How to Choose a Healthcare Market Research Agency in Saudi Arabia: 10 Questions to Ask — Healthcare market research agency Saudi Arabia: a 2026 buyer checklist

Choosing a healthcare market research agency in Saudi Arabia is a fieldwork and access problem before it is a brand-name problem. The Kingdom had 35.3 million residents in mid-2024 and 499 hospitals in 2023, with Riyadh and Makkah alone holding 204 of them (my.gov.sa; GASTAT 2023). A Dubai-managed “GCC average”, or a syndicated diagnostics-market slide, will not tell a brand team how a Riyadh Ministry of Health cluster, an Eastern CHI-insured private hospital and a National Guard Pharmacy and Therapeutics committee will each treat the same product. This checklist sits on our healthcare market research hub and next to our ranking of top healthcare market research companies in Saudi Arabia in 2026.

What is a healthcare market research agency Saudi Arabia?

It is a firm that designs and fields commissioned primary research with the people who diagnose, treat, fund and supply care in the Kingdom — physicians, pharmacists, payers, procurement leads, patients and caregivers — and reports the result as evidence for one decision. That decision is usually a formulary addition, a NUPCO tender, a CHI benefit question, a launch forecast or a share-of-treated-patients tracker. Country context sits on healthcare market research in Saudi Arabia. The regional sibling is our healthcare market research agency GCC page.

It is not a syndicated market-size PDF. Report publishers such as Grand View Research and IMARC Group sell Saudi healthcare and pharmaceutical outlooks that often occupy neighbouring queries. Those pages can triangulate category spend. They cannot tell you which Riyadh cluster will start a product, which Eastern CHI-insured hospital will list it, or why a non-Saudi internist in Jeddah will not. IQVIA, Ipsos and Kantar also sell custom healthcare work alongside audits and trackers. The buyer’s job is to insist that the proposal in front of you is the custom workstream, not the audit extract.

A usable healthcare market research agency in Saudi Arabia usually needs:

• An in-Kingdom field office or a named, contracted Saudi field partner — not a slide that says “MENA coverage”.
• Arabic and English instruments, and interviewers who can run both.
• Quotas that split region, nationality and public versus private versus military or National Guard.
• A written PDPL plan for health data, including any transfer outside the Kingdom (PDPL Article 29; SDAIA transfer regulation)
• A method that matches the decision: anonymous patient-record forms for treated share, in-depth interviews for P&T objections, a structured physician survey for initiation and switch. A physician-survey design is set out on physician surveys in Saudi Arabia.

Why Saudi Arabia is not a GCC average

The population file alone is enough to kill a Gulf-average brief. GASTAT’s mid-2024 estimate is 35.3 million residents, up 1.6 million from mid-2023, a 4.7% annual increase (GASTAT publication; GASTAT statistics). The national portal prints 35,300,280 (my.gov.sa). Saudis were 55.6% and non-Saudis 44.4%; males were 62.1% (GASTAT). Entitlement and out-of-pocket exposure still have to be researched by nationality.

The workforce file is the second reason. In 2023 the Kingdom had 113,300 medical doctors: 64,813 non-Saudi and 48,487 Saudi; 72,261 male and 41,039 female. Dentists were 25,970, nurses 213,110, pharmacists 36,810 (GASTAT workforce). A plan that assumes “Saudi consultants in Riyadh, English only” will miss the physicians who write the scripts. The Ministry of Health Statistical Yearbook is the regional cut of the same system (MOH yearbook page; Yearbook 2023 PDF).

The hospital file is the third. GASTAT counted 499 hospitals in 2023. Riyadh Region had 109; Makkah Region had 95 (GASTAT). That is 204 of 499, or about two in five, in two regions. Beds were 23.8 per 10,000 population nationally, but 37.7 in the Northern Borders and 36.7 in Al-Baha (GASTAT). Capacity, referral and waiting time are regional. A sample that is 80% Riyadh KOLs is a Riyadh study.

