Wadira: Find your way through Saudi data & privacy law.
How the Saudi Central Bank (SAMA) and the Capital Market Authority (CMA) compare on cybersecurity and data, as at 20 October 2026.
| SAMA | CMA | |
|---|---|---|
| Entities | Banks, finance companies, payment providers, credit bureaus (insurers moved to the Insurance Authority) | Capital Market Institutions (215 at end-2025); listed issuers for disclosure, offers and governance |
| Binding | Yes: CSF is a binding supervisory requirement | Main Controls mandatory, although the document is called "guidelines" |
| Maturity | CSF level 3 or higher (a level 4 subdomain requirement for banks is reported, not confirmed) | n/a |
| Cloud | SAMA approval first; Saudi-located in principle; offshore only with explicit approval (CSF 3.4.3) | Cloud services within KSA |
| Outsourcing | Written no objection for material and overseas outsourcing (Outsourcing Rules Arts 41–42) | Security monitoring only to providers within KSA |
| Incidents | Medium or high incidents to SAMA immediately (CSF 3.3.15) | Report immediately; official report after recovery |
| PDPL | SDAIA regulates; SAMA circular 43045328 requires adherence; SDAIA–SAMA MoU (5 February 2025) | SDAIA regulates; PDPL applies to CMI client data |
A PDPL-compliant transfer does not replace SAMA approval or no objection for offshore cloud or outsourcing.
Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21