Data Localisation and Hosting Map

Saudi Arabia has no single localisation rule. Where data must be stored depends on the regime that covers the data and the entity, and the regimes apply in parallel. Position as at 20 October 2026.

Regime	Current position	Status
PDPL (general)	No general localisation duty today. Transfers are permitted for PDPL Art 29 purposes, with adequacy (no list published) or a Transfer Regulation Art 4 safeguard: SDAIA standard contractual clauses (SCCs), binding common rules (BCRs) or an accreditation certificate. A risk assessment is required under Transfer Regulation Art 7. Consent is not a transfer mechanism.	In force
Draft PDPL Implementing Regulation (IR) Art 23(2)	"The Controller shall store Personal Data within the Kingdom"; lawful transfers still permitted. Open question: does it require a local copy alongside a lawful transfer?	Draft (6 October to 5 November 2026)
NCA ECC-2:2024 / CCC-2:2024	In-Kingdom hosting controls deleted; localisation referred to the National Data Management Office (NDMO). Remaining: managed security operations centres (SOCs) fully in the Kingdom (ECC 4-1-3-2); Saudi nationals in cybersecurity roles at in-Kingdom data centres and isolated community cloud (CCC).	In force
NCA NCNICC-1:2025	No hosting rule; classify data before cloud hosting; data returned at exit.	In force
CST Cloud Computing Services Provisioning Regulations (CCSPR) v4	Government data must not leave the Kingdom, even for backup (Art 3-3-5). Subscriber notice and consent before offshore storage or processing (Art 3-3-7), which is not a PDPL transfer basis. Class C for secret and top secret data.	In force
CST Data Centre Services Regulations	Registration per data centre; no data-location rule.	In force
Cloud Computing and Informatics SEZ Bylaws	Saudi law applies where the Bylaws are silent.	In force
Global AI Hub Law	Foreign-law "data embassies"; interaction with draft IR Art 23(2) unresolved.	Draft
Saudi Central Bank (SAMA)	Cyber Security Framework 3.4.3: SAMA approval before cloud use; Saudi-located in principle; offshore only with explicit approval. Outsourcing Rules Arts 41–42: written no objection for overseas outsourcing. Credit bureaus: head office in the Kingdom.	In force
Capital Market Authority (CMA)	Cloud services within the Kingdom; security monitoring outsourced only to providers in the Kingdom.	In force
Health	National Health Information Center (NHIC) telehealth guidelines: hosting in Saudi Arabia. National Committee of Bioethics (NCBE): coded samples only; no offshore banking of samples. Health data is PDPL sensitive data.	In force
NDMO (government data)	Classification-based handling. The instrument that now holds the localisation rule referred to by the NCA is not identified.	To verify

Reading the map

A PDPL-compliant transfer does not replace SAMA approval or no objection for offshore cloud or outsourcing.
CST subscriber consent under CCSPR Art 3-3-7 is a telecoms rule, not a PDPL transfer basis.
If draft IR Art 23(2) is adopted, it would add a general storage duty alongside the sector rules.

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21