Hosting a website or app for Saudi Arabia: data residency, Saudi cloud regions, and what NCA, SDAIA and the PDPL actually require

The rules, and where to read them

Three regulators touch hosting in Saudi Arabia: the National Cybersecurity Authority (NCA) for cybersecurity controls, the Saudi Data and AI Authority (SDAIA) for personal data and data governance, and the Communications, Space and Technology Commission (CST) for cloud providers. These are the documents this guide relies on, read in October 2026:

• NCA's Cloud Cybersecurity Controls, CCC-2:2024: scope, the controls for providers and tenants, and Annex D, which records that the data localisation controls were removed and moved to SDAIA's National Data Management Office. NCA states that the Arabic version is binding.
• The Personal Data Protection Law on SDAIA's National Data Governance Platform, in particular Article 29 on transfers outside the Kingdom.
• SDAIA's Regulation on Personal Data Transfer Outside the Kingdom, version 2.0 of August 2024, and the standard contractual clauses.
• CST's Cloud Computing Services Provisioning Regulations, issued by decision 506/1445 in 2023, which set the obligations and rights of cloud providers and their customers.
• The cloud providers' own region lists and announcements, linked in the regions section below.

Who must host inside the Kingdom

The CCC applies to two groups of cloud customers, which NCA calls tenants: every government agency, including ministries, authorities, and their companies and sub-entities, and every private sector entity that owns, operates or hosts Critical National Infrastructure. Both must comply with the CCC and with NCA's Essential Cybersecurity Controls. Cloud providers serving them are in scope too. NCA lists, as examples outside the scope, providers that serve individuals and private companies that do not own, operate or host Critical National Infrastructure, and it only encourages those other entities to use the controls as good practice.

Until 2024 the controls themselves required in-scope providers to deliver services from inside the Kingdom, including storage, processing, disaster recovery, monitoring and support. CCC-2:2024 deleted those two subcontrols. Annex D explains that data localisation controls were transferred to the National Data Management Office (NDMO) at SDAIA, and that entities must refer to the NDMO about data localisation before taking any action. So if you are a government body, a supplier building a system for one, or a Critical National Infrastructure operator, treat in-Kingdom hosting as the expected answer and confirm the details with the NDMO and the contracting entity.

Sector regulators can add their own rules, and contracts often do: a tender from a ministry, a bank's vendor questionnaire or a hospital group's security schedule will usually state where data must live. Read those documents first, because they bind you even when the general law does not.

Everyone else: the PDPL treats hosting abroad as a transfer

If your servers, database, backups, email platform, CRM, analytics or AI tools are outside the Kingdom, the personal data in them has been transferred outside the Kingdom. Article 29 of the PDPL allows that only for listed purposes: performing an agreement to which the Kingdom is a party, serving the Kingdom's interests, performing an obligation to which the data subject is a party, such as delivering the order they placed, or other purposes set by the regulations. The transfer regulation adds three: central operational processing, providing a service or benefit to the data subject, and scientific research.

Article 29 then sets three conditions: the transfer must not harm national security or the Kingdom's vital interests; the destination must offer a level of protection no lower than the PDPL's, based on SDAIA's assessment; and the data transferred must be the minimum needed. Under Article 3 of the transfer regulation, SDAIA publishes the list of countries and international organisations it considers adequate and reviews it every four years or when needed. We could not find such a list on SDAIA's platform in October 2026, so check the knowledge centre before relying on adequacy.

Where the adequacy or minimum-data condition is not met, Article 4 of the regulation exempts the controller only in defined cases and only with appropriate safeguards: standard contractual clauses, binding common rules within a multinational group, or an accreditation certificate issued by a body SDAIA has licensed. The cases include infrequent or time-limited transfers about a limited number of people, central operations within a multinational group, direct service to the data subject, and research. Several of them exclude sensitive data, such as health data. These conditions are legal judgements, so have your adviser confirm the route for your setup.

Article 7 requires a written risk assessment before a transfer in two situations: whenever you rely on an Article 4 exemption, and whenever you transfer sensitive data abroad continuously or at scale. The assessment covers the purpose and legal basis, the processing and countries involved, the safeguards, how you limit the data to the minimum, the possible harm, and the measures to prevent or reduce it. Onward transfers from the foreign recipient stay subject to the PDPL under Article 5.

What is changing: SDAIA's draft storage requirement

On 6 October 2026 SDAIA opened a public consultation, running to 5 November 2026, on amendments to the PDPL's Implementing Regulation. According to Clyde & Co's summary of the draft, a new article would require controllers to store personal data inside the Kingdom, while transfers under the law would still be possible. The same summary says the amendments would apply 60 days after publication in the Official Gazette. It is a draft, its final text may differ, and nothing changes until it is adopted and published.

The practical reading for anyone building now: a system launched in 2027 should be able to keep its primary copy of Saudi personal data in the Kingdom without a rebuild. That means choosing a provider with a Saudi region, or at least an architecture where the database and file storage can move region without changing the application.

Cloud regions inside Saudi Arabia in October 2026

Hosting in the Kingdom used to mean a local data centre or telecom cloud. In 2026 most of the large clouds list, or are about to open, a Saudi region. The table below is what each provider publishes about itself: Google Cloud's regions and zones, Oracle's region list, Alibaba Cloud's regions and zones, Microsoft's February 2026 announcement and AWS's announcement. Saudi telecom groups also run local clouds, which suit some government and enterprise work.

A region being listed does not mean every service is there: managed databases, AI models, email sending and some security tools may only be available in other regions. Check each service you plan to use, and remember that an AI or email service called from a Saudi-hosted app may still process the data abroad.

How to choose hosting for a Saudi project

We run through these questions with every Saudi client during discovery, before any server is ordered:

Static websites, CDNs and the everyday tools

A marketing site with no logins and no stored customer data is the easy case: the HTML, images and scripts can sit on a global CDN, which will usually serve Saudi visitors from a nearby edge location. The data question moves to the contact form, newsletter sign-up, live chat and analytics. Send form submissions to a database or CRM you have mapped, load analytics and ad tags only after consent, and list those tools in the privacy policy.

Stores and apps hold more: accounts, addresses, order history, sometimes ID or health data. That is where the database location matters and where a Saudi region pays off. Payment card data is normally held by the payment gateway rather than by you; see payment gateways in Saudi Arabia.

Related Saudi rules for websites and apps

Hosting is one part of compliance. The privacy policy, consent, data subject rights and the 72-hour breach notice are covered in Saudi PDPL compliance for websites and apps. Online stores also need the disclosures and return rules in Saudi E-Commerce Law requirements, invoicing systems need ZATCA e-invoicing Phase 2, and the domain is covered in .sa domain registration. Serving Oman as well? Oman's own transfer rules are in Oman PDPL compliance for websites and apps.

How OGB Labs helps

OGB Labs, a web and software development company in Muscat, Oman, with a team in Dubai, builds websites, apps, online stores and custom software for Saudi companies. We confirm the hosting requirement during discovery, deploy to a Saudi cloud region when the data or the client calls for it, keep the database, uploads and backups in the Kingdom, map every third-party tool, and hand over a data-location record your legal adviser can use for the PDPL. We are not lawyers; we work alongside yours. See web and software development in Saudi Arabia and our custom software and website services, or message us on WhatsApp at +968 7111 0727.