SAMA & IA
Saudi Central Bank & Insurance Authority — banks, insurers & fintech
PCI SSC Qualified Security Assessor — Riyadh · Melbourne
Certified assessors.
.
We certify compliance as a PCI SSC Qualified Security Assessor — and we build SAMA, NCA, PCI DSS and PDPL programs engineered to stand before any regulator.
[ EST. 2010 — UK · RIYADH · MELBOURNE ][ 12+ FRAMEWORKS AUDITED ][ 100% ON-TIME DELIVERY ][ QSA · PCI SSC CERTIFIED ]
PCI DSSSAMA CSFSAMA ITGFSAMA BCMSAMA CTIPSAMA CRFRSAMA MVCNCA ECCNCA CCCCST CRFPDPLIA — INSURANCEPCI DSSSAMA CSFSAMA ITGFSAMA BCMSAMA CTIPSAMA CRFRSAMA MVCNCA ECCNCA CCCCST CRFPDPLIA — INSURANCE
QSA
PCI SSC approved Qualified Security Assessor for PCI DSS
0+ yrs
Combined consulting experience with enterprises and governments
0+
Regulatory frameworks audited, from SAMA CSF to PCI DSS and PDPL
0 markets
Saudi Arabia, UAE, Qatar, Bahrain, and Australia
Index of services
Every framework, navigable.
Each engagement begins with a gap assessment and ends with audit-ready assurance — structured like the standards themselves.
NCA & CST
National cybersecurity & telecom regulators
Payments & Privacy
PCI DSS certification and SDAIA’s PDPL
Security Testing
Offensive assurance for your controls
Our footprint
London. Melbourne. Riyadh.
Established in the UK in 2010. Registered in Australia. On the ground in the Kingdom — an international practice with its focus on Saudi Arabia.
Working principle
Plan. Do. Check. Act. Then again.
Compliance is not a certificate on a wall — it is a cycle. We embed the PDCA discipline into every engagement, breaking frameworks into stages your teams can plan, implement, measure, and continuously improve.
01
Plan
Gap assessment against the framework; scoped roadmap with owners and dates.
02
Do
Policies, controls, and processes implemented alongside your teams.
03
Check
Internal audit, testing, and evidence review before the regulator looks.
04
Act
Remediation, tuning, and preparation for the next cycle of the standard.
Why GRC360
Built to hold up to an auditor.
01
Experience
Led by consultants with decades across banking, government, and enterprise — trusted by large organisations to deliver when it matters.
02
Cost-effective
Fees that are competitive and in line with our skills and experience. Scoped engagements, no surprises.
03
Delivery
A 100% success rate delivering on time and within budget — we exceed client expectations, not just meet them.
The journal
Latest analysis
Data Protection · 23 Nov 2025
Saudi PDPL: When Personal Data Can Be Processed Without Consent
How to correctly apply vital, actual, and legitimate interest under the Saudi PDPL when processing personal data without consent, with practical worked examples.
Data Protection · 11 Jul 2024
Navigating the Saudi PDPL Part 1: Appointing a Data Protection Officer (DPO)
Understand when the Saudi PDPL requires a Data Protection Officer, the criteria under Article 30, and the value a DPO brings beyond compliance obligations.
Data Protection · 11 Jul 2024
Navigating the Saudi PDPL Part 2: A Step-by-Step Guide to Appointing a DPO
A practical six-step guide to appointing a Data Protection Officer under the Saudi PDPL, from assessing data processing activities to communicating the appointment.
Start the conversation
Which regulation is keeping you up
We'll bring the map.
Contact us — info@grc360.net