Managed IT and cyber security for regulated firms in Riyadh and KAFD
Managed IT and cyber security for regulated firms in Riyadh and KAFD
There is no single rule that says every company must keep all its data in Saudi Arabia. Where your data can be stored depends on who you are and what the data is. The NDMO at SDAIA sets data localisation requirements, the PDPL controls personal data sent abroad, and sector regulators such as SAMA and the CMA add their own expectations. Government bodies, critical infrastructure operators and regulated financial firms face the tightest limits. Classify your data first, because that decides the rest.
Several bodies have a say, and more than one can apply to the same organisation. This summary is our own, for orientation.
| Rule or regulator | Who it applies to | What it means for where data is stored |
|---|---|---|
| NDMO at SDAIA | Government entities, and in practice the companies that handle their data | Sets data classification and localisation requirements. ECC-2:2024 tells in-scope entities to refer to the NDMO before acting on data localisation. |
| NCA ECC-2:2024 | Government bodies and critical national infrastructure operators; other organisations are strongly encouraged to adopt it | No longer contains a general in-Kingdom hosting sub-control. Remote managed security monitoring and operations centres must be fully located in the Kingdom (4-1-3-2). |
| NCA CCC-2:2024 | Cloud providers and cloud tenants in scope | The NCA says the current version was updated to reflect changes to data localisation requirements. |
| PDPL and SDAIA’s transfer regulation | Anyone processing personal data in the Kingdom | Personal data may go abroad only for a permitted purpose, with adequate protection or an approved safeguard, and limited to what is necessary. |
| SAMA | Banks, insurers and finance companies | Check SAMA’s cloud and outsourcing requirements, and treat moving customer data out of the Kingdom as something to clear with SAMA first. |
| CMA Cybersecurity Guidelines | Capital market institutions | Cloud services should be hosted in Saudi Arabia, and outsourced security monitoring is limited to providers in the Kingdom. |
The question “can this data leave the Kingdom?” cannot be answered until you know what the data is. The NDMO’s classification scheme runs from public data up to top secret, and the higher the level, the tighter the controls on where it can be held and who can reach it.
In practice, that means three jobs. List the systems you use and what each one holds. Give each type of data a classification level, using the NDMO’s scheme if you are a government entity or handle government data. Then record where each system actually stores its data, including backups, logs and the locations your providers support it from. Most surprises turn up in that last step.
If your email, files, CRM or HR system sit in a data centre outside Saudi Arabia, personal data is very likely being transferred abroad, so the PDPL’s transfer rules apply to everyday IT, not just to special projects.
SDAIA’s Regulation on Personal Data Transfer outside the Kingdom, updated in September 2024, sets the conditions. In outline:
For the wider IT side of the PDPL, including the 72-hour breach notice to SDAIA, see our PDPL IT checklist.
More services can now keep data in Saudi Arabia. Microsoft has announced that its Saudi Arabia East datacenter region will be available in November 2026 for “supported Microsoft cloud and AI services”. Its announcement does not list the services and does not mention Microsoft 365, so do not assume your mailboxes and files will move. Egnyte has a data centre in Dammam, so files can be stored in the Kingdom.
Whatever the service, ask your provider to confirm in writing:
For Microsoft 365 settings that matter wherever data is stored, see Microsoft 365 and cloud governance for Saudi organisations.
If you would like help mapping where your data sits today, talk to our Riyadh team.
Last reviewed 20 October 2026. This guide is general information, not legal or regulatory advice. Rules change, so check the current text and take advice from your compliance officer or legal adviser before relying on it.
No single rule says so for every organisation. ECC-2:2024 removed its general in-Kingdom hosting sub-control and refers data localisation to the NDMO at SDAIA. Government bodies, critical infrastructure operators and SAMA- or CMA-regulated firms face tighter limits, and the PDPL controls personal data sent abroad.
Often, yes, for organisations outside government, critical infrastructure and the regulated financial sector, provided personal data transfers meet the PDPL’s conditions. Check your sector regulator’s rules and your contracts first.
A permitted purpose, adequate protection or a safeguard such as SDAIA’s standard contractual clauses, a risk assessment where the rules require one, and no more data than necessary.
Microsoft says its Saudi Arabia East region will be available in November 2026. Its announcement does not mention Microsoft 365, so ask Microsoft or your licensing partner in writing which services will be hosted in the Kingdom, and when.