Governing Lawful Basis Selection in the Saudi Third Sector: Nonprofit Accountability under the Personal Data Protection Law

Abstract Third-sector organizations manage beneficiary, donor, and volunteer relationships through data-mediated systems, yet lawful basis selection is often treated as legal compliance rather than nonprofit governance. This article addresses that gap through conceptual governance analysis grounded in doctrinal interpretation of the Saudi Personal Data Protection Law. It argues that lawful basis selection can operate as a board-level accountability mechanism by allocating responsibility for purpose definition, discretion, excluded alternatives, stakeholder risk, and review. The article recasts basis selection as nonprofit governance and develops three connected outputs: a Decision Standard, a seven-step reasoning sequence, and a Purpose–Basis–Governance matrix that structure reviewable judgment across beneficiary, donor, and volunteer relationships.