00 · The short version
A workload that touches personal — let alone sensitive — data in the Kingdom triggers PDPL/SDAIA, NDMO classification, NCA security controls and CST cloud-class registration simultaneously. The lowest-risk design is in-Kingdom hosting, no cross-border transfer, on a CST-registered provider. This page is the map, the shortcuts, and a navigator that turns your specifics into a checklist.
regulators trigger together: SDAIA · NDMO · NCA · CST
to notify SDAIA of a breach — no materiality threshold
top general fine (doubles to 10M on repeat)
The grace period ended 14 September 2024. Saudi Arabia’s Personal Data Protection Law is no longer a "prepare for later" obligation — SDAIA is issuing decisions now.[S1]
What's actually happening
Most violations to date trace back to the basics: processing without a valid legal basis, unauthorized disclosure, missing technical and organizational safeguards, and marketing without consent.[S2]
Enforcement risk raises the stakes on where data lives and how transfers happen. SDAIA still has not published an adequacy country list, so cross-border transfers run on standard contractual clauses or binding rules plus a transfer risk assessment — not on a "this country is approved" shortcut.[S3]
The regime assembled in stages: data controls, in-Kingdom regions, PDPL enforcement, and now a private-sector cybersecurity baseline. A few anchors are still pending.
4-tier data classification and 47 sub-controls for government bodies and CNI operators.
First hyperscaler in-Kingdom region; later adds Sovereign Controls by CNTXT on Class C infrastructure.
The one-year transition closes; the Personal Data Protection Law becomes fully enforceable.
SCCs become a primary safeguard for cross-border transfers while no adequacy list exists.
Refined to 4 domains and ~110 controls; all cybersecurity roles must be filled by qualified Saudi nationals.
Proposed changes to DPO rules and a 10-business-day duty to respond to SDAIA. Not yet confirmed in force.
Three availability zones around Riyadh; ~$5.3B investment.
NCA extends mandatory cybersecurity to every non-CNI private entity, tiered by size (Category A 65 controls).
SDAIA reports 48 enforcement decisions; fines up to SAR 5M, 5-day response window, power to suspend processing.
Three availability zones built in the Eastern Province; general availability confirmed for Q4 2026.
Until published (Art. 3 ARPDT), cross-border transfers rely on SCCs/BCRs plus a transfer risk assessment.
01 · The reality nobody states plainly
People look for one law that says "sensitive data must stay in-Kingdom." It does not exist as a single clause. In-Kingdom hosting is the combined result of two things: (a) PDPL cross-border-transfer rules plus SDAIA safeguards and approval, and (b) CST cloud-class licensing — where only a Class C provider may host secret / top-secret data. NDMO sets the classification; NCA sets the security controls. SDAIA has not published an adequacy whitelist, so today every cross-border transfer needs Saudi SCCs/BCRs or accreditation plus a transfer risk assessment.
Stop hunting for the one residency law. Residency is an emergent property of PDPL transfer rules + CST class licensing.
02 · The four regulators at a glance
Map your obligations to the right authority before you architect anything.
| Regulator | Governs | Key instrument | What it wants from you |
|---|---|---|---|
| SDAIA (PDPL) | Personal & sensitive data | PDPL + Implementing Reg + Transfer Reg | Lawful basis, privacy notice, ROPA, DPAs, DPO (if triggered), 72h breach notice, transfer safeguards |
| NDMO | Data classification & governance | Data Governance Policies + Classification Policy | Classify every dataset into 4 levels; apply handling rules per level |
| NCA | Cybersecurity controls | ECC-2:2024 · NCNICC-1:2025 · CCC · DCC · NCS · CSCC | Baseline ECC-2 (gov/CNI) or NCNICC-1:2025 (general private sector); add CCC if cloud, DCC for gov/CNI data, NCS for crypto, CSCC if critical/government |
| CST | Cloud provider licensing | Cloud Computing Services Provisioning Regulations | Register/qualify by class — only Class C may host secret/top-secret |
03 · Step one — classify
You cannot protect what you have not classified. Every dataset gets an NDMO level; personal data also gets a PDPL flag.
Gravest impact to national interest if exposed. Strictest handling and residency.
Serious impact. In-Kingdom, Class C hosting territory.
Limited/internal impact. Controlled access and logging.
No harm on disclosure. Residency flexible.
PDPL "sensitive data"
04 · Step two — where can it live
A practical synthesis of PDPL transfer rules + CST class licensing + NDMO levels. Treat the in-Kingdom column as the conservative default.
| Data | Where it can live | CST class to host it | Cross-border |
|---|---|---|---|
| Public / non-personal | Flexible (in or out) | A or B | Generally permitted |
| Personal (non-sensitive) | In-Kingdom preferred | A / B / C | Allowed with safeguards + TRA |
| Sensitive personal (health, biometric...) | In-Kingdom | C | Heightened scrutiny + mandatory TRA |
| Secret / Top Secret (classified) | In-Kingdom only | C only | Effectively barred |
In-Kingdom options commonly cited: AWS me-central-2, Google Cloud Dammam (with Sovereign Controls by CNTXT), Oracle, and sovereign offerings. Confirm a provider CST registration class covers your data before signing — see the verified status table below.
