00 · The short version
Saudi hosting and compliance.
Where your data can live, which of PDPL, NDMO, NCA and CST covers you, and what to check before choosing a cloud region. Sources reviewed 27 September 2026, updated 10 October 2026.
By Aziz Al Khunizan, Master's in Information Security. Last updated .
Can you host data outside Saudi Arabia?
Often yes for private-sector personal data, but only with a documented legal route. Your sector or a government classification can say no.
- Personal data abroad: allowed under PDPL Article 29 and the SDAIA Transfer Regulation for a stated purpose, with the minimum data and adequate protection, through a recognised route such as standard contractual clauses, binding common rules or accreditation. Check whether Article 7 requires a risk assessment.
- Your sector can require Saudi hosting: covered SAMA member organisations need SAMA approval for cloud outside Saudi Arabia, and the CMA cybersecurity guidelines (section 4.4.3) list cloud services within Saudi Arabia.
- Government-classified data follows the competent authority’s location rules. A PDPL “sensitive” label alone is not a blanket local-hosting rule.
- Watch the draft: SDAIA’s proposed amendments, open for comment until 5 November 2026, would add a default duty to store personal data inside the Kingdom, with transfers still possible under the Law. They are not in force yet.
Check your data type and sector first, then choose the region.
regulatory frameworks to check: SDAIA · NDMO · NCA · CST
from awareness to notify SDAIA when the breach meets Article 24 criteria
maximum general administrative fine; repeat violations may increase it
01 · The reality nobody states plainly
There is no single "classification to residency" statute.
A PDPL sensitive-data label is not itself a government security classification or a universal Class C hosting requirement. Check data-governance scope, the applicable NCA controls, CST provider registration and any sector-specific restrictions separately. CCC-2:2024 removed two provider localization subcontrols and directs entities to NDMO; that change does not authorize every offshore workload.
Document which rule requires a location or approval for this workload. A cloud-region name is not evidence of compliance.
02 · The four regulators at a glance
Who governs what, and what each one wants from you.
Map your obligations to the right authority before you architect anything.
| Regulator | Governs | Key instrument | What it wants from you |
|---|---|---|---|
| SDAIA (PDPL) | Personal-data processing within statutory scope | PDPL + Implementing Regulation + Transfer Regulation | Lawful basis, privacy notice, records, processor controls, DPO where required, conditional breach notification and lawful transfers |
| NDMO | National data governance and classification within policy scope | Data Governance Policies + Classification Policy | Check whether the policy covers your organization or data; classify and apply the relevant handling rules |
| NCA | Cybersecurity for entities within each control set’s scope | ECC-2:2024 · NCNICC-1:2025 · CCC · DCC · NCS · CSCC | Determine your baseline and any NCA notification; cloud use alone does not make every control set mandatory |
| CST | Cloud service provisioning and provider registration | Cloud Computing Services Provisioning Regulations | Providers check registration requirements; customers verify the exact provider, registration category and service scope |
03 · Step one: classify
NDMO four levels, and PDPL personal / sensitive split.
Where NDMO policy applies, classify data under its four levels. Separately identify personal and sensitive data under PDPL; the two systems are not interchangeable.
Gravest impact to national interest if exposed. Strictest handling and residency.
Serious impact. Apply the competent authority’s handling and hosting requirements.
Limited/internal impact. Controlled access and logging.
No harm on disclosure. Residency flexible.
PDPL "sensitive data"
04 · Step two: where can it live
The residency matrix (derived, not a single statute).
Use this as a planning checklist. A PDPL label alone does not determine a CST registration category or authorize a transfer.
| Data | Hosting decision | Provider check | Cross-border |
|---|---|---|---|
| Public / non-personal | Check contracts and any sector rules | Verify registration and service scope | PDPL transfer rules apply only if personal data is involved |
| Personal (non-sensitive) | Local or overseas subject to applicable rules | Check provider obligations independently | Document the lawful route and any required assessment |
| Sensitive personal (health, biometric...) | Check sector rules; sensitivity alone is not a blanket local-hosting rule | No universal Class C rule based only on the PDPL label | Heightened safeguards; Article 7 assessment where triggered |
| Government-classified data | Apply the competent authority’s classification and location requirements | Confirm the approved provider category and workload | Do not transfer without confirming the applicable authority requirements |
Check each service’s availability, backups and support access as well as its region. An announced region cannot be treated as a live hosting option. Provider statements below are not a certification of your workload.
