Cloud and data residency in Saudi Arabia

Three questions decide where data may live

1. Is it government data, and how is it classified?
2. Is it part of a critical system?
3. Is it personal data that will leave the Kingdom?

How government data is classified

Government data is classified at four levels: Top Secret, Secret, Restricted and Public. The classification comes from the guidelines issued by the National Data Management Office (NDMO) at SDAIA, or from the subscriber's sector regulator where one applies. CST's cloud regulations refer to these levels; they do not create them.

How CST registers cloud providers

Under its Regulations for the Provision of Cloud Computing Services, fourth version, issued 8 October 2023 under CST Decision 506/1445, CST registers cloud service providers in three categories, A, B and C, alongside a separate qualifying category. Category C covers the most sensitive government data, including data classified Top Secret.

Which classification levels each lower category may host is set in the CST regulations. Check the current CST text for that mapping before you choose a provider for government data.

Data localization: the NDMO and CST

Data localization rules now come from more than one place. When the NCA issued CCC-2:2024, it moved the data localization controls out of the cloud controls and transferred them to the National Data Management Office (NDMO) at SDAIA, and it tells entities to refer to the NDMO on data localization before taking any action. Separately, CST's Regulations for the Provision of Cloud Computing Services prohibit registered providers and their subscribers from transferring Saudi government agency data outside the Kingdom unless a law or regulation allows it.

Critical systems

Under the NCA's Critical Systems Cybersecurity Controls, cloud hosting for critical systems must be inside the organization, with a government provider, or with a Saudi cloud provider that complies with the NCA's Cloud Cybersecurity Controls, taking into account the classification of the hosted data. Outsourcing and managed services for critical systems must rely on Saudi companies.

Personal data leaving the Kingdom

Transfers of personal data outside the Kingdom are governed by SDAIA's Regulation on Personal Data Transfer outside the Kingdom. If you use an overseas cloud region, support team or parent company, record each flow and its basis. Read the PDPL page.

A practical approach

1. Inventory your data and record who it belongs to and how it is classified.
2. Identify government data and critical-system data, because they carry the strictest hosting rules.
3. Choose providers whose CST registration category covers the highest classification they will hold, checked against the current CST text.
4. Check the NDMO's localization requirements and CST's rules for each data type before you move it.
5. Map every flow of personal data outside the Kingdom and confirm its basis.
6. Review the map whenever you add a provider, a region or a new type of data.