The transformation file is the fourth. Vision 2030’s 2025 annual report records life expectancy of 79.7 years in 2024, primary-care coverage of 97.5%, and a Healthcare Quality Index of 70.4% in 2025, above a 60% target. It also records completion of the first phase of health-sector transformation with the launch of 20 health clusters (Vision 2030 2025 report; annual-reports page). The Ministry of Health released the 2025 Health Sector Annual Report on 15 February 2026 (MOH, 15 February 2026). The Health Sector Transformation Program’s own 2025 report adds more than 31 million Sehati app beneficiaries (HSTP 2025). “MOH physician” is not one decision-maker. It is a cluster, a specialty and a hospital P&T.

Neighbouring systems are not substitutes. Compare healthcare market research in the UAE, Egypt and Kuwait. A Saudi CHI or NUPCO answer is not a DHA, DOH or DHAMAN answer.

The 10 questions at a glance

Use these ten questions on every proposal. They are written for a pharmaceutical, medical-device or healthcare buyer who has to defend the study to medical, access and finance. They sit beside ESOMAR’s buyer questions for online sample (ESOMAR 37 Questions; 2012 28 Questions) and ISO 20252’s service requirements for market, opinion and social research (ISO 20252:2026). They are not a substitute for those documents. They add the Saudi access and PDPL layer those documents do not write for you.

1. Where is the fieldwork actually run?

Ask for the office that will recruit, the office that will interview, and the office that will quality-check — then ask which of those three is in the Kingdom. BioNixus runs Saudi healthcare fieldwork from an Al Khobar field office. “We cover the GCC from Dubai” is a routing answer, not a field force.

A serious proposal names the cities. Riyadh holds 109 of the 499 hospitals; Makkah Region holds 95 (GASTAT 2023). Jeddah, Dammam/Khobar/Qatif and Jazan are the usual next cuts for specialty work. If the study is obesity or GLP-1, the published physician papers already show how specialty and city change the result — see our GLP-1 physician survey Saudi Arabia methods guide and the obesity research shortlist. If the study is hematology, Eastern and Jazan prevalence is not a Riyadh prevalence; that briefing is on hematology market research Saudi Arabia.

Ask who the subcontractors are. A European healthcare agency that buys a Saudi consumer panel and relabels it as “HCP fieldwork” is not a healthcare market research agency in Saudi Arabia. Write the subcontract into the contract, including PDPL processor clauses (Implementing Regulation Article 26)

Green: a named Saudi field office or a named Saudi field partner, with city-level interviewing. Red: “MENA coverage” and a project manager in Europe who has never sat in a Riyadh waiting room.

2. Can you recruit the right respondents?

Ask for the frame, not the promise. “Fifty physicians” is not a sample. Fifty endocrinologists, internists and family physicians, split by Riyadh / Jeddah / Eastern, by public versus private versus military, and by Saudi versus non-Saudi, is a sample. GASTAT’s 2023 workforce file is why the last split matters: 64,813 of 113,300 doctors were non-Saudi (GASTAT)

Ask which respondent types the brief actually needs:

• Treating physicians for initiation, switch and treated share — anonymous patient-record forms beat opinion questions.
• Pharmacists for stock, substitution and CHI-claim friction.
• Payers and P&T members as four seats, not one: MOH cluster, NUPCO, CHI, hospital committee (PPRI 2024; CHI formulary)
• Patients and caregivers when persistence, out-of-pocket and journey are the decision. CHI’s essential benefit package is the private-insurance baseline, not a clinical guideline (CHI Essential Benefit Package)

Ask for the language of the instrument and of the interview. Front-line clinics do not all run in English. A bilingual guide is a minimum on any patient or primary-care brief. Ask how the agency will find the respondent: hospital lists, licensed-professional frames, client-supplied lists, or an online HCP panel. ESOMAR’s 37 Questions exist so that the last of those four is not a black box (ESOMAR 37)

Green: a quota table with specialty, sector, region, nationality and language, and a named frame. Red: “KOLs and physicians, n=30, online, English.”