Saudi cloud regions: available and announced
| Provider | Status | Region | Verified |
|---|---|---|---|
| AWS Middle East (Saudi Arabia) | Announced · December 2026 target; not live at review | Saudi Arabia; region code not confirmed | 2026-09-27 |
| Google Cloud Dammam | Available · Class C; Saudi billing through CNTXT | me-central2 · Dammam | 2026-09-27 |
| Microsoft Azure Saudi Arabia East | Announced · November 2026; not live at review | Eastern Province | 2026-10-10 |
| Oracle Cloud Saudi Arabia | Available | Saudi Arabia West (Jeddah) · Saudi Arabia Central (Riyadh) | 2026-09-27 |
| Huawei Cloud Riyadh | Available since September 2023 | Riyadh | 2026-09-27 |
| stc cloud | Available · Class C (provider statement) | Saudi Arabia | 2026-09-27 |
Source review dates are shown per provider. A CST class shown here is the provider’s own statement; verify registration and service availability before contracting.
05 · If any data leaves the Kingdom
Document the legal route for each overseas data flow.
Do not assume that a destination is approved: this review did not locate a published SDAIA adequacy list. Check the current position for the intended destination.
PDPL Article 29 and the Transfer Regulation govern the purpose, minimum data needed and protection for a transfer. The Regulation provides adequacy and specified safeguard routes, with conditions and limited exceptions. Saudi SCCs, binding common rules and accreditation are not interchangeable permissions for every transfer; identify the provision that fits your case.
Transfer Risk Assessment (TRA)
Current transfer rules: SDAIA source. The August 2024 version remains the published text located in this review. Consultation proposals are not proof that a replacement rule has taken effect.
06 · Step three: secure it
The NCA control stack you actually have to implement.
ECC-2:2024 covers government and critical national infrastructure entities. NCNICC-1:2025 covers non-CNI private SMEs and large entities notified by NCA. Confirm your scope, category and timetable. NCA also publishes the 2026 GCCC-CSP implementation guide for cloud providers; it supports CCC-2:2024 rather than replacing it.
| Control set | Applies when | In one line |
|---|---|---|
| ECC-2:2024 | Government and CNI entities within scope | Essential Cybersecurity Controls; assess the scope before treating it as your baseline |
| NCNICC-1:2025 | Non-CNI private SMEs and large entities notified by NCA | Category A: 65 controls across 3 domains; Category B: 26 controls in 1 domain. Check the NCA notice and official sizing criteria |
| CCC-2:2024 + GCCC-CSP-2:2026 guide | In-scope government/CNI cloud tenants and providers serving them | Separate provider/tenant duties. The 2026 guide supports implementation; localization still needs NDMO, PDPL and sector review |
| DCC-1:2022 | Government and CNI entities within scope | Data protection controls; map the official classification vocabulary to your data policy |
| NCS-1:2020 | Where the applicable controls require cryptography | Check the version served by NCA; a consultation document alone does not establish a replacement standard |
| CSCC-1:2019 | Critical systems within scope | Additional critical-system controls; a government workload is not automatically a critical system |
Not sure NCA applies to you? → Does NCA cybersecurity apply to my company?
AI · If you build or use AI
AI rules: what binds you today, and what is still a draft.
No AI-specific statute was found in force at this review. Binding duties for AI systems come from the PDPL, NCA controls and sector rules; SDAIA and NCA publish frameworks and guidelines on top. Check each instrument’s status before you cite it as a requirement.
