# Hosting a website or app for Saudi Arabia: data residency, Saudi cloud regions, and what NCA, SDAIA and the PDPL actually require

> For most private companies there is no general rule today that a website or app serving Saudi customers must be hosted inside the Kingdom. The strict in-Kingdom hosting rules apply to government entities and to private companies that own, operate or host Critical National Infrastructure, under the National Cybersecurity Authority's Cloud Cybersecurity Controls (CCC-2:2024), which now refer data localisation questions to the National Data Management Office at SDAIA. Everyone else is governed by the Personal Data Protection Law: hosting personal data abroad is a transfer outside the Kingdom, allowed only for the purposes and under the conditions in Article 29 and SDAIA's transfer regulation, which in practice means a documented legal route, safeguards such as SDAIA's standard contractual clauses, and a risk assessment in some cases. Two things are changing. SDAIA's draft amendments, under public consultation until 5 November 2026, would require personal data to be stored inside the Kingdom. And the hyperscalers are arriving: Google Cloud (Dammam), Oracle (Riyadh and Jeddah) and Alibaba Cloud (Riyadh) already list Saudi regions, Microsoft says its Saudi Arabia East region opens to customers in Q4 2026, and AWS says its first Saudi region launches in December 2026. For a new system holding customer data, a Saudi region is now the low-risk default.

- Canonical: https://www.ogblabs.com/guides/saudi-data-residency-cloud-hosting
- Arabic version: https://www.ogblabs.com/ar/guides/saudi-data-residency-cloud-hosting
- Author: OGB Labs (https://www.ogblabs.com)
- Published: 2026-10-19
- Updated: 2026-10-19

## The rules, and where to read them

Three regulators touch hosting in Saudi Arabia: the National Cybersecurity Authority (NCA) for cybersecurity controls, the Saudi Data and AI Authority (SDAIA) for personal data and data governance, and the Communications, Space and Technology Commission (CST) for cloud providers. These are the documents this guide relies on, read in October 2026:

- NCA's [Cloud Cybersecurity Controls, CCC-2:2024](https://cdn.nca.gov.sa/api/files/public/upload/6d5408a3-d8e6-4e96-963b-2c7198e5b7c2_CCC-2-2024-EN-.pdf): scope, the controls for providers and tenants, and Annex D, which records that the data localisation controls were removed and moved to SDAIA's National Data Management Office. NCA states that the Arabic version is binding.
- The [Personal Data Protection Law](https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/PDPL) on SDAIA's National Data Governance Platform, in particular Article 29 on transfers outside the Kingdom.
- SDAIA's [Regulation on Personal Data Transfer Outside the Kingdom](https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/RegulationonPersonalDataTransferOutsidetheKingdom), version 2.0 of August 2024, and the [standard contractual clauses](https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter/details/StandardContractualClauses).
- CST's [Cloud Computing Services Provisioning Regulations](https://www.cst.gov.sa/en/regulations-and-licenses/regulations/Document-1550), issued by decision 506/1445 in 2023, which set the obligations and rights of cloud providers and their customers.
- The cloud providers' own region lists and announcements, linked in the regions section below.

## Who must host inside the Kingdom

The CCC applies to two groups of cloud customers, which NCA calls tenants: every government agency, including ministries, authorities, and their companies and sub-entities, and every private sector entity that owns, operates or hosts Critical National Infrastructure. Both must comply with the CCC and with NCA's Essential Cybersecurity Controls. Cloud providers serving them are in scope too. NCA lists, as examples outside the scope, providers that serve individuals and private companies that do not own, operate or host Critical National Infrastructure, and it only encourages those other entities to use the controls as good practice.

Until 2024 the controls themselves required in-scope providers to deliver services from inside the Kingdom, including storage, processing, disaster recovery, monitoring and support. CCC-2:2024 deleted those two subcontrols. Annex D explains that data localisation controls were transferred to the National Data Management Office (NDMO) at SDAIA, and that entities must refer to the NDMO about data localisation before taking any action. So if you are a government body, a supplier building a system for one, or a Critical National Infrastructure operator, treat in-Kingdom hosting as the expected answer and confirm the details with the NDMO and the contracting entity.

