Wadira: Find your way through Saudi data & privacy law.
Home › Frameworks › Telecommunications & Cloud › CST Guide for Cloud Computing Service Providers
| Type | Guideline |
|---|---|
| Issuing authority | Communications, Space & Technology Commission (CST) |
| Framework | Telecommunications & Cloud |
| Tier | Guidelines & circulars |
| Legal status | Guidance |
The Guide for Cloud Computing Service Providers (Fifth Version, October 2023) is the Communications, Space & Technology Commission's manual for registering as a cloud service provider (CSP) under the Cloud Computing Services Provisioning Regulations, grounded in the Telecommunication and Information Technology Act (Royal Decree M/106, 2/11/1443H).
Registration is required of any provider exercising direct or effective control over a data centre or the critical infrastructure of a cloud computing system hosted and used in the Kingdom. Applications go through CST's electronic platform, describing the applicant's business, services, cloud systems and data centres, including any foreign data-centre locations used to process Saudi subscribers' content, which CST may refuse.
Providers register in Class A, Class B or Category C, evidenced by escalating facility certifications (Tier 2 or ISO/IEC 27001; Tier 3; further approvals for Category C), and must comply with the National Cybersecurity Authority's controls. Submissions are in Arabic; CST decides within 15 working days; registration lasts three years, renewable, with registered CSPs published on CST's website.
Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-08-13