| Instrument | Issuer | Status (27 Sep 2026) | What it means for you |
|---|---|---|---|
| Personal Data Protection Law and Implementing Regulation | SDAIA | In force | Training data, retrieval and profiling need a lawful basis. A documented impact assessment (Implementing Regulation, Article 25) covers automated decisions and emerging technology. |
| AI Ethics Principles v1.0 | SDAIA | Published September 2023; registration is optional | Seven principles, including fairness, privacy and security, transparency and accountability. SDAIA also runs an AI ethics self-assessment and an AI provider accreditation service. |
| National AI Risk Management Framework | SDAIA | Launched 14 July 2026; a methodology, not a law | A national method to identify, assess, treat and monitor AI risks. Use it to structure your AI risk register. |
| Generative AI Guidelines for Government; Deepfakes Guidelines; AI Adoption Framework | SDAIA | Published guidance (2025); Deepfakes adoption status not confirmed | Practice for GenAI use, synthetic media and adoption planning. Guidance, not binding rules. |
| AI Cybersecurity Guidelines | NCA | Draft; public consultation 5 July to 5 August 2026 | Covers governance, defense, resilience and third parties, including generative and agentic AI. Not yet in force. |
| Responsible AI Policy; AI First Policy | SDAIA (NDMO) | Drafts; consultations closed 7 June and 28 July 2026 | Signals where national AI policy is heading. Not binding. |
| Global AI Hub Law | CST | Draft; consultation 14 April to 14 May 2025; not enacted | A proposed law CST published for consultation. Track it; do not rely on it until it is enacted. |
| Counter-fraud technology rules | SAMA | In force for covered financial institutions | Machine learning or AI used against fraud must not be a “black box” and must be auditable. |
| Guidance on AI and ML medical devices (MDS-G010) | SFDA | Guidance, version 1.0 (November 2022) | Classification and intended-use expectations for AI/ML-based medical devices. |
| AI Sandbox for Digital Education policy | National eLearning Center | Previously listed window: 2 September to 1 October 2026; final status unconfirmed | The listed deadline has passed. The Istitlaa draft was retrieved on 2 October 2026, but current closure or final adoption was not established. Verify with NELC before relying on it. |
07 · If you provide hosting
Check provider registration and the service you are buying.
A cloud customer and a cloud provider have different duties. CST’s class overview lists individuals, nonprofit and private-sector customers under A, B and C; the government-data scope expands by class. Check the provider’s current registration and your workload’s other requirements before contracting.
The entry registration class in CST’s structure (Decision 506/1445, Qualifying Guide v2). Check the current provider guide for what it covers.
Government public data, alongside individuals, nonprofit and private-sector customers.
Adds government data labelled Confidential in CST’s English class overview to the Class A scope.
Adds government Secret and Top Secret data to the Class B scope. Registration alone does not approve a particular workload.
Cloud regulations v4 and the provider guide v5 took effect on 10 October 2023. Data-center service operators must also assess CST’s separate Data Center Services Regulations, effective 1 January 2024. A PDPL sensitive-data flag does not automatically select Class C; confirm the relevant classification, registration conditions and sector approvals.
08 · What it costs to get wrong
Penalties, and the 72-hour clock.
The current amended PDPL distinguishes administrative violations from the specific sensitive-data offense. The former one-year/SAR 1 million cross-border offense is not in current Article 35 and has been removed from this guide.
Maximum general administrative fine under Article 36; warning also available
Article 35 sensitive-data offense: imprisonment and/or fine, with the required intent
Breach notice from awareness when Article 24 criteria are met
The 72-hour breach clock
What changes by industry.
Start with the scope of each regulator. PDPL governs covered personal-data processing; sector rules can add requirements. NCNICC covers specified non-CNI private entities notified by NCA.
Government & public sector
Regulators
Key obligations
- NDMO National Data Governance: classification, sharing, open data, freedom of information.
- NCA ECC-2:2024 (and DCC-1:2022 for data) as the cybersecurity baseline.
- Data classification drives handling, so classify before you host.
Hosting note
Apply government-data handling and cloud requirements by classification. Class C covers government Secret/Top Secret data; it is not automatically required for all government data.
The gotcha
NDMO 'Restricted' and NCA/CCC 'Confidential' can label the same level; reconcile the terminology before mapping controls.
Healthcare
Regulators
Key obligations
- Health data is sensitive under PDPL. Restrict access and processing to the staff and purposes needed for care.
- Assess transfer risks before Article 4 transfers and continuous or large-scale sensitive-data transfers.
- Confirm additional health-sector requirements for the specific entity and service.
