CST decision 506/1445 · Communications, Space and Technology Commission
Issued
2023-10-08 (23/03/1445H)
In force from
2023-10-10
Version
4
Dates
CST decision 506/1445 (23/03/1445H, 8 October 2023); in force 10 October 2023
Last verified
2026-10-20
The Cloud Computing Services Provisioning Regulations (version 4) were approved by CST decision 506/1445 dated 23/03/1445H (8 October 2023) and have been in force since 10 October 2023. They replace the Cloud Computing Regulatory Framework (version 3). The decision is CST Regulation-1482; the text is Document-1550.
Registration: providers must register with CST before taking control of a data centre or critical cloud infrastructure in the Kingdom (Art 3-2-1).
Government data: must not leave the Kingdom, even temporarily or for backup, unless a law allows (Art 3-3-5).
Other content: the provider must notify the subscriber and obtain consent before storing or processing it abroad (Art 3-3-7).
Breaches: notify CST and affected subscribers without undue delay (Art 3-3-8).
Categories: Qualifying (transitional, no government customers); Class A (public data); Class B (up to restricted); Class C (up to secret and top secret, with CST approval for those).
PDPL: the Art 3-3-7 consent sits between the provider and its subscriber. It is not a PDPL transfer basis; the controller still needs a route under PDPL Art 29 and the Transfer Regulation.
Proposed: draft PDPL Implementing Regulation (IR) Art 23(2) (October 2026) would add a default duty on controllers to store personal data in the Kingdom. The NCA's CCC-2:2024 dropped its in-Kingdom cloud subcontrols.
2026-10-01 · CST publishes H1 2026 cloud latency report: CST published a report on cloud service latency for the first half of 2026 on 1 October 2026. It is a market report, not a regulatory instrument.