Data residency in Saudi Arabia: what the PDPL asks when your cloud and AI tools run abroad

Data residency in Saudi Arabia is conditional for most private companies. The Personal Data Protection Law (PDPL) lets a company send personal data abroad, or let someone abroad access it, for a purpose the law lists, without harm to national security and with only the data needed. The destination must also be assessed as adequate by the regulator, the Saudi Data & AI Authority (SDAIA); if not, the transfer must fit one of five exemption cases, each with a safeguard. Stricter hosting rules come from government and sector requirements.

This guide is for Saudi companies whose cloud and AI tools run abroad, and for companies in the Gulf and beyond that process data of people in the Kingdom.

This article is general information, not legal advice. Check your obligations against the current law and its regulations.

Data residency in Saudi Arabia: the short answer

What the law says. PDPL Article 29, as amended in 2023 by Royal Decree M/148, lets a controller (the party deciding why and how personal data is processed) transfer or disclose it abroad for listed purposes, on three conditions [1, Arts. 1(18), 29]:

• no prejudice to national security or the Kingdom's vital interests;
• adequate protection abroad, "according to the results of an assessment conducted by the Competent Authority";
• no more than "the minimum amount of Personal Data needed".

Extreme necessity to protect a person's life or vital interests, or to prevent, examine or treat disease, is exempt [1, Art. 29(3)]. The amendment also dropped the original text's requirement for SDAIA's approval [2].

Data localization in Saudi Arabia: where the rules come from

No single Saudi data residency law covers private companies generally. The National Cybersecurity Authority's Cloud Cybersecurity Controls (CCC-2:2024) cover government bodies, private owners, operators and hosts of critical national infrastructure, and their cloud providers [3]. The 2024 version deleted the two subcontrols requiring cloud services, including storage, processing, disaster recovery, monitoring and support, to be provided from within the Kingdom, and refers entities to SDAIA's National Data Management Office on localisation [3, Annex D]. Some sectors add approvals, such as the Saudi Central Bank's in banking [4].

Saudi company or foreign company: who these rules reach

In the Kingdom, a foreign cloud, SaaS or AI tool holding customer or staff data means a transfer. You are usually the controller and the provider your processor [1, Art. 1(19)]; if it also uses your data for its own purposes, such as model training, it is a controller for that use. Choose processors "providing the necessary guarantees" and monitor them [1, Art. 8].

Outside the Kingdom, the law covers "the Processing of Personal Data related to individuals residing in the Kingdom by any means from any party outside the Kingdom" [1, Art. 2]. No Saudi office is needed.

Registration. SDAIA's data governance platform has a route for entities outside the Kingdom (an active commercial registration and a representative authorised through the Ministry of Foreign Affairs) [6]. Registration rules for controllers outside the Kingdom "will be issued" [7]; we found none on 29 September 2026 [8].

Gulf readers: SDAIA's Regulation on Personal Data Transfer Outside the Kingdom (the Transfer Regulation) applies its country standards to "cities, special economic zones, and global trade centers" too, so a zone can be assessed apart from its country [9, Art. 3(4)].

PDPL data transfer: a decision path in six questions

Transfer includes access: SDAIA's templates cover "granting of access" [10] and its risk guideline "remote access" [11], so a Riyadh database that a support team abroad can open is in scope.

1. Is personal data of people in the Kingdom stored, processed or viewed abroad? If not, the transfer rules don't apply to this flow; the rest of the PDPL still does.
2. Are you a government body, a critical-infrastructure operator, or in a sector with its own data rules (such as banking)? Check those rules first; the questions below still apply.
3. What is the purpose? Article 29 lists the Kingdom's agreements and interests, "an obligation to which the Data Subject is a party", and purposes set by the regulations [1]. The Transfer Regulation adds "central processing" operations, "a service or benefit" to the person, and scientific research [9, Art. 2]. If none fits, don't transfer.
4. Can you send less? Minimum data is a condition [1, Art. 29(2)(c)]. Remove names and ID numbers where the purpose allows; SDAIA's clauses point to "encryption or de-identification" [10, Clause 11].
5. Is the destination on SDAIA's adequacy list? SDAIA must publish one, reviewed "every four years, or as necessary" [9, Art. 3]; adequacy is its assessment, not yours [1, Art. 29(2)(b)]. On 29 September 2026 its regulations pages showed none [8]. If listed, send the minimum and record it; if not, go on.
6. Which exemption case fits? Article 4 lifts the adequacy or minimum-data condition, or both, in five cases, each with a safeguard; the national-security condition stays [9, Art. 4(2)].

Note on cases B and E: the official Arabic text excludes sensitive data from the whole of both cases [12]; in case B, the English translation ties the exclusion to the certificate option only [9]. Rely on the Arabic. Sensitive data includes health, genetic and identifying biometric data, ethnic origin, religious and political belief, and security and criminal data [1, Art. 1(11)].

Where does an ordinary subscription fit? No case is written for a company subscribing to a foreign cloud or AI service: C needs a multinational group, D a certified recipient, B a limited transfer. Choosing a case is a legal judgement: note which one you rely on and why, have a lawyer check it, and file the note with your risk assessment. Meanwhile, narrow the question:

• Ask whether the provider can store and process your data in the Kingdom; support access from abroad is still a transfer, but a narrower one, easier to limit and record [10; 11].
• Prefer a recipient with an SDAIA accreditation certificate once certified entities are listed; it is an accepted safeguard in cases B to E [9, Art. 4(2)].

