DCC-1:2022, published 18 September 2022 (NCA page updated 15 May 2025)
Last verified
2026-10-20
The Data Cybersecurity Controls (DCC) add NCA requirements for protecting data across its lifecycle, on top of the ECC baseline.
Version: DCC-1:2022, published 18 September 2022 (NCA page updated 15 May 2025).
Structure: three domains: cybersecurity governance; cybersecurity defence; and third-party and cloud computing cybersecurity.
Implementation guide: GDCC-1:2023.
Proposed PDPL change (as at 20 October 2026): SDAIA's draft amendments to the PDPL Implementing Regulation (IR), open for comment to 5 November 2026, would require controllers to apply applicable NCA controls (draft Art 23(1)(b)), to store personal data in the Kingdom (draft Art 23(2)) and to notify SDAIA within 72 hours of any breach, without prejudice to NCA reporting (draft Art 24). With ECC-2 and CCC-2 referring localisation to NDMO, draft Art 23(2) would become the main general localisation rule.