Sector regulators can add their own rules, and contracts often do: a tender from a ministry, a bank's vendor questionnaire or a hospital group's security schedule will usually state where data must live. Read those documents first, because they bind you even when the general law does not.

**Where does your project fall?**

| Your situation | Main rules | Hosting in practice |
| --- | --- | --- |
| Government entity, or its company or sub-entity | CCC and ECC, NDMO on localisation, PDPL | Inside the Kingdom, with a provider able to serve government workloads |
| Private company owning, operating or hosting Critical National Infrastructure | CCC and ECC, NDMO on localisation, PDPL | Inside the Kingdom; confirm details with the NDMO and NCA |
| Supplier building a system for either of the above | The client's obligations flow into your contract | Whatever the contract and the client's controls require, usually in-Kingdom |
| Private business: store, app, SaaS, clinic, school, services | PDPL and the transfer regulation | Abroad is possible with a documented transfer route; a Saudi region avoids the question |
| Website with no personal data beyond analytics | PDPL for cookies and analytics | Anywhere, with a CDN; check where analytics and forms send data |

## Everyone else: the PDPL treats hosting abroad as a transfer

If your servers, database, backups, email platform, CRM, analytics or AI tools are outside the Kingdom, the personal data in them has been transferred outside the Kingdom. Article 29 of the PDPL allows that only for listed purposes: performing an agreement to which the Kingdom is a party, serving the Kingdom's interests, performing an obligation to which the data subject is a party, such as delivering the order they placed, or other purposes set by the regulations. The transfer regulation adds three: central operational processing, providing a service or benefit to the data subject, and scientific research.

Article 29 then sets three conditions: the transfer must not harm national security or the Kingdom's vital interests; the destination must offer a level of protection no lower than the PDPL's, based on SDAIA's assessment; and the data transferred must be the minimum needed. Under Article 3 of the transfer regulation, SDAIA publishes the list of countries and international organisations it considers adequate and reviews it every four years or when needed. We could not find such a list on SDAIA's platform in October 2026, so check the [knowledge centre](https://dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter) before relying on adequacy.

Where the adequacy or minimum-data condition is not met, Article 4 of the regulation exempts the controller only in defined cases and only with appropriate safeguards: standard contractual clauses, binding common rules within a multinational group, or an accreditation certificate issued by a body SDAIA has licensed. The cases include infrequent or time-limited transfers about a limited number of people, central operations within a multinational group, direct service to the data subject, and research. Several of them exclude sensitive data, such as health data. These conditions are legal judgements, so have your adviser confirm the route for your setup.

Article 7 requires a written risk assessment before a transfer in two situations: whenever you rely on an Article 4 exemption, and whenever you transfer sensitive data abroad continuously or at scale. The assessment covers the purpose and legal basis, the processing and countries involved, the safeguards, how you limit the data to the minimum, the possible harm, and the measures to prevent or reduce it. Onward transfers from the foreign recipient stay subject to the PDPL under Article 5.

## What is changing: SDAIA's draft storage requirement

On 6 October 2026 SDAIA opened a public consultation, running to 5 November 2026, on amendments to the PDPL's Implementing Regulation. According to [Clyde & Co's summary of the draft](https://www.clydeco.com/en/insights/2026/10/sdaia-publishes-draft-amendments-to-the-pdpl), a new article would require controllers to store personal data inside the Kingdom, while transfers under the law would still be possible. The same summary says the amendments would apply 60 days after publication in the Official Gazette. It is a draft, its final text may differ, and nothing changes until it is adopted and published.

The practical reading for anyone building now: a system launched in 2027 should be able to keep its primary copy of Saudi personal data in the Kingdom without a rebuild. That means choosing a provider with a Saudi region, or at least an architecture where the database and file storage can move region without changing the application.

