Data Localization Requirements in Saudi Arabia

“Does Saudi Arabia require data localization?” is usually not the most useful first question. A business should instead ask what data it holds, whether that information is personal or sensitive data, which regulator governs the organization, where the data is stored and processed, and who can access it from outside Saudi Arabia.

Saudi Arabia’s framework combines personal-data transfer rules, cybersecurity requirements, cloud regulation and sector-specific controls. As a result, an architecture that may be permissible for one commercial business may be unsuitable for a regulated financial institution or an organization processing government or critical-system data.

01  
Does Saudi Arabia Require All Data to Be Stored Locally?

No. There is no single universal requirement under the PDPL stating that every category of private-sector business data must remain physically inside Saudi Arabia.

Instead, the analysis may involve several regulatory layers, including the PDPL’s rules on transfers outside the Kingdom, SDAIA’s Transfer Regulation, cybersecurity requirements, cloud-provider regulation and stricter requirements applicable to particular regulated industries.

A company should therefore avoid treating “data localization” as one binary legal question. The legal answer depends on the nature of the data and the organization processing it.

02  
Localization, Residency and Cross-Border Transfer Are Different Concepts

—	Data localization — a requirement to keep specified data, processing or infrastructure within a defined jurisdiction.
—	Data residency — the geographical location in which data is stored.
—	Cross-border transfer — transferring, disclosing or granting access to personal data from Saudi Arabia to a controller, processor or other recipient outside the Kingdom.
—	Remote access — offshore access to Saudi-held personal data may itself form part of the transfer analysis even where the primary server remains physically located in Saudi Arabia.

This distinction matters in modern cloud environments. A database physically hosted in Riyadh may still be accessible to a support team, administrator, parent company or subprocessor outside Saudi Arabia. Conversely, an international technology provider may operate infrastructure within the Kingdom.

The relevant analysis should therefore follow the actual data flow, rather than simply the nationality of the technology provider.

03  
Article 29 of the Saudi PDPL

Article 29 of the Personal Data Protection Law is the central statutory provision governing transfers and disclosures of personal data outside Saudi Arabia.

Article 29 permits a controller, subject to the conditions set by the Law, to transfer personal data outside the Kingdom for specified purposes. These include performing an obligation under an agreement to which Saudi Arabia is a party, serving the interests of the Kingdom, performing an obligation to which the data subject is a party, and other purposes established by the Regulations.

The transfer is also subject to statutory conditions. In particular, the transfer or disclosure must not prejudice Saudi national security or the Kingdom’s vital interests; the level of protection outside the Kingdom must meet the standard required under the Saudi framework; and the transfer must be limited to the minimum amount of personal data necessary.

Article 29 also contains a limited exception from certain requirements in cases of extreme necessity involving the life or vital interests of the data subject or the prevention, examination or treatment of disease.

04  
The Transfer Regulation and Additional Permitted Purposes

SDAIA’s current Regulation on Personal Data Transfer Outside the Kingdom supplements Article 29 and gives further detail on how cross-border transfers should be assessed.

Article 2 of the Transfer Regulation recognizes additional purposes including:

—	performing necessary central processing operations that enable the controller to conduct its activities;
—	providing a service or benefit to the data subject; and
—	conducting scientific research and studies.

“Central processing operations” are particularly relevant to multinational organizations because the Transfer Regulation expressly identifies operational processes such as human resources, billing and accounting.

However, identifying a permitted purpose does not by itself remove the other requirements of the Law and Transfer Regulation.

05  
Appropriate Levels of Personal Data Protection

Article 3 of the Transfer Regulation provides for the competent authority to publish and periodically review a list of countries or international organizations that provide an appropriate level of personal data protection.

The assessment considers issues including the destination’s personal-data protection laws, enforceable data-subject rights, the existence and effectiveness of a supervisory authority, rules governing disclosure, international commitments and protections governing subsequent transfers.

A company should therefore not assume that a jurisdiction automatically satisfies the Saudi adequacy standard simply because it has GDPR-style legislation, an active privacy regulator, or an adequacy determination issued by another jurisdiction.

The current status of the destination should be checked against SDAIA’s official material at the time the transfer is assessed.

06  
Standard Contractual Clauses, Binding Common Rules and Accreditation

Article 4 of the Transfer Regulation identifies specified situations in which a controller may be exempted from complying with one or both of the Article 29 requirements relating to the appropriate level of protection and the minimum amount of data transferred, provided the applicable safeguards and conditions are satisfied.

