ENالعربية
Contact Us

Data residency Saudi Arabia: what the rules say and what depends on your data

Shield illustration for data residency Saudi Arabia, showing PDPL, NCA, In-Kingdom

Last updated 2 October 2026

Data residency is the physical location where an organisation’s data is stored and processed. In practice, data residency Saudi Arabia rules come from several instruments, and no single rule settles that location for all data. The Personal Data Protection Law (PDPL) sets conditions for moving personal data out of the Kingdom, while a requirement to keep data inside it depends on how the data is classified, your sector and your regulator.

This guide to data residency Saudi Arabia is general information, not legal advice. Confirm your position with a qualified adviser and the relevant authority (SDAIA, the NCA, CST or your sector regulator) before deciding where data is hosted.

Three terms that are often treated as one

Tenders and sales decks use data residency, data localisation and data sovereignty interchangeably. They describe different things, and mixing them up leads to the wrong questions for providers. Getting the terms straight is the first step of any data residency Saudi Arabia assessment.

Term What it means Saudi example
Data residency The country or region where data is stored and processed. Usually the organisation’s own choice or contract, sometimes shaped by a rule. Choosing an in-Kingdom data centre for a business application.
Data localisation A legal requirement that data be stored or processed inside a territory. The OECD counts explicit requirements only. A rule that a defined class of data must stay inside the Kingdom.
Data sovereignty The principle that data is subject to the laws of the country where it is held, as part of a government’s right to regulate data within its borders. Saudi law applying to data held in the Kingdom.

Residency says where the data is. Localisation is a rule that fixes where it must be. Sovereignty is about whose law governs it. A data residency Saudi Arabia position can exist with no localisation rule at all, simply because an organisation chose an in-Kingdom provider. Data localisation Saudi Arabia requirements, by contrast, exist only where a rule says so. The phrase sovereign cloud Saudi Arabia providers use in sales material is a commercial label, and we found no definition of it in the NCA, CST or SDAIA documents we reviewed. Ask any provider using it what it promises about location, who operates the service and which country’s law applies.

Data residency Saudi Arabia: what does the PDPL say about data leaving the Kingdom?

It does not require all personal data to stay in the Kingdom. Article 29 allows personal data to be transferred outside the Kingdom, or disclosed to a party outside it, for listed purposes and subject to conditions.

  • The law. Royal Decree M/19 of 9/2/1443H (16 September 2021), amended by Royal Decree M/148 of 5/9/1444H (27 March 2023).
  • In force. 29/2/1445H (14 September 2023), with up to one year to adjust, according to the Saudi Press Agency.
  • Regulations. The Implementing Regulations and the first Transfer Regulation were published on 7 September 2023. SDAIA announced an updated Transfer Regulation (version 2.0, dated August 2024) on 1 September 2024.
  • Reach. Article 2 covers processing in the Kingdom by any means, including processing by parties outside it of personal data about residents of the Kingdom.

For data residency Saudi Arabia projects, Article 29 is the provision to read closely. It allows a transfer or disclosure for four kinds of purpose. These are performing an obligation under an agreement to which the Kingdom is a party, serving the Kingdom’s interests, performing an obligation to which the data subject is a party, and other purposes set in the regulations. Three conditions apply. The transfer must not harm national security or vital interests, the data must receive protection not lower than the law’s, and only the minimum necessary data may move. The Article also has an emergency route for protecting life or vital interests, and lets the regulations define cases where a controller is exempt from the second and third conditions.

The Transfer Regulation fills in the detail that data residency Saudi Arabia projects need on PDPL cross-border data transfer. Article 2 adds central processing operations, services or benefits to the data subject, and scientific research as purposes. Article 3 provides for SDAIA to publish a list of countries and organisations with adequate protection. Article 4 sets out cases where a controller can rely on “appropriate safeguards” instead, namely standard contractual clauses issued by SDAIA, binding common rules for multinational groups, or certificates of accreditation. Article 7 requires a risk assessment before relying on those safeguards and for continuous or large-scale transfers of sensitive data. Sources from early 2026 reported that SDAIA had not yet published an adequacy list, so check before relying on adequacy.

For data residency Saudi Arabia hosting choices, this means personal data kept on in-Kingdom infrastructure is not being transferred out. It does not close every question, because Article 29 also covers disclosure to a party outside the Kingdom. Overseas support staff who can read the data, a backup held abroad or a monitoring service that exports records can each raise a transfer question. That is our reading of the wording, so put it to your legal adviser before a design relies on any of them.

Do the NCA controls require Saudi hosting?

Not in their current versions, though earlier ones did. ECC-1:2018 sub-control 4-2-3-3 required an entity’s information to be hosted and stored inside the Kingdom. CCC-1:2020 controls 2-3-P-1-10 and 2-3-P-1-11 required cloud providers to deliver services from within the Kingdom, including storage, processing, disaster recovery centres, monitoring and support. That history is why data residency Saudi Arabia advice written against the earlier versions can look out of date.