Hosting note
Local hosting can simplify the design. PDPL sensitivity alone does not establish universal residency or Class C; a transfer needs the applicable legal route and sector review.
The gotcha
Consent and transfer safeguards do not override sector restrictions or remove the need to limit health-data access.
Financial services
Regulators
Key obligations
- For covered SAMA Member Organizations: risk assessment and provider due diligence before public/hybrid cloud adoption.
- Obtain SAMA approval before use or signing the cloud contract.
- Apply PDPL separately to personal data and international transfers.
- Capital-market entities: CMA’s cybersecurity guidelines (section 4.4.3) list using cloud services within Saudi Arabia.
- AI used against fraud must be auditable, not a “black box” (SAMA counter-fraud rules).
Hosting note
SAMA’s framework calls for Saudi-located cloud in principle; cloud outside Saudi Arabia needs explicit SAMA approval.
The gotcha
Section 3.4.3 covers public and hybrid cloud for its Member Organizations and excludes internal private cloud. Financial data alone does not establish SAMA scope.
Retail & e-commerce
Regulators
Key obligations
- Obtain consent for marketing and provide an opt-out.
- Check NCA notification and size category before determining NCNICC obligations.
- Publish a privacy notice; obtain consent before processing where consent is the lawful basis.
- E-Commerce Law Article 5: keep customer data only as long as the dealing needs, protect it, and do not disclose it without consent unless the law requires.
- E-invoicing: ZATCA allows a cloud or data centre outside Saudi Arabia if the Saudi branch can access all related records (VAT Implementing Regulations, Article 66).
Hosting note
PDPL does not impose universal local hosting for customer data. Review transfer conditions and any payment-service or sector requirements separately.
The gotcha
A purchase does not by itself supply consent for unrelated marketing.
Education & edtech
Regulators
Key obligations
- Determine guardian-consent requirements when processing data of persons lacking full legal capacity.
- Check NCA notification and category for private non-CNI entities.
- Document processor contracts and the purposes and locations of processing.
Hosting note
For student personal data, prefer in-Kingdom or safeguarded transfers; document processors handling minors' data.
The gotcha
Children’s data is not automatically PDPL-sensitive by age alone. Check both the actual data category and legal-capacity requirements.
SMEs & startups (any sector)
Regulators
Key obligations
- PDPL applies to covered personal-data processing; company size is not a general exemption.
- If notified by NCA and within the small/medium category, confirm the 26 Category B controls and the notice timetable.
- Start with lawful basis, notices, access control, backups and incident handling.
Hosting note
Choose an available service that meets the applicable hosting and transfer conditions. Verify provider registration and region availability; Class C is not a universal SME requirement.
The gotcha
Headcount alone does not establish an NCNICC duty. Check the official scope, Monshaat category and any NCA notice.
09 · The shortcut
Compliance navigator: answer four things, get your stack.
Use your answers to identify matters to check: residency, provider registration, NCA scope, DPO triggers and sector requirements. The output is a planning aid; it cannot determine every legal obligation from four answers.
Ask the compliance assistant
Answers are drawn only from the sourced knowledge base on this page and cite their [S#] source. It tells you when it has no verified source instead of guessing.
Try one:
Not legal advice. Confirm against the primary regulator documents (see Sources) and a Saudi-qualified advisor before go-live.
Which Saudi regulations apply to me?
Answer seven questions to identify the frameworks and follow-up checks relevant to your workload. Each result links to its source.
10 · The 90-day shortcut
Master checklist: one pass to go-live.
The whole thing on one page, phased. This is the shortcut version of everything above.
