Data sovereignty in Saudi Arabia: what regulated buyers ask before moving to cloud

In Saudi Arabia, where your data may live in the cloud is decided by a small set of rules: your data classification under the National Data Management Office (NDMO), the Personal Data Protection Law (PDPL) for personal data, the CST registration class of your cloud provider, and, if you are a bank, SAMA. The NCA's cloud controls set the security baseline but now leave data localisation to NDMO.

Almost every regulated cloud deal I work on in the Kingdom slows down at the same point: someone asks "can this data leave Saudi Arabia?" and nobody in the room is sure. This is the plain-language map I use with customers. It is not legal advice, and the rules are moving, so check the sources below for your case.

Data sovereignty vs data residency: what is the difference?

Data residency is about location: the data is physically stored in a given country. Data sovereignty goes further: the data is subject to that country's laws, and you control who can access it, including the cloud provider and foreign authorities. A workload can be resident in a Riyadh region and still raise sovereignty questions if support teams, encryption keys or backups sit elsewhere. Saudi regulators care about both.

Which Saudi regulations decide where cloud data can live?

How does NDMO data classification affect hosting?

Classification comes first, because everything else follows from it. Government data is classified by the impact of disclosure: Top Secret (high impact), Secret (medium), Restricted (low) and Public (none). Under the Cloud First Policy, the most sensitive government data is hosted with government cloud providers, while other data can go to approved commercial providers. Private companies are not bound by the government scheme in the same way, but many regulated customers adopt it, and their regulators increasingly expect it.

If you do one thing before a cloud project, get your data classified and the classification approved. It answers half the questions that would otherwise stall the deal.

What does the PDPL say about transferring personal data abroad?

The PDPL allows personal data to leave the Kingdom only on a recognised legal basis. Since the amended Transfer Regulation took effect in September 2024, that includes transfers to countries with adequate protection, standard contractual clauses, and binding common rules for groups of companies, supported by SDAIA's transfer risk assessment guidelines. Penalties for serious breaches reach SAR 5 million.

What do the NCA ECC and CCC require?

The NCA's Essential Cybersecurity Controls (ECC) set the baseline for national entities, and the Cloud Cybersecurity Controls (CCC) extend it to cloud, for both providers and the organisations using them. The second edition, CCC-2:2024, made a change many people missed: it removed the sub-controls that required storage, disaster recovery, monitoring and support to sit in the Kingdom, and states that data localisation is now a matter for NDMO. In other words, CCC tells you how to secure the workload; your data classification tells you where it may live.

What are the CST cloud provider classes?

CST registers cloud service providers by the most sensitive data they may host. As providers describe the scheme, Class A covers public data, Class B covers public and restricted data, and Class C covers the most sensitive data, up to secret and top secret. When a provider says it "holds Class C", it means CST has cleared it for highly sensitive workloads. Ask for the certificate, not the slide. My guide to cloud providers in Saudi Arabia covers which hyperscalers run regions in the Kingdom today.

What questions should you ask before moving regulated data to cloud?

1. What is our data classification, and who approved it?
2. Which CST class is the provider registered in, and does it cover our highest classification?
3. Where do storage, backups, disaster recovery, monitoring and support physically sit? Residency of the primary copy is not enough.
4. Who holds the encryption keys, and can the provider access our data without us?
5. What is our legal basis for any personal data transfer under the PDPL, and are we ready if in-Kingdom storage becomes mandatory?
6. Do we need regulator approval, such as SAMA's no-objection for financial institutions?
7. What are our audit and exit rights, and how do we get our data back?

What is changing next?

Two developments are worth tracking. The PDPL draft above could make in-Kingdom storage of personal data the default. CST has also consulted on a Global AI Hub Law that would let foreign governments and companies host data in "data embassy" style hubs in the Kingdom under their own laws. It was published as a draft in April 2025 and, as far as I can tell, has not yet been enacted. Together they point the same way: Saudi Arabia wants more of the world's data, and its own, to live in the Kingdom.