Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Cloud & Data Centres › Data Centre Services Regulations

Data Centre Services Regulations

CST registration for each data centre offering services in the Kingdom

Type	Regulation
Issuing authority	Communications, Space & Technology Commission (CST)
Framework	Cloud & Data Centres
Tier	Implementing & executive regulation
Legal status	In force
Instrument number	CST decision 502/1445 · Communications, Space and Technology Commission
Issued	2023-08-22
In force from	2024-01-01
Dates	CST decision 502/1445, 22 August 2023; in force 1 January 2024
Last verified	2026-10-20

CST's Data Centre Services Regulations require providers of data centre services to register each data centre with CST. The decision is published as CST Regulation-1478; the text is Document-1546.

• Registration per data centre, in one of four categories: Qualifying; Limited; Standard (Tier II); Advanced (Tier III and above).
• Registration lasts three years; no fee.
• Standard and Advanced data centres must be carrier-neutral.
• Offering cloud services needs a separate registration under the Cloud Computing Services Provisioning Regulations v4.
• No data-location rule: the Regulations do not say where data must be held.
• Personal data stays subject to the PDPL; cybersecurity to the NCA's controls.

Documents

• Official source (www.cst.gov.sa)

In this framework

• Regulatory Bylaws of the Cloud Computing and Informatics Special Economic Zone
• Cloud Computing Services Provisioning Regulations (version 4)
• Cloud provider registration classes (Qualifying, A, B, C)
• CST Guide for Cloud Computing Service Providers (version 5)
• Registration Guide in the Qualifying Category (version 2)

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21