3. How do you handle PDPL and research ethics?

This is the question that separates a healthcare agency from a consumer-panel shop. The Saudi Personal Data Protection Law classifies Health Data as Sensitive Data. Health Data is any personal data related to an individual’s physical, mental or psychological condition, or to health services received (PDPL Article 1)

Article 23 of the Law requires extra controls for health data, including restricting access to medical files to the minimum staff needed to provide the health service, and restricting processing to what is needed for health services or health-insurance programmes (PDPL Article 23). Article 26 of the Implementing Regulation adds documented processing stages, role-based access, processor-contract clauses, and a minimum-necessary rule, and it points controllers at Ministry of Health, Saudi Health Council, Saudi Central Bank and CHI requirements (Implementing Regulation)

Article 29 sets the conditions for transferring personal data outside the Kingdom: an adequate level of protection, a minimum transfer, and no prejudice to national security or vital interests, with exceptions set out in the Regulations (PDPL Article 29; SDAIA regulations page). SDAIA’s controller-and-processor guide is the practical reading list (SDAIA PDPL guide). Article 36 of the Law attaches imprisonment of up to two years, or a fine of up to three million riyals, or both, to disclosing or publishing Sensitive Data in violation of the Law with intent to harm or to gain (PDPL Article 36)

Commercial market research is not automatically “research on living creatures.” The National Committee of Bioethics sets standards for biological research ethics, oversees local committees, and publishes the Law of Ethics of Research on Living Creatures and its implementing regulations (NCBE; NCBE standards; NCBE portal). If your brief is a hospital chart review, a prospective clinical protocol, or the collection of biological samples, ask which NCBE-registered local committee will review it. If your brief is a double-blind physician interview with no medical-record extract, ask the agency to say so in writing and to apply PDPL and the ICC/ESOMAR Code instead (ICC/ESOMAR Code 2025)

The 2025 ICC/ESOMAR Code, updated in July 2025, states that participation must be voluntary and based on clear information, that consent is a freely given, specific and informed indication of agreement, and that re-contact needs the data subject’s agreement except for quality control, adverse-event reporting or law (ICC/ESOMAR)

Green: a one-page PDPL note that names controller and processor, storage location, transfer legal basis, retention, and the ethics regime (commercial MR versus NCBE/IRB). Red: “We are GDPR compliant” as the entire Saudi answer.

4. How do you prove sample quality?

Ask how the agency knows the internist is an internist. Then ask what happens when they are not. BioNixus replaces non-qualifying respondents at no cost to the client and writes a minimum sample into the contract. That is a quality clause. “Best efforts” is not.

Where the sample is online, use ESOMAR’s buyer questions. The 2012 “28 Questions to Help Buyers of Online Samples” set the original transparency list for sources, recruitment and quality controls (ESOMAR 28 Questions, 2012). ESOMAR’s current publication is the 37 Questions, which updates and replaces that 2012 document and is meant as a conversation with the sample provider, not a tick-box score (ESOMAR 37 Questions). Ask for the agency’s written answers on source mix, de-duplication, identity validation, and how Saudi HCP sample is built — not a global consumer-panel appendix.

ISO 20252:2026, published in September 2026, sets vocabulary and service requirements for market, opinion and social research, including insights and data analytics. It does not apply to direct marketing (ISO 20252:2026). The Market Research Society records a three-year transition from the 2019 edition, with certification to the 2026 standard mandatory from September 2029, and retention of primary records for 12 months and project research records for 24 months unless the client agrees otherwise (MRS)

Ask whether the agency is certified to ISO 20252, works to it, or neither. Certification is not a legal requirement in Saudi Arabia. Documentation of sampling, fieldwork and quality control is still the difference between a study finance will accept and a study it will send back.

Green: identity check, de-duplication, a replacement clause, and either ISO 20252 certification or a written “we work to” statement plus ESOMAR 37 answers for any online cell. Red: an open link, a gift-voucher panel, and no way to prove the respondent’s licence.

5. Will results split by region, nationality and channel?

Ask for the banner. If the proposal offers one national percentage, it is not yet a Saudi healthcare study. The 2023 hospital file already shows why region is not optional: 109 of 499 hospitals sit in Riyadh Region and 95 in Makkah Region (GASTAT)

Nationality is the second banner. Mid-2024 residents were 55.6% Saudi and 44.4% non-Saudi (GASTAT 2024). CHI’s Q3 2025 insurance file is even more skewed: 4.5 million Saudi and 9.5 million non-Saudi beneficiaries inside a private-insurance total of more than 14 million (CHI)

Channel is the third banner. Public MOH clusters, military and National Guard hospitals, CHI-insured private groups and self-pay are different wallets and different P&T calendars (PPRI 2024). CHI itself is only the private-insurance regulator. In January 2025 it reported more than 13 million beneficiaries; by 27 October 2025 that official print was more than 14 million for the third quarter (CHI, 7 January 2025; CHI, 27 October 2025). Fourteen million privately insured people are not 35.3 million residents. A forecast that treats CHI coverage as “the Saudi market” will be sent back.