The Regulation identifies three categories of appropriate safeguard:

 

—	Saudi Standard Contractual Clauses (SCCs) — standard clauses issued by SDAIA for cross-border transfers. They are a Saudi regulatory instrument and should not be confused with EU Standard Contractual Clauses.
—	Binding Common Rules (BCRs) — rules established within a group of multinational entities to govern qualifying transfers between controllers and processing parties within that group.
—	Certificate of Accreditation — an accreditation mechanism recognized by the Transfer Regulation, subject to the rules issued by SDAIA governing accreditation certificates and entities licensed to issue them.

These safeguards are not interchangeable in every case. Article 4 links particular safeguards to particular transfer scenarios.

For example, where central operations involve a controller that is part of a multinational group, the Regulation provides for Binding Common Rules or Saudi Standard Contractual Clauses, or the applicable accreditation route, subject to the conditions of Article 4.

Adoption of a safeguard also does not eliminate the controller’s remaining obligations under the PDPL and its Regulations.

07  
When Is a Cross-Border Transfer Risk Assessment Required?

The Saudi Transfer Regulation does not require a formal transfer risk assessment for every routine cross-border interaction.

Under Article 7 of the Transfer Regulation, the controller must conduct a risk assessment before transferring or disclosing personal data outside the Kingdom in two principal situations:

 

—	where the transfer or disclosure is made in accordance with Article 4 of the Transfer Regulation; or
—	where Sensitive Data is transferred or disclosed outside the Kingdom on a continuous or widespread basis.

The assessment should address the purpose and legal basis of the transfer, the nature and geographical scope of the processing, the safeguards in place, data-minimization measures where applicable, the potential material or moral effects on data subjects, the likelihood of those risks and measures designed to prevent or mitigate them.

For corporate compliance teams, this means transfer decisions should be supported by documented analysis rather than by a general assumption that a vendor’s contractual terms are sufficient.

08  
Sensitive Personal Data

The PDPL’s definition of Sensitive Data includes specified personal data relating to racial or ethnic origin, religious, intellectual or political beliefs, security-related criminal convictions and offenses, biometric or genetic information used to identify a person, health data, and information indicating that one or both parents of an individual are unknown.

Businesses should use the Saudi statutory definition rather than assuming that the categories are identical to the GDPR or another foreign privacy regime.

Continuous or widespread cross-border transfers of Sensitive Data are especially significant because Article 7 of the Transfer Regulation expressly brings those transfers within the risk-assessment requirement.

09  
Must Saudi Business Data Be Hosted on Servers in Saudi Arabia?

Not necessarily for every company and every category of data.

The answer depends on factors such as:

—	whether the information qualifies as Personal Data or Sensitive Data;
—	whether data is transferred, disclosed or made accessible outside Saudi Arabia;
—	whether the organization is regulated by SAMA or another sector regulator;
—	whether NCA controls apply to the entity or system;
—	whether government or contractually classified information is involved; and
—	where primary data, backups, disaster-recovery copies and administrative access are located.

The PDPL should therefore not be described as a universal Saudi cloud-localization mandate.

10  
CST’s Cloud Computing Regulatory Framework

The Communications, Space & Technology Commission (CST) regulates the provision of cloud computing services through its Cloud Computing Services Provisioning Regulations.

CST approved Version 4 of those Regulations together with updated provider and registration guides, with the revised framework taking effect in October 2023.

The framework addresses cloud-service-provider registration and the regulatory operation of cloud services in Saudi Arabia.

For corporate customers, the practical point is to distinguish between:

—	regulatory obligations imposed directly on the cloud service provider;
—	PDPL obligations governing the customer’s personal-data processing;
—	cybersecurity requirements applicable to the customer; and
—	any stricter rules imposed by the customer’s own sector regulator.

CST regulation of cloud providers should not therefore be converted into a general statement that every ordinary private company must store all business data locally.

11  
NCA Cybersecurity Controls

The National Cybersecurity Authority (NCA) maintains several cybersecurity-control frameworks, including Essential Cybersecurity Controls, Cloud Cybersecurity Controls, Data Cybersecurity Controls and Critical Systems Cybersecurity Controls.

These instruments address cybersecurity rather than simply personal-data privacy. Their scope should therefore be checked before applying an NCA requirement to a particular private business, system or dataset.