Days 1–30
Phase 1: Discover & classify
- Inventory every dataset and system (you cannot protect what you cannot see)
- Check NDMO scope and classify covered data: Top Secret / Secret / Restricted / Public
- Flag personal and sensitive personal data under PDPL
- Map all data flows, especially anything crossing the Saudi border
- Decide required hosting per level (residency matrix)
Days 31–60
Phase 2: Architect & document
- Choose an available region with the required service coverage; do not plan production on an unlaunched region
- Appoint a DPO where required: a public body providing services that process personal data at scale, core regular/systematic monitoring, or core sensitive-data processing
- Publish a PDPL-compliant privacy notice
- Build the ROPA (record of processing activities)
- Sign DPAs with every processor; collect sub-processor lists
- For overseas flows, document the transfer route and complete a risk assessment where Article 7 requires it
Days 61–90
Phase 3: Control & prove
- Confirm your NCA scope and any notification: ECC-2 or NCNICC as applicable; add relevant cloud/data controls
- Encryption at rest + in transit; key management per NCS
- Wire the 72-hour breach runbook, then test it
- If you are a hosting provider, register with CST (qualify by class)
- Audit the PDPL, NDMO, NCA and CST requirements that actually apply; close gaps
- Set a review cadence: re-assess classification + transfers every 12–24 months
Not legal advice. Confirm specifics against the primary regulator documents and a Saudi-qualified advisor before go-live.
PDPL obligations are already in force.
The transition period ended on 14 September 2024. Hosting decisions need to account for the current law and its implementing rules.[S1]
What the current rules require
- Article 36 provides for a warning or a fine up to SAR 5 million for covered violations. For repeat violations the fine may be doubled, up to SAR 10 million; doubling is discretionary, not automatic.
- SDAIA reported 48 violation decisions for 2025 under Article 36 (announced 16 January 2026). No total fine amount was published.
- Article 35 covers unlawful disclosure or publication of sensitive data with intent to harm the data subject or obtain personal benefit: up to 2 years and/or SAR 3 million.
- The 72-hour notification period runs from awareness when the Article 24 harm or rights/interests criteria are met.
- Assess the lawful basis, provider contract, processing locations and any overseas access before go-live.
These are scoped duties, not automatic penalties for every incident. Use the current amended law rather than penalty summaries based on the original 2021 text.[S2]
What this means for hosting decisions
Saudi hosting can simplify a residency requirement, but the main database is only one part of the flow. Check backups, logs, AI calls and overseas support access. For a transfer, document the applicable legal route and any required risk assessment.[S3]
How Saudi cloud compliance got here, and what’s next.
Selected published rules, guidance and provider announcements. An announcement or a review date is not an effective date. NELC and Azure date notes updated 2 October 2026; the wider source review remains 27 September.
- November 2023Done
Google Cloud Dammam opens↗
The me-central2 region is available; verify the services and sovereignty controls required by your workload.
- 14 September 2024Done
PDPL transition period ends↗
Personal-data processing and transfer requirements are already applicable.
- 2024 edition; July 2025 pageDone
CCC-2:2024 updates localization controls↗
Annex D removes two provider subcontrols and refers localization to NDMO. It does not grant blanket offshore-hosting permission.
- 28 December 2025Active
NCNICC-1:2025 published↗
Scope includes notified non-CNI private SMEs and large entities. Check the category and timetable in the NCA notice.
- 16 January 2026Done
SDAIA reports 48 PDPL violation decisions for 2025↗
Decisions under Article 36 covered unlawful collection or processing, disclosure without a legal basis, weak safeguards and marketing messages without consent. No total fine amount was published.
- 6 March 2026Done
PDPL accreditation and audit licensing rules published↗
Rules for accreditation certificates and for licensing audit and inspection activities appeared in Umm Al-Qura. They take effect on publication on SDAIA’s website.
- 19 June 2026Done
Government-data monetization rules published↗
Rules for turning government data into products and services. Data classified Secret or higher is excluded.
- 2026 guidanceActive
Cloud provider implementation guide↗
GCCC-CSP-2:2026, linked by NCA, helps providers implement controls and prepare evidence. It is guidance supporting CCC-2:2024.
- 14 July 2026Done
National AI Risk Management Framework launched↗
A national methodology for identifying, assessing, treating and monitoring AI risks. It is guidance, not a statute.
- 5 July to 5 August 2026Pending
NCA AI Cybersecurity Guidelines consultation closes↗
Draft guidance covering governance, defense, resilience and third parties, including generative and agentic AI. Not in force at this review.
- Previously listed deadline: 1 October 2026Pending
Consultation: AI Sandbox for Digital Education↗
The previously listed consultation deadline has passed. Istitlaa still presents the draft text retrieved on 2 October 2026; current closure and final adoption were not established. Check NELC for the final policy.
