis while making the reasoning behind that choice reviewable. Across beneficiary, donor, and volunteer domains, excluded-alternative reasoning clarifies why a lawful basis may fit or fail in a particular governance context.
Empirical research is needed to evaluate implementation effects, organizational burdens, and stakeholder experience, especially because formalization may also create symbolic compliance, managerialism, or capacity pressure. The framework’s value lies in structuring context-sensitive judgment.
Future research should examine how nonprofit organizations interpret, adapt, simplify, or resist lawful basis governance in practice. Comparative work could explore similar questions under other data-protection regimes and nonprofit regulatory settings. Stakeholder-facing studies could investigate how beneficiaries, donors, and volunteers experience explanation, choice, and contestation in data-mediated nonprofit relationships. By treating lawful basis selection as a site where legal justification, stakeholder accountability, and board reviewability intersect, the article uses Saudi Arabia’s formalizing third sector as a bounded case for a wider nonprofit-governance question: how data-protection formalization may reshape accountability without being reduced to legal compliance.
Abbreviations
- DPIA
-
data protection impact assessment
- IR
-
implementing regulations
- LI
-
legitimate interests
- LO
-
legal obligation
- PDPL
-
personal data protection law
Supplementary material
The supplementary material for this article can be found at http://doi.org/10.1017/S0957876526000835.
Data availability statement
No dataset was generated or analyzed.
Author contribution
Ahmed M. Bamashmoos contributed to conceptualization, methodology, analysis, and writing (original draft and review/editing).
Funding statement
No funding was received for this study.
Competing interests
The author declares none.
Ethical standards
This study did not involve human participants, human data, or human tissue.
Consent to participate
Not applicable.
Consent for publication
Not applicable.
Open access