Record every transfer, "including the legal basis for the Transfer and recipient parties", in your record of processing activities [13, Art. 33(5)(g)]. If you fail to apply the safeguards, or SDAIA finds them inadequate, the exemption lapses: halt the transfer and notify the recipients [9, Art. 6].

SDAIA standard contractual clauses, binding common rules or a certificate: which safeguard to use

SDAIA's standard contractual clauses (SCCs) are fixed contract terms that the exporter in the Kingdom and the importer abroad sign as a transfer safeguard [9, Arts. 1(4), 4(1)]. Version 1.0 (September 2024) has four templates; the parties keep the one that fits their roles and "delete those that do not apply" [10].

What the importer signs up to [10]:

• Fixed text. Only the blanks may be filled in; other changes "shall not be recognized by the Competent Authority", and extra terms must not contradict or weaken the clauses (Rules 4, 5).
• Saudi law and courts. The importer submits to Saudi law and jurisdiction and cooperates with SDAIA's requests and audits (Rules 8 and 9; Clause 8).
• Home-country law. No transfer if the importer's local laws block compliance (Rule 7).
• Deadlines. The importer warns the exporter within 24 hours if it can't comply; transfers then stop, and it has 30 days, extendable by 30, to show compliance, or the parties agree to end the contract (Clause 12). Template 2 adds 24 hours for breach reports and 48 for relaying data subjects' requests (sections 6(D), 10(A)).
• Onward transfers abroad go only to parties that have acceded to the clauses (Template 2, section 8).
• At the end, data is destroyed or returned, and destruction documented (Template 2, section 5; Clause 12).

Binding common rules suit groups. They "must be approved internally by the authorized person within the Group of Entities", bind every member, and fall under Saudi law and courts [14]. The guideline describes no SDAIA pre-approval step.

An accreditation certificate is issued by an SDAIA-licensed body to a controller or processor "operating either within or outside the Kingdom" [15, Art. 1(3)]. Applicants must be in the National Register of Controllers; the licensee's evaluation takes up to 90 business days; certificates last two years; and holders abroad must report conflicting changes in their home rules or practices [15, Arts. 3, 6, 8, 9]. A certificate is an option in cases B to E and the only safeguard in D. SDAIA is to publish licensees and certified entities [15, Arts. 5, 13]; on 29 September 2026 we found neither list on its regulations pages or its data governance platform's public pages [8].

The transfer risk assessment, as a worksheet

A risk assessment is required before any Article 4 transfer and before sending sensitive data abroad "on a continuous or widespread basis", covering six elements [9, Art. 7]. SDAIA's February 2025 guideline, "not legally binding", explains the steps and offers a supporting tool [11].

The guideline's last step: if risk stays high, with effects on people or the community that may not be reversible in the near term, "the controller should explore alternative methods", such as changing or dropping the processing [11].

Cloud and AI tools: ten questions for each provider

Your processor contract must cover the purpose, data categories, duration, breach notice "without undue delay", "whether the Processor is subject to Regulations in other countries", mandatory disclosures under Saudi law, and subcontractors; new sub-processors need your prior acceptance [13, Art. 17(1), (5)].

Send these in writing; questions 7 to 9 are our practical advice, the rest follow from the texts above. Providers abroad: expect these questions from Saudi customers, and keep written answers and Template 2 appendices ready.

1. Where is our data stored, processed, backed up and accessed from, including by support staff?
2. Which sub-processors do you use, and where? Will you tell us before adding one, including when a new AI feature sends our data to another provider or region?
3. Could another country's laws force you to disclose our data?
4. Will you sign SDAIA's Template 2 unchanged?
5. Will you report breaches to us within 24 hours?
6. When the contract ends, will you delete or return our data and confirm it in writing?
7. AI: are prompts, files and outputs logged or stored? For how long, and where?
8. AI: are they used to train or improve models, and can the contract exclude that?
9. AI: can your staff read our content, and from where?
10. Do you hold an SDAIA accreditation certificate? From which licensee, and until when?

Minimise before you send. Before AI summarises support tickets, remove names, ID and iqama (residence permit) numbers and phone numbers it doesn't need, and keep sensitive data out unless the risk assessment is done. New to AI? Start with one repetitive task. For customer-reply assistants, see our WhatsApp AI guide. Law firms also owe clients confidentiality; see AI for law firms in Saudi Arabia.

Say it plainly to your customers. The law requires you to tell people at collection whether their data will be processed outside the Kingdom [1, Art. 13]. State the main location, then the exceptions. O AI describes its own setup this way: "Core hosting (compute, database and files) is on Saudi-based cloud infrastructure inside the Kingdom. A small number of supporting services, such as AI processing and email delivery, can run outside the Kingdom; the privacy policies describe each flow."

A one-page inventory: tool, data, country, safeguard

One column per tool here; one row per tool in your own sheet, including free tools staff signed up for. The examples are hypothetical.

Review each entry when a provider changes regions or sub-processors, and when SDAIA publishes its list; SDAIA may also revise each case's safeguards "every two years or as necessary" [9, Art. 4(4)]. Keep the record of processing for five years after the processing ends [13, Art. 33(1)].

What to do in the next two weeks

1. List every tool that touches personal data, including chat, AI and backups.
2. Fill in an inventory entry for each, and send the ten questions to each provider abroad.
3. Choose a route and safeguard for each tool, and have a lawyer check the choice.
4. Run the risk assessment where required, then update your record of processing and privacy policy.

Buying new software? Add questions 1 to 6 to the brief in our build-or-buy guide.

O AI is a Saudi AI and software company in Al Khobar. Not sure which of your tools send personal data abroad? Book a free consultation to talk it through, with no commitment. We reply within one business day.