Wadira: Find your way through Saudi data & privacy law.
Home › Regulators › Communications, Space & Technology Commission
Communications, Space & Technology Commission (CST)
Regulator for telecom and IT, digital content platforms, cloud computing, data centre services, IoT, internet and space.
The Communications, Space and Technology Commission (CST) regulates telecom and IT, digital content platforms, cloud computing, data centre services, IoT, internet and space. CoM Resolution 430 (23/06/1446H, 24 December 2024; Umm Al-Qura 17 January 2025) amended CST's Organisation: it adds digital content platforms to CST's sectors and rewrites its functions and board.
Cloud (CCSPR v4, in force 10 October 2023): providers register before taking control of a data centre or critical cloud infrastructure in the Kingdom (Art 3-2-1). Government data must not leave the Kingdom, even temporarily or for backup, unless a law allows (Art 3-3-5). Other content needs subscriber notice and consent before storage or processing abroad (Art 3-3-7). Breaches go to CST and affected subscribers without undue delay (Art 3-3-8).
Cloud categories: Qualifying; Class A (public data); Class B (up to restricted); Class C (up to secret and top secret, with CST approval).
Data centres: registration per data centre under the Data Centre Services Regulations (in force 1 January 2024); no data-location rule.
Marketing: Spam Regulations (decision 493/1444) run alongside the PDPL.
Regulates: Telecom and IT · Digital content platforms · Cloud computing · Data centre services · IoT · Internet · Space
Protects: Telecom and ICT users · Cloud subscribers · Government data (CCSPR Art 3-3-5)