The National Cybersecurity Authority (NCA) deleted those controls in ECC-2:2024 and CCC-2:2024. Both change tables give the same reason, that controls on data localisation were transferred to the National Data Management Office (NDMO) at SDAIA. CCC-2:2024 adds that entities must refer to NDMO on localisation before acting. NCA’s website lists CCC-2:2024 with a publication date of 31 July 2025.

Scope matters too for data residency Saudi Arabia questions. The ECC applies to government agencies and their affiliated companies and entities, and to private-sector entities that own, operate or host critical national infrastructure (CNI). The NCA encourages everyone else to use it. The NCA cloud cybersecurity controls (CCC) extend the ECC to cloud computing, for providers serving those in-scope customers and for the customers themselves.

The cloud controls that remain still matter. ECC-2:2024 control 4-2-3 requires, as a minimum, that data be protected in line with its classification and returned in a usable format when the service ends (4-2-3-1), and that the entity’s virtual environments be kept separate from other tenants’ (4-2-3-2). A provider that evidences NCA compliance has answered a security question, not a data residency Saudi Arabia question.

What do CST and NDMO add?

CST registers cloud computing service providers under its Cloud Computing Services Provisioning Regulations. Version 4 was approved by CST decision 506/1445 on 8 October 2023 and took effect on 10 October 2023. Providers register in a Qualifying category or in Class A, B or C, matching the classification of subscriber data they are qualified to deal with. “Registered with CST” is therefore not one fact, because the category shows what a provider may host for you. A provider’s CST category is a useful early check in any hosting tender.

NDMO sits within SDAIA and sets the national data classification policy for data residency Saudi Arabia decisions, which sorts data into four levels by the impact of unauthorised disclosure. Classification is usually the first input to a hosting decision, because CST’s provider categories and the NCA’s cloud controls are both tied to it.

What decides data residency Saudi Arabia requirements for your data?

The deciding instrument depends on what the data is and who holds it. This table maps each kind of data to the instrument that mainly decides the question.

Your data or organisation What mainly decides where it may sit What to check
Personal data, any organisation PDPL Article 29 and the Transfer Regulation. These set conditions for transfers abroad rather than a general storage requirement. Every place a copy or access exists, including backups, support access and sub-processors, and the transfer basis for any abroad.
Government entities, and owners, operators or hosts of CNI Data classification, NDMO’s localisation requirements, ECC-2:2024 and CCC-2:2024 (which apply by scope), the provider’s CST category and any sector regulator’s rules. Classification of each dataset, the provider’s CST category, and NDMO’s current requirements.
Banks, insurers and other financial institutions SAMA’s rulebook, which includes sections on outsourcing and cloud computing, and the PDPL for personal data. SAMA’s current rules before any outsourcing or cloud decision.
Other regulated sectors The sector regulator’s own rules. Ask the regulator in writing and keep the reply.
Everything else The PDPL for personal data. Contracts, tender terms and other laws can add location requirements for particular records. Contract clauses and records-retention rules.

Data residency Saudi Arabia questions to put to a hosting provider

  1. Where are production data, backups, disaster recovery copies, logs and monitoring data held? Ask for the answer per copy, in writing.
  2. Who can administer or read the data, from which countries, and through which sub-contractors?
  3. Which CST category does the provider hold, and for which data classifications?
  4. Which NCA controls can the provider evidence, and against which versions?
  5. For personal data, what is the transfer basis for anything outside the Kingdom, and who carries out the risk assessment?
  6. How is data returned and deleted at exit? CCC-2:2024 control 2-6-T-1-1 expects tenants to have an exit strategy for secure disposal of data when a contract ends.

Recovery copies belong on that list. A disaster recovery replica is still your data, so assume the rules for the primary copy apply to it as well, and extend any data residency Saudi Arabia check to cover it (see RPO and RTO explained for how recovery targets shape what you replicate).

Hybrid designs are a common answer when only some workloads are tied to the Kingdom. Regulated data stays on premises or in an in-Kingdom environment while other workloads use public cloud. WASNA Digital Solutions designs sovereign, hybrid and multi-cloud architectures around these questions, starting with data classification, and treats data residency Saudi Arabia requirements as an input to the design rather than an afterthought.

Map your systems to a hosting decision before you choose a provider

Bring a list of your main systems and the data each one holds. A WASNA Digital Solutions consultant will come back with the classification and regulator questions that shape the scope.

Request a data residency Saudi Arabia assessment

Sources

In this article

Talk to the team

Describe your situation and a WASNA Digital Solutions consultant will reply with where to start.

Contact WASNA
Share this article

Keep reading

More from the same topic.
See all articles