Vision 2030’s cluster model is the fourth reason to refuse a single national cell. The 2025 annual report records 20 health clusters in the first transformation phase (Vision 2030). Ask the agency which clusters it will recruit from, and whether it can name them.

Green: a dummy banner with region, nationality and channel, and a minimum cell size. Red: “nationally representative physicians, n=100.”

6. Do you separate SFDA, NUPCO and CHI?

Ask the agency to draw the access map before it draws the sample. The Saudi Food and Drug Authority is the competent authority for marketing authorisation of medicines and medical devices (SFDA). Authorisation is not reimbursement and it is not a tender award. PPRI’s 2024 Saudi pricing note describes SFDA pricing, NUPCO group purchasing, hospital Pharmacy and Therapeutics committees, and CHI control of private reimbursement as separate layers (PPRI 2024)

NUPCO is the National Unified Procurement Company. It was established in 2009, is fully owned by the Public Investment Fund, and has a registered capital of SAR 1.5 billion (PIF). It provides unified procurement, warehousing and distribution of pharmaceuticals, medical devices and supplies for government health entities (NUPCO overview; NUPCO services). A NUPCO interview is a government-supply interview. It is not a CHI interview.

CHI writes the private-insurance rules. Its Essential Benefit Package is the baseline private policy (CHI EBP). Its drug formulary is an open list of SFDA-registered medicines; additions go through a hospital P&T committee or the assigned medical director (CHI formulary). That is why “talk to payers” is an incomplete brief. You need to say which payer, in which hospital, under which benefit.

Access strategy for the registration and pricing layer sits on SFDA market access strategy. Health-economics support sits on HEOR consulting in Saudi Arabia. Company context sits on pharmaceutical companies in Saudi Arabia.

Green: four discussion guides, or four clearly marked blocks in one guide, for SFDA/pricing, NUPCO, CHI and hospital P&T. Red: a single “payer n=8” line.

7. What methods will you run in-Kingdom?

Ask which method answers the decision, then ask where it will be fielded. A share-of-treated-patients question wants anonymous patient-record forms completed by treating physicians, with incident and prevalent cases quota-controlled separately. A P&T-objection question wants in-depth interviews. An initiation-and-switch question wants a structured physician survey. A journey question wants patients and caregivers in Arabic. A syndicated outlook from Grand View Research or IMARC Group answers none of those. Neither does an IQVIA audit extract, an Ipsos brand tracker, or a Kantar usage-and-attitude deck, unless the proposal says that custom module is what you are buying.

Ask about mode. Computer-assisted telephone, online, face-to-face and hybrid each have a different non-response pattern. ISO 20252 exists so that the mode, the sampling plan and the quality steps are documented (ISO 20252:2026). Do not change from online to mall-intercept mid-study without a bridge sample.

Ask whether the instrument is in Arabic and English, and who translated it. Back-translation is a method. Google Translate in the project manager’s browser is not. Ask how adverse events will be handled if a physician or patient mentions a named product in an interview; ICC/ESOMAR treats adverse-event reporting as a lawful reason to re-contact (ICC/ESOMAR Code)

Green: a method paragraph that names the unit of observation (chart, interview, survey), the mode, the language and the decision. Red: “qual + quant mix” with no instrument and no n per cell.

8. Who owns the data, and can you re-cut it?

Ask who owns the tables, the transcripts, the recordings and the panel identities. Then ask what happens when the medical director changes the question after fieldwork. A study that cannot be re-bannered by cluster, nationality or CHI versus MOH will be re-fielded at your cost. Write client ownership of deliverables into the contract, and write the agency’s right to keep de-identified methodological records for the ISO 20252 retention window (MRS retention)

Ask where the personal data will sit. If any identified or identifiable health data will leave the Kingdom, ask for the Article 29 basis, the adequacy assessment, and the minimum-transfer argument (PDPL Article 29; SDAIA)

Ask whether the agency will append client CRM data. The ICC/ESOMAR Code requires informed consent for participation and restricts re-contact (ICC/ESOMAR). A tracker is not a remarketing list. A physician interview is not a sales lead.

