Cloud and Data Hosting Regulations in Saudi Arabia: SME Guide

Can your business keep its data on servers outside Saudi Arabia, and which rules actually apply to you? No single law answers that. Cloud and data hosting regulations in Saudi Arabia come from four sets of rules. The Communications, Space and Technology Commission (CST) regulates cloud providers. The National Cybersecurity Authority (NCA) sets cybersecurity controls. The Personal Data Protection Law (PDPL) governs personal data, and ZATCA sets record-keeping rules.

The short version for most private SMEs is simple. Government data never leaves the Kingdom. Personal data goes abroad only on conditions. And a resident taxpayer's tax records sit on a server inside the Kingdom. This guide explains each rule in plain business terms, who it binds, which major cloud providers have Saudi regions, and the backup basics you need.

It is not a substitute for legal advice on your specific case, but it gives you the right questions to ask before you sign any hosting contract or cloud subscription.

Who regulates cloud and data hosting in Saudi Arabia?

Four authorities, each from a different angle. This table sums up what it means for a private business:

What do CST's cloud computing regulations say?

CST issued the fourth version of its Regulations for the Provision of Cloud Computing Services in October 2023; the framework started life as the Cloud Computing Regulatory Framework in January 2018. It applies to cloud services provided to subscribers who reside in, or have an address in, the Kingdom. The parts that matter most to you:

• Provider registration: no provider may control a data centre or core cloud infrastructure hosted in the Kingdom to provide cloud services before registering with CST. Registration comes in categories that set which classes of data the provider may handle.
• Data classification: the regulations separate government agencies' data (top secret, secret, restricted and public) from other data, and the subscriber is responsible for choosing the right classification.
• Government data stays in: content from Saudi government agencies' data must not be transferred outside the Kingdom in any form. That includes temporary storage or backup, unless another law explicitly allows it. If you serve a government client, this covers its data in your hands.
• Notice and consent before moving abroad: a registered provider must tell subscribers in advance and get their consent if their content will be transferred, stored or processed outside the Kingdom.
• Breach reporting: providers must notify CST and their subscribers without undue delay of any breach they become aware of.
• Minimum contract terms: the services, fees, termination terms, service level details, how your data is returned when the contract ends, and how complaints are handled.

The practical step: ask any cloud provider for its CST registration category, the location of its data centres, and the clause that says how you get your data back on termination.

Do the NCA's cybersecurity controls apply to your business?

The Essential Cybersecurity Controls (ECC-2:2024) apply to government agencies and their companies and affiliates, and to private entities that own, operate or host critical national infrastructure. They contain 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols, and the NCA strongly encourages every other entity in the Kingdom to use them as well.

The Cloud Cybersecurity Controls (CCC-2:2024) extend the ECC and set minimum cloud cybersecurity requirements for both cloud service providers and their tenants. In scope are tenants that are government bodies or critical infrastructure operators, and the providers that serve them.

What does that mean for a small business? If you're not in scope, they aren't mandatory for you. But if you sell to a government body, or plan to, expect to be asked about them. Even without a mandate, the ECC's backup subdomain makes an excellent checklist. Backups should cover your critical technology and information assets. You should be able to recover quickly after an incident, and you should test recovery regularly.

One detail worth knowing: the data localisation controls were moved out of the second version of the ECC. They now sit with the National Data Management Office at SDAIA. So don't rely on old copies of the document when discussing where data must be hosted.

When can personal data be transferred outside Saudi Arabia?

Article 29 of the PDPL allows transfers for set purposes, including fulfilling an obligation to which the data subject is a party, and other purposes defined in the regulations. SDAIA's Regulation on Personal Data Transfer outside the Kingdom adds three: operational processes needed for central processing, providing a service or benefit to the data subject, and scientific research.

In every case, the law's conditions must be met:

1. The transfer must not harm national security or the Kingdom's vital interests.
2. The receiving country must offer an adequate level of protection. SDAIA publishes a list of countries that do, reviewed every four years or when needed.
3. Only the minimum personal data needed may be transferred.

In defined exemption cases from the last two conditions, the transfer must rely on appropriate safeguards: standard contractual clauses, binding common rules within a multinational group, or an accreditation certificate. In those cases the regulation requires the controller to carry out a risk assessment before the transfer, and also before transferring sensitive data continuously or at large scale.

A practical example: a CRM or marketing messaging platform hosted abroad that stores your customers' names and mobile numbers means you are transferring personal data out of the Kingdom. Start by listing these tools, then record the legal basis, condition and safeguard for each, or move them to hosting inside the Kingdom. We touched on this in our guide to AI automation for Saudi small businesses, because many AI tools process data abroad.

Which major cloud providers have regions in Saudi Arabia?

Global providers have expanded their presence in the Kingdom considerably in recent years. Here is where each stands according to its own official pages, as of 29 October 2026:

Two cautions. A region in the Kingdom doesn't mean every service is available there, so check the specific service you need. And make sure your data and its backups are actually set to the Saudi region, not to a default region abroad.

What backup and data-processing basics does an SME need?

A small business doesn't need a huge compliance programme. It does need discipline on seven points.

1. Classify your data: personal (customers and staff), financial and tax, operational, and any data belonging to a government body you work with.
2. Map where it lives: for each type, which system, which provider and which country?
3. Choose locations by class: keep a resident taxpayer's tax records on a server in the Kingdom, as ZATCA's guideline on tax invoicing and records requires. Send personal data abroad only under the transfer conditions. Keep government data in the Kingdom, always.
4. Back up regularly: automatic, encrypted backups, a copy in a separate account or location, and retention that respects the six-year minimum for tax records.
5. Test restores: restore a full system at regular intervals and write down how long it took.
6. Control access: an individual account for every employee, two-factor authentication, a log of who accessed what and when, and immediate removal of leavers' access.
7. Prepare an incident plan: the PDPL Implementing Regulations require a controller to notify the competent authority within 72 hours of becoming aware of a leak that could harm data subjects. Decide in advance who decides and who reports.

How can Manzomia help with hosting and data-processing infrastructure?

At Manzomia we build business systems and the hosting and data-processing infrastructure they run on. We design them from the start around your data map: where data is stored, who can reach it, and how it is backed up and restored. That usually starts as part of a custom ERP or SaaS platform, or a web app or portal that needs hosting built for Saudi rules.

If invoicing is part of the picture, read our ZATCA e-invoicing Phase 2 guide too, because invoicing systems have their own storage and archiving requirements. If you are choosing a business system, compare the options in our guide to ERP for SMEs in Saudi Arabia.

What is your next step?

List every system or app your business uses today, and next to each one write the type of data it holds, the provider's name and the country where it hosts that data. Then book a consultation and we'll go through the list with you to decide what needs moving, safeguards or better backups.