- 6 October to 5 November 2026 (consultation)Active
Draft PDPL Implementing Regulation amendments: comments close 5 November↗
SDAIA’s second-round draft is open on Istitlaa until 5 November 2026 and is not in force; it would take effect 60 days after publication in the Official Gazette. Proposed changes include: a new Article 23(2), “The Controller shall store Personal Data within the Kingdom”, with transfers still allowed under the Law and its regulations; breach notification within 72 hours without the current harm condition (Article 24); registration in the National Register of Controllers for controllers that transfer personal data abroad, among other triggers (Article 34); and a 20-business-day deadline to answer SDAIA requests. Checked on the Istitlaa project page, 10 October 2026.
- November 2026 (announced)Pending
Azure Saudi Arabia East: November 2026↗
On 31 August 2026 Microsoft said the region will be available to customers in November 2026. It was not live when checked on 10 October 2026; confirm service availability before committing.
- December 2026 (target)Upcoming
AWS Saudi region: December 2026 target↗
AWS states a December 2026 launch target. At this review the region was not live and no region code was confirmed; treat the date as a provider plan.
11 · Show your work
Primary sources & citation index.
Sources for the regulatory review and provider availability. A newer review date does not imply a new legal rule.
- govCurrent amended Personal Data Protection Law(Articles 1, 6, 26, 29, 35–36)
- govPDPL Implementing Regulation(Article 24)
- govIstitlaa: draft amendments to the PDPL Implementing Regulation(Consultation 6 October to 5 November 2026 · Not in force · Checked 10 October 2026)
- govSDAIA breach notification service and criteria(27 September 2026)
- govRegulation on Personal Data Transfer Outside the Kingdom(August 2024 · Articles 3, 4, 7)
- govNational Data Governance Policies(NDMO · Version 1)
- govEssential Cybersecurity Controls(ECC-2:2024)
- govNon-Critical Infrastructure Cybersecurity Controls(NCNICC-1:2025 · 27 September 2026)
- govCloud Cybersecurity Controls(CCC-2:2024 · Annex D)
- govCloud provider implementation guide(GCCC-CSP-2:2026 · 27 September 2026)
- govData Cybersecurity Controls(DCC-1:2022)
- govCloud Computing Services Provisioning Regulations(CST · Regulations v4 and provider guide v5 · Effective 10 October 2023)
- govCST cloud computing overview: provider registration classes(Figure 4 · Page 21 · Government-data scope by class)
- govCST Data Center Services Regulations announcement(Separate data-center registration · Effective 1 January 2024)
- govSAMA: Cloud Computing(3.4.3 · In force)
- pressAWS: Regions and Availability Zones(27 September 2026)
- pressGoogle Cloud: Dammam access, CNTXT billing and Class C registration(Documentation updated 3 September 2026 · Reviewed 27 September 2026)
- pressMicrosoft: Saudi Arabia East available in November 2026(31 August 2026 · 10 October 2026)
- govNational Cryptographic Standards(NCS-1:2020 · 27 September 2026)
- govRules for Appointing a Personal Data Protection Officer(Check appointment triggers)
- govSDAIA: 48 PDPL violation decisions for 2025(SPA · 16 January 2026)
- govPDPL accreditation certificates and audit licensing rules(Umm Al-Qura · 6 March 2026)
- govGovernment-data monetization rules(Umm Al-Qura · 19 June 2026)
- govSDAIA AI Ethics Principles(Version 1.0 · September 2023)
- govNational AI Risk Management Framework launch(SPA · 14 July 2026)
- govNCA AI Cybersecurity Guidelines (consultation)(Draft · 5 July to 5 August 2026)
- govCST: Global AI Hub Law consultation(Draft · 14 April to 14 May 2025)
- govSAMA: Counter-fraud technology(AI/ML auditability)
- govSFDA: AI and ML medical devices (MDS-G010)(Version 1.0 · November 2022)
- govCMA Cybersecurity Guidelines(Section 4.4.3 · Cloud computing)
- govZATCA e-invoicing FAQ(Data residency · VAT Implementing Regulations Article 66)
- pressAWS: Saudi Arabia region announcement(December 2026 target · Reviewed 27 September 2026)
Hosting, privacy and AI source review: 27 September 2026. NELC wording updated 2 October 2026: the listed consultation deadline has passed and final policy adoption is not confirmed. Updated 10 October 2026: Microsoft now names November 2026 for Azure Saudi Arabia East, and SDAIA’s draft amendments to the PDPL Implementing Regulation are open on Istitlaa until 5 November 2026 (not in force). Source-specific dates remain below.