In-Kingdom regions — verified status
| Provider | Status | Region | Verified |
|---|---|---|---|
| AWS Middle East (Saudi Arabia) | Live since January 2026 · 3 AZs · US$5.3B | me-central-2 · Riyadh | 2026-06-26 |
| Google Cloud Dammam | Live · Sovereign Controls by CNTXT (Class C infra) | me-central2 · Dammam | 2026-06-26 |
| Microsoft Azure Saudi Arabia East | GA confirmed Q4 2026 · 3 AZs built | Eastern Province | 2026-06-26 |
Cloud regions commonly used for in-Kingdom hosting. Status verified 26 June 2026 — confirm the provider's CST registration class covers your data before signing.
05 · If any data leaves the Kingdom
SDAIA has not published a list of "adequate" countries. Until it does, you build your own safeguard for each flow.
For any transfer abroad you need an appropriate safeguard — Saudi Standard Contractual Clauses, Binding Corporate Rules, or accreditation — plus a transfer risk assessment. Transfers must not prejudice national security or the Kingdom vital interests, and must observe data minimization (minimum necessary).
Transfer Risk Assessment (TRA)
Proposed: PDPL Implementing Regulations amendments — Public consultation closed 27 May 2025. Proposed changes repeal/replace the DPO-appointment rules and add a 10-business-day duty to respond to SDAIA compliance inquiries. Treat as proposed — confirm it is in force before citing it as binding.
06 · Step three — secure it
Your baseline depends on who you are: government and critical-infrastructure entities sit on ECC-2:2024, while the general private sector now has its own mandatory floor in NCNICC-1:2025. Layer the rest by what your workload is.
| Control set | Applies when | In one line |
|---|---|---|
| ECC-2:2024 | Always (baseline) | Essential Cybersecurity Controls — the security floor for any in-scope entity |
| NCNICC-1:2025 | General private sector (non-CNI) | Non-Critical Infrastructure Cybersecurity Controls — the new mandatory baseline for private companies. Cat A (250+ FTE or > SAR 200M): 65 essential controls across Governance, Cyber Defense, and Third-party & Cloud; Cat B (SME, 6–249 FTE or SAR 3M–200M): a reduced set. |
| CCC (CCC-2:2024) | Cloud is in scope | Cloud Cybersecurity Controls — provider + tenant split of duties |
| DCC-1:2022 | Government or CNI data | Data Cybersecurity Controls — 3 domains, 47 sub-controls, and a 4-tier data classification (note: uses a “Confidential” tier where NDMO §03 says “Restricted” — map the two explicitly). |
| NCS-1:2020 | You use cryptography | National Cryptographic Standards — approved algorithms & key management. NCS-2:2025 is unverified — confirm it is in force before relying on it. |
| CSCC-1:2019 | System is critical / government | Critical Systems Cybersecurity Controls — the hardest tier |
Not sure NCA applies to you? → Does NCA cybersecurity apply to my company?
07 · If you provide hosting
If you merely consume cloud, you pick a registered provider and you are a customer. If you provide cloud/hosting services to others, you register/qualify with CST by class.
Lower-sensitivity workloads. Lightest obligations.
Mid-tier. Broader personal-data hosting.
The only class permitted to host secret / top-secret data.
Register via the National Platform (my.gov.sa) under the Cloud Computing Services Provisioning Regulations (in force since 10 Oct 2023). Verify current class definitions against the official CCSPR PDF before relying on this split.
08 · What it costs to get wrong
PDPL enforcement is active — the grace period ended 14 Sep 2024, SDAIA has issued 48 decisions, and general fines reach SAR 5M (doubling to SAR 10M on repeat).
General violations — doubles to SAR 10M on repeat
Intentional disclosure of sensitive data (imprisonment + fine)
Unlawful cross-border transfer (imprisonment + fine)
The 72-hour breach clock
09 · The shortcut
Pick what describes your workload. The navigator returns your residency posture, the CST class you need (if any), your NCA control stack, whether a DPO is likely required, sector overlays, and a tailored checklist you can copy. Conservative by design — it errs toward in-Kingdom + verify with counsel.
Answers are drawn only from the sourced knowledge base on this page and cite their [S#] source. It tells you when it has no verified source instead of guessing.
Try one:
Not legal advice. Confirm against the primary regulator documents (see Sources) and a Saudi-qualified advisor before go-live.
10 · The 90-day shortcut
The whole thing on one page, phased. This is the shortcut version of everything above.
Days 1–30
Days 31–60
Days 61–90
Not legal advice. Confirm specifics against the primary regulator documents and a Saudi-qualified advisor before go-live.
11 · Show your work
Every claim above traces to an official .gov.sa document or a flagged secondary source. Verify before you rely.
Current as of 25 June 2026 · re-verify against primary regulator sources before go-live.
12 · FAQ
Short, sourced answers to the questions teams ask first. Each links its primary source.