Business

Data Residency Requirements in Saudi Arabia: What You Must Know

CLOUD|December 3, 2025|3 min read|1,906 views

Some data cannot leave Saudi Arabia — by law. We explain: which data, which entities, and what are the penalties.

What Is Data Residency?

Data residency means that data is physically stored and processed within specific geographic boundaries — in our case: the Kingdom of Saudi Arabia. It is not just about where the server is located, but also where processing, backup, and archiving occur.

Difference from data protection and localization: data protection and localization concerns which law governs the data. Data residency concerns where the data physically resides. The two are related but not identical.

The Regulatory Framework in Saudi Arabia

Personal Data Protection Law (PDPL)

Article 29 of PDPL regulates the transfer of personal data outside the Kingdom:

Default: Personal data stays in Saudi Arabia
Exception: Transfer is permitted under strict conditions (explicit consent + adequate protection guarantees)
Sensitive data: Stricter restrictions (health, financial, security data)

Digital Government Authority (DGA)

Mandates for every government and semi-government entity:

Store data in data centers within the Kingdom
Do not use foreign cloud services for government data
Obtain prior approval for any external processing

National Cybersecurity Authority (NCA)

Cloud Cybersecurity Controls (CCC) require:

Data classification before selecting storage location
Data classified as "Confidential" or "Top Secret" = mandatory local storage
Periodic review of data storage locations

Saudi Central Bank (SAMA)

Financial institutions face additional requirements:

Requirement	Details
Customer data	Mandatory local storage
Transaction records	Local storage + 10-year archiving
Payment systems	Mandatory local processing
Backup	At least one local copy

Who Must Comply?

Mandatory

Government and semi-government entities
Banks and financial institutions
Insurance companies
Healthcare providers
Telecommunications companies
Any entity processing government data

Strongly Required

Companies integrating with Nafath (National Access)
IT service providers for the government sector
Companies processing large volumes of personal data

Technical Requirements for Compliance

1. Accredited Saudi Data Center

The server must be in a data center within the Kingdom with specifications:

Tier III minimum — 99.98% uptime
Cooling and backup power — UPS + generators
Physical security — access control, cameras, guards
Recognized certifications — ISO 27001 preferred

2. Data Encryption

In transit: TLS 1.2+ mandatory
At rest: AES-256 for sensitive data
Encryption keys: Managed within the Kingdom

3. Backup

Backups must also be within the Kingdom. A backup on a foreign server equals a cross-border data transfer.

4. Access Logs

Log every data access operation
Retain logs for a minimum of 12 months (NCA)
Logs themselves must be stored locally

Common Mistakes

Saudi server but foreign CDN — data passes through external servers
Backup on S3 or سحابة أمريكية — data leaves the Kingdom
Using foreign SaaS for data processing — a US CRM processing Saudi customer data
Email on a foreign server — correspondence contains personal data
Foreign DNS logging query data — even DNS logs constitute data

Compliance Roadmap

Data classification — identify what data you have and its classification
Infrastructure audit — where is your data now? Every storage and processing point
Migration plan — prioritize transfers based on data sensitivity
Execution — move data to Saudi servers
Periodic review — every 6 months, verify everything remains compliant

CLOUD provides servers in Riyadh with Tier III standards. Data stays within the Kingdom — from storage to backup. A direct starting point for data residency compliance.