Green: client-owned tables, a named storage location, a PDPL transfer paragraph if needed, and a re-cut fee or a re-cut included. Red: agency-owned data, “insights only,” and no file you can take to HEOR.

9. What is guaranteed in writing?

Ask what happens when the sample falls short, when a respondent fails a quality check, and when the instrument breaks in pilot. Then read the contract. BioNixus writes four delivery guarantees: non-qualifying respondents are replaced at no cost; a minimum sample is committed; if the field fails that sample, we re-field at our cost; the pilot fee is credited to the main study. The tagline is Guaranteed in writing. That guarantee covers the agreed scope and timeline. It does not cover the accuracy of findings, and it is not a guarantee of a particular result.

Ask the other agencies the same four questions. “Best efforts,” “indicative n,” and “subject to fieldwork feasibility” are not guarantees. They are exits. ISO 20252’s service requirements exist so that feasibility, sampling and quality control are agreed before fieldwork, not after (ISO)

Ask for the price as a range against a specified n and method, not as a teaser. BioNixus prices typical custom studies at $10k–$60k. A 200-physician treated-share PRF with payer interviews will sit at a different point on that range than a 12-interview P&T exploratory. If a proposal is far below the range and promises a national HCP sample, ask which of questions 1–8 has been dropped.

Green: minimum n, replacement, re-field, credited pilot, and a price tied to that n. Red: a discounted “GCC healthcare snapshot” with no sample clause.

10. Can you show therapy-area work without breaking confidentiality?

Ask for methods, not logos. A wall of unnamed “top-10 pharma” marks is not evidence that the agency can recruit Eastern hematologists or CHI formulary leads. Ask for a redacted discussion guide, a dummy banner, a published methods page, and two therapy-area examples that match your brief. Our own published Saudi methods pages are the GLP-1 physician survey, the obesity shortlist and the hematology launch briefing. The vendor comparison for the Kingdom is top healthcare market research companies in Saudi Arabia 2026, with a longer firm list on top healthcare market research firms in Saudi Arabia.

Ask how the agency will handle confidentiality in the other direction. Physician interviews in a small specialty — transplant, gene therapy, certain rare-disease clinics — can identify a hospital even when the name is stripped. The PDPL’s health-data minimum-necessary rule and the ICC/ESOMAR duty not to harm participants both apply (PDPL; ICC/ESOMAR)

Green: a redacted instrument, a dummy banner, and a therapy-area methods page. Red: a logo wall and a confidentiality excuse that also prevents any methods discussion.

How to choose a healthcare market research agency Saudi Arabia

Score each of the ten answers red, amber or green, then refuse to average them. One red on PDPL or on in-Kingdom fieldwork is enough to drop the proposal, even if the price is attractive. Two ambers on splits and access layers means the study will be re-cut or re-fielded after the first steering committee. Ten greens is the brief you can take to medical and finance.

Gate the proposal in order: location and PDPL first; then sample and splits; then access layers, method and data ownership; then written guarantees and therapy-area proof. Write the decision in one sentence at the top of the statement of work. The healthcare market research hub is the service map; the 2026 Saudi healthcare ranking is the vendor map.

Why choose BioNixus as your healthcare market research agency in Saudi Arabia?

BioNixus is a primary market research and market access consultancy for pharmaceutical, medical device and healthcare companies, founded in 2012. It has served 118 clients in 48 countries, has run 127 studies so far in 2026 and works with a network of about 3,200 physicians. Custom study pricing is typically $10k–$60k. Regional leadership offices are in Sheridan, Wyoming (US headquarters), London EC1V 2NX and Cairo (Sheikh Zayed, Giza). Dubai, Al Khobar and Salmiya, Kuwait (Olympia Mall) are field offices, and it is in the process of opening a São Paulo office by the end of 2026. LATAM work is covered from the US office with a strong local consultant network.