12 · FAQ
Saudi cloud compliance: frequently asked.
Short, sourced answers to the questions teams ask first. Each links its primary source.
- Must all sensitive data be hosted inside Saudi Arabia?
- A PDPL sensitive-data label alone does not impose blanket localization or Category C. Check sector controls, government classification and the permitted transfer route before deciding on location.[F1]
- Can Saudi government entities host their data outside the Kingdom?
- There is no blanket permission. Government data follows NDMO classification and the competent authority’s location rules. In the cloud, use a CST-registered provider whose class covers the data level: Class A for public government data, Class B adds Confidential, Class C adds Secret and Top Secret. CCC-2:2024 refers localization to NDMO rather than permitting offshore hosting.[F13]
- Does the old cross-border prison penalty still appear in the law?
- Current Article 35 addresses unlawful sensitive-data disclosure or publication with specified intent. It does not contain the former one-year/SAR 1 million transfer offense. Other violations require assessment under Article 36 and applicable rules.[F2]
- Can I transfer personal data outside Saudi Arabia?
- Potentially, depending on purpose, destination and conditions. Identify the route under Article 29 and the Transfer Regulation; SCCs, binding common rules and accreditation apply in specified cases. Check whether Article 7 requires a risk assessment.[F3]
- Does NCNICC automatically apply to every private company?
- No. The official scope covers non-CNI private SMEs and large entities notified by NCA. Company size alone does not establish that notification. Confirm your category and timetable with NCA.[F4]
- Is the AWS Saudi region available now?
- Not yet. AWS states a December 2026 launch target for its Saudi region. At the 27 September 2026 review it was not live and no region code was confirmed. Check the provider table before choosing a region.[F5]
- Does server location alone establish compliance?
- No. Separate cybersecurity controls from lawful processing and transfer requirements. Also review backups, logs, support access, subprocessors and sector obligations.[F6]
- Does every breach require notice to SDAIA within 72 hours?
- The clock starts at awareness when the breach may harm personal data or the data subject, or conflict with their rights or interests. Assess Article 24 and document the decision; the earlier “no materiality threshold” wording was inaccurate.[F7]
- What does the 2026 cloud guide add?
- GCCC-CSP-2:2026 helps cloud providers implement CCC-2:2024 and prepare compliance evidence. It is implementation guidance, not a replacement control set or permission for offshore hosting.[F8]
- Is there an AI law in Saudi Arabia?
- No AI-specific statute was found in force at this review. AI systems are bound by the PDPL, applicable NCA controls and sector rules. SDAIA’s AI Ethics Principles and its July 2026 AI risk framework are guidance; NCA’s AI cybersecurity guidelines and the Global AI Hub Law are drafts.[F9]
- Can I use Google Analytics or Microsoft Clarity on a Saudi website?
- No Saudi rule names or bans specific analytics tools. Where a tool processes identifiable visitor data abroad, treat it as a personal-data transfer: identify the Article 29 route, disclose it in your privacy notice and assess risk where the Transfer Regulation requires it.[F10]
- Has SDAIA enforced the PDPL yet?
- Yes. SDAIA reported 48 violation decisions for 2025 under Article 36, covering unlawful collection or processing, disclosure without a legal basis, weak safeguards and marketing without consent. It did not publish a total fine amount.[F11]
- Do capital-market or e-invoicing rules require Saudi hosting?
- They differ. CMA’s cybersecurity guidelines (section 4.4.3) list using cloud services within Saudi Arabia. ZATCA allows an e-invoicing cloud or data centre outside Saudi Arabia if the Saudi branch can access all related records (VAT Implementing Regulations, Article 66).[F12]