In practice, cybersecurity obligations can become particularly relevant to government entities, national critical systems, critical infrastructure, priority sectors and entities falling within the scope of the relevant NCA control.

12  
Government and Classified Data

Government information and data processed for government entities may be subject to requirements that differ from those applicable to an ordinary private-sector commercial database.

A private-sector contractor should therefore review:

—	the classification of the information involved;
—	the cybersecurity controls applicable to the relevant system;
—	the procurement or government contract;
—	cloud-service conditions; and
—	any sector-specific regulatory requirements.

The fact that one government-facing project requires stricter residency or cybersecurity controls does not mean those same controls automatically apply to all data processed by the contractor.

13  
Does the PDPL Apply to Foreign Companies With No Saudi Presence?

Potentially, yes. The PDPL extends to processing of personal data relating to individuals residing in Saudi Arabia where that processing is carried out by a party outside the Kingdom.

This is important for international:

—	SaaS providers;
—	multinational employers;
—	global e-commerce platforms;
—	foreign group companies; and
—	international processors handling Saudi-resident data.

The Saudi territorial-scope analysis should be applied according to the wording of the PDPL rather than by importing the GDPR’s territorial tests into Saudi law.

14  
Controller vs Processor: Outsourcing Does Not Eliminate Responsibility

The PDPL distinguishes between a Controller, which determines the purpose and manner of processing personal data, and a Processor, which processes personal data for the benefit and on behalf of the Controller.

Responsibility for decisions about processing may also be shared among multiple Controllers depending on how the processing activity is structured.

A foreign affiliate receiving data from a Saudi business may therefore be:

—	a Controller;
—	one of multiple Controllers involved in the processing; or
—	a Processor acting on the Saudi Controller’s instructions.

The legal classification depends on the actual role performed, not merely the group’s organizational chart or the title given to the party in a contract.

The Implementing Regulations also place ongoing responsibilities on Controllers when selecting and monitoring Processors. Outsourcing data to a cloud provider, payroll vendor, CRM service or managed-service provider therefore does not remove the Controller’s compliance responsibilities.

15  
Two Situations That Commonly Create Cross-Border Issues

A SaaS platform with distributed operations. A Saudi company’s main database may be hosted within the Kingdom while support staff outside Saudi Arabia access customer tickets, backups are replicated to another jurisdiction, analytics run offshore and a foreign subprocessor handles logs.

The legal analysis should cover each of those data flows rather than relying solely on the stated location of the primary database.

A multinational HR platform. A Saudi subsidiary may send employee information to a centralized global HR environment operated by its foreign parent or another group company.

The Transfer Regulation recognizes central processing operations as a relevant transfer purpose. Where the company relies on the Article 4 framework for a multinational group’s central operations, the applicable safeguards may include Binding Common Rules, Saudi Standard Contractual Clauses, or the accreditation mechanism specified by the Regulation.

The company must still assess the remaining statutory and regulatory requirements applicable to that transfer.

16  
What to Check in Cloud, SaaS and Outsourcing Contracts

Data-protection compliance increasingly depends on understanding the technical and contractual architecture of a service.

Legal and procurement teams should examine matters such as:

—	primary hosting region;
—	backup and disaster-recovery locations;
—	approved subprocessors and their locations;
—	offshore support and administrative access;
—	onward-transfer controls;
—	security safeguards;
—	audit and compliance rights;
—	breach and incident procedures;
—	return and deletion of data; and
—	termination assistance and portability.

Contractual provisions are important, but a contract cannot override Article 29 or other mandatory Saudi regulatory requirements.

17  
Onward and Subsequent Transfers

A lawful initial transfer does not create unrestricted authority to move the data onward.

Article 5 of the Transfer Regulation expressly provides that the Saudi Law and Regulations continue to apply to subsequent transfers of personal data that has already been transferred or disclosed outside the Kingdom.

This makes subprocessor mapping particularly important in global cloud and outsourcing arrangements.

A company should know not only the identity of its principal service provider but also where relevant subprocessors, backup facilities and technical-support teams operate.