Choose BioNixus when the decision depends on why Saudi physicians, payers and patients act as they do, rather than on a syndicated market-size total. Each study is built around one decision — a formulary, a tender, a launch forecast — and is reported as share of treated patients or as a named access objection. The delivery commitment is Guaranteed in writing. That guarantee covers the agreed scope and timeline, free replacement of non-qualifying respondents, a minimum sample, re-field at our cost if that sample is missed, and a pilot fee credited to the main study. It does not cover the accuracy of findings. Where reviews are relevant, BioNixus has 40 client reviews.

See also healthcare market research in Saudi Arabia, healthcare market research agency GCC, physician surveys in Saudi Arabia, SFDA market access strategy and pharmaceutical companies in Saudi Arabia.

To brief a Saudi healthcare study, use the BioNixus contact form or email admin@bionixus.com.

References

1. General Authority for Statistics (GASTAT). Population Estimates Statistics 2024 (English). Mid-2024 estimate: 35.3 million residents. Source (accessed 15 October 2026).
2. GASTAT. Population Estimates Publication 2024 (English PDF). Total population 35.3 million in mid-2024; annual growth 4.7% versus mid-2023. Source (accessed 15 October 2026).
3. National Platform (my.gov.sa). Reports and Statistics: population in 2024 listed as 35,300,280. Source (accessed 15 October 2026).
4. GASTAT. Healthcare Establishments and Workforce Statistics Publication 2023. 499 hospitals; 23.8 beds per 10,000 population; 113,300 medical doctors (48,487 Saudi; 64,813 non-Saudi). Source (accessed 15 October 2026).
5. Ministry of Health. Statistical Yearbook landing page. Yearbook 2023 PDF and 2024 Excel listed as available downloads. Source (accessed 15 October 2026).
6. Ministry of Health. Statistical Yearbook 2023 (English/Arabic PDF). Hospitals, beds and health-manpower tables by health region, nationality and specialty. Source (accessed 15 October 2026).
7. Council of Health Insurance (CHI). More than 13 million beneficiaries of private health-insurance services in the Kingdom. News release, 7 January 2025. Source (accessed 15 October 2026).
8. CHI. 14 million beneficiaries of private health-insurance services in the Kingdom. News release, 27 October 2025. More than 14 million in Q3 2025; 10 million primary subscribers and 4 million dependents; 4.5 million Saudi and 9.5 million non-Saudi. Source (accessed 15 October 2026).
9. CHI. Basic Health Insurance Policy: Updated Essential Benefit Package (effective 1 October 2022). Source (accessed 15 October 2026).
10. CHI. CHI Drug Formulary (Dhaman). Open formulary of SFDA-registered medicines; addition requests go through a hospital Pharmacy and Therapeutics Committee or the assigned medical director. Source (accessed 15 October 2026).
11. NUPCO. Overview. Founded in 2009 and fully owned by the Public Investment Fund; unified procurement, warehousing and distribution of pharmaceuticals, medical devices and supplies for government health entities. Source (accessed 15 October 2026).
12. Public Investment Fund. The National Unified Procurement Company (nupco). Established 2009; registered capital SAR 1.5 billion; fully owned by PIF. Source (accessed 15 October 2026).
13. NUPCO. Services and business solutions: unified procurement of pharmaceuticals, medical supplies and healthcare equipment through consolidated sourcing and demand aggregation. Source (accessed 15 October 2026).
14. Saudi Vision 2030. Annual Report 2025 (English PDF). Life expectancy 79.7 years in 2024; primary-care coverage 97.5%; Healthcare Quality Index 70.4% in 2025; first phase of health-sector transformation completed with the launch of 20 health clusters. Source (accessed 15 October 2026).
15. Saudi Vision 2030. 2025 Annual Report landing page. Healthcare coverage listed at 97.5%. Source (accessed 15 October 2026).
16. Health Sector Transformation Program. Annual Report 2025 (Arabic PDF). Life expectancy 79.7 years; primary-care coverage 97.5%; more than 31 million Sehati (Sehhaty) app beneficiaries. Source (accessed 15 October 2026).
17. Ministry of Health. Ministry of Health Releases the 2025 Health Sector Annual Report. 15 February 2026. Source (accessed 15 October 2026).