18  
Common Scenarios at a Glance

Scenario	Automatic Localization?	Primary Question
Ordinary private company, non-personal commercial data	Not automatically	Check applicable contracts, cybersecurity and sector rules
Personal data transferred outside KSA	Not automatically prohibited	Article 29 + Transfer Regulation
Continuous or widespread transfer of Sensitive Data	Enhanced compliance analysis	Article 7 risk assessment + other applicable transfer requirements
SAMA Member Organization using public/hybrid cloud	Stricter sector controls apply	SAMA cloud approval and data-location requirements
Government or critical-system data	Potentially stricter	Applicable classification, NCA, contract and sector requirements
Saudi-hosted database with offshore support access	Local storage does not end the analysis	Assess the offshore access as part of the cross-border transfer analysis

19  
A Practical Data Localization Decision Framework

1	Identify the data involved.
2	Determine whether the information qualifies as Personal Data.
3	Identify any Sensitive Data.
4	Identify every storage, processing, backup and support location.
5	Determine whether anyone outside Saudi Arabia receives or accesses the data.
6	Identify the applicable Article 29 transfer purpose.
7	Check the destination’s current status under SDAIA’s adequacy framework.
8	Determine whether Article 4 applies and, if so, which safeguard is permitted for that transfer scenario.
9	Determine whether Article 7 requires a transfer risk assessment.
10	Check whether SAMA, NCA, CST, a government customer or another regulator adds stricter requirements.

20  
Data Localization and Cross-Border Transfer Checklist

—	Map the categories of data held by the Saudi operation.
—	Identify Personal Data and Sensitive Data.
—	Map storage, processing, backup and remote-access locations.
—	Identify Controllers, Processors and subprocessors.
—	Document the purpose of each transfer outside Saudi Arabia.
—	Check Article 29 and the Transfer Regulation.
—	Determine whether an Article 4 safeguard is relevant.
—	Complete and document a risk assessment where Article 7 requires one.
—	Review onward-transfer and subprocessor arrangements.
—	Review sector-specific and cybersecurity requirements.
—	Reassess the position whenever vendors, data flows or hosting regions change.

Frequently Asked Questions

Does Saudi Arabia require all personal data to be stored in Saudi Arabia?

No. The PDPL does not establish a universal rule requiring every category of personal data to remain physically inside Saudi Arabia. Transfers outside the Kingdom may be permitted where Article 29 and the Transfer Regulation are satisfied, subject to any stricter sector-specific requirements.

Can a Saudi company use a foreign cloud provider?

Potentially yes. The company should assess where the provider stores and processes the data, whether offshore access or subprocessors create cross-border transfers, and whether the business is subject to a regulator such as SAMA or another sector-specific authority.

What does Article 29 of the PDPL regulate?

Article 29 governs the transfer or disclosure of Personal Data outside Saudi Arabia and establishes the permitted purposes and principal conditions applicable to those transfers.

Are Saudi Standard Contractual Clauses required for every transfer?

No. Saudi SCCs are one of the appropriate safeguards recognized under Article 4 of the Transfer Regulation and apply in the transfer scenarios specified by that Regulation. The correct mechanism depends on the circumstances of the transfer.

Can a multinational company send Saudi employee data to its foreign headquarters?

Central processing operations are expressly recognized by the Transfer Regulation, but this is not unconditional permission to export employee data. The company must still satisfy the applicable PDPL and Transfer Regulation requirements. Where Article 4 applies to central operations within a multinational group, the permitted safeguards can include Binding Common Rules, Saudi SCCs or the specified accreditation mechanism.

When is a cross-border transfer risk assessment required?

Article 7 requires a risk assessment where a transfer or disclosure is carried out under Article 4 of the Transfer Regulation, and where Sensitive Data is transferred or disclosed outside Saudi Arabia on a continuous or widespread basis.

Can offshore remote access count as a cross-border transfer?

Yes, granting access to Personal Data from Saudi Arabia to a recipient outside the Kingdom can fall within the cross-border transfer framework even where the primary database itself remains hosted in Saudi Arabia.

Are SAMA-regulated organizations subject to stricter cloud requirements?

Yes. For Member Organizations within the scope of SAMA’s current Cyber Security Framework, public and hybrid cloud use is subject to specific approval and data-location controls, including the principle that cloud services should be located in Saudi Arabia unless explicit SAMA approval is obtained for services outside the Kingdom.

Does using a Saudi data center automatically make a company PDPL-compliant?

No. Local hosting does not resolve every data-protection question. Offshore support access, subprocessors, backup regions, security controls, processing purposes and other PDPL obligations must still be assessed.

This article is provided for general informational purposes and does not constitute legal advice. Data protection, cybersecurity, cloud and sector-specific regulatory requirements may change, and businesses should confirm the requirements applicable to their particular data flows and operating model.