18. Saudi Data & Artificial Intelligence Authority (SDAIA). Personal Data Protection Law (English translation). Health Data is Sensitive Data (Article 1). Additional health-data controls in Article 23. Cross-border transfer conditions in Article 29. Disclosure or publication of Sensitive Data in violation of the Law can carry imprisonment of up to two years or a fine of up to three million riyals, or both (Article 36). Source (accessed 15 October 2026).
19. SDAIA. Implementing Regulation of the Personal Data Protection Law (English). Article 26 (Processing Health Data) requires documented processing, role-based access, processor-contract clauses and minimum-necessary processing. Source (accessed 15 October 2026).
20. SDAIA. Guide to the Saudi Personal Data Protection Law for controllers and processors (English). Source (accessed 15 October 2026).
21. SDAIA. Laws and regulations page: Personal Data Protection Law, Implementing Regulation, and Regulation on Personal Data Transfer Outside the Kingdom. Source (accessed 15 October 2026).
22. ICC / ESOMAR. International Code on Market, Opinion and Social Research and Data Analytics (updated July 2025): participation is voluntary and based on clear information; re-contact needs agreement except for quality control, adverse-event reporting or law; consent is a freely given, specific and informed indication of agreement. Source (accessed 15 October 2026).
23. ESOMAR. 37 Questions to Help Buyers of Online Samples. Official publication page; updates and replaces the 2012 “28 Questions” document. Source (accessed 15 October 2026).
24. ESOMAR. 28 Questions to Help Buyers of Online Samples (September 2012 PDF). Predecessor buyer checklist for online sample sources, recruitment and quality controls. Source (accessed 15 October 2026).
25. International Organization for Standardization. ISO 20252:2026, Market, opinion and social research, including insights and data analytics — Vocabulary and service requirements. Edition 4, published September 2026. Does not apply to non-research activities such as direct marketing. Source (accessed 15 October 2026).
26. Market Research Society. Quality standards: ISO 20252:2026 replaces ISO 20252:2019; three-year transition, with certification to the 2026 standard mandatory from September 2029. Primary records retained for 12 months (or as agreed); project research records for 24 months (or as agreed). Source (accessed 15 October 2026).
27. PPRI / Austrian National Public Health Institute. Healthcare system and pharmaceutical pricing in Saudi Arabia (2024). Describes SFDA pricing, NUPCO group purchasing, hospital Pharmacy and Therapeutics committees, and Council of Health Insurance control of private reimbursement. Source (accessed 15 October 2026).
28. National Committee of Bioethics (NCBE). Public website and researcher portal for ethical review of research on living creatures. Source (accessed 15 October 2026).
29. NCBE. Who We Are. The National Committee sets standards for biological research ethics, oversees local committees, and sets ethical controls to safeguard rights of human subjects and confidentiality of research information. Source (accessed 15 October 2026).
30. NCBE. Standards and Regulations. Hosts the Law of Ethics of Research on Living Creatures, its Implementing Regulations, and model informed-consent forms. Source (accessed 15 October 2026).
31. Saudi Food and Drug Authority (SFDA). English home page. SFDA is the competent authority for marketing authorisation of medicines, medical devices and other regulated products in the Kingdom. Source (accessed 15 October 2026).
32. IQVIA. Global healthcare data, analytics and contract-research group. Syndicated audits and custom consulting are different products; a Saudi custom brief is not an IMS/MIDAS extract. (accessed 15 October 2026).
33. Ipsos. Global insights group with a healthcare practice. Public “ESOMAR 37” sample-provider answers describe online-sample operations, not a Saudi in-clinic hematology or payer study. (accessed 15 October 2026).
34. Kantar. Global insights group; Kantar Health / Cerner Enviza heritage is often cited on GCC healthcare RFPs. A brand-tracker methodology is not a NUPCO or CHI access study. (accessed 15 October 2026).
35. Grand View Research. Syndicated country and therapy-area outlook pages. Useful for a first cut of category spend; not a substitute for primary physician, patient or payer research. (accessed 15 October 2026).
36. IMARC Group. Syndicated Saudi healthcare and pharmaceutical report pages. Desk-research market-size documents, not commissioned fieldwork. (accessed 15 October 2026).