## Cloud regions inside Saudi Arabia in October 2026

Hosting in the Kingdom used to mean a local data centre or telecom cloud. In 2026 most of the large clouds list, or are about to open, a Saudi region. The table below is what each provider publishes about itself: [Google Cloud's regions and zones](https://cloud.google.com/compute/docs/regions-zones), [Oracle's region list](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm), [Alibaba Cloud's regions and zones](https://www.alibabacloud.com/help/en/ecs/user-guide/regions-and-zones), [Microsoft's February 2026 announcement](https://news.microsoft.com/source/emea/2026/02/microsoft-confirms-saudi-arabia-datacenter-region-available-for-customers-to-run-cloud-workloads-from-q4-2026/) and [AWS's announcement](https://www.aboutamazon.com/news/aws/aws-cloud-region-saudi-arabia). Saudi telecom groups also run local clouds, which suit some government and enterprise work.

A region being listed does not mean every service is there: managed databases, AI models, email sending and some security tools may only be available in other regions. Check each service you plan to use, and remember that an AI or email service called from a Saudi-hosted app may still process the data abroad.

**Saudi cloud regions, from the providers' own pages**

| Provider | Saudi region | Status |
| --- | --- | --- |
| Google Cloud | me-central2, Dammam, three zones | Listed in Google's regions and zones |
| Oracle Cloud Infrastructure | me-riyadh-1 (Riyadh) and me-jeddah-1 (Jeddah) | Listed in Oracle's region list |
| Alibaba Cloud | me-central-1, Riyadh partner region, two zones | Listed in Alibaba's regions and zones |
| Microsoft Azure | Saudi Arabia East, Eastern Province, three availability zones | Microsoft said in February 2026 that customers can run workloads from Q4 2026 |
| Amazon Web Services | First AWS region in the Kingdom | AWS said its region is on track to launch in December 2026 |

## How to choose hosting for a Saudi project

We run through these questions with every Saudi client during discovery, before any server is ordered:

1. Classify the project: are you, or is your client, a government entity or a Critical National Infrastructure operator? Does a contract, tender or sector regulator say where data must be stored? If yes, that decides it.
2. Map the personal data: what you collect, where it is stored, and every third-party service that receives it, including email, SMS, WhatsApp, payments, analytics, CRM, support chat and AI models.
3. Keep the core in the Kingdom where you can: the application database, file uploads and backups in a Saudi region, which removes most transfer questions and is ready for SDAIA's proposed storage rule.
4. For each service that stays abroad, record the Article 29 purpose, the safeguard (usually SDAIA's standard contractual clauses in the contract), and whether an Article 7 risk assessment is required. Send the minimum data.
5. Check the provider: the region offers the services you need, the provider can give you its CCC compliance status if you are in scope, and the contract states the data location, backup location and support access.
6. Design for latency and availability: a Saudi region for the application, a CDN for static files, and backups in a second zone or second Saudi region.
7. Write it down: a short hosting and data-location record supports your PDPL records of processing and answers the questions banks, enterprise customers and government buyers will ask.

## Static websites, CDNs and the everyday tools

A marketing site with no logins and no stored customer data is the easy case: the HTML, images and scripts can sit on a global CDN, which will usually serve Saudi visitors from a nearby edge location. The data question moves to the contact form, newsletter sign-up, live chat and analytics. Send form submissions to a database or CRM you have mapped, load analytics and ad tags only after consent, and list those tools in the privacy policy.

Stores and apps hold more: accounts, addresses, order history, sometimes ID or health data. That is where the database location matters and where a Saudi region pays off. Payment card data is normally held by the payment gateway rather than by you; see [payment gateways in Saudi Arabia](https://www.ogblabs.com/guides/payment-gateways-saudi-arabia).

## Related Saudi rules for websites and apps

Hosting is one part of compliance. The privacy policy, consent, data subject rights and the 72-hour breach notice are covered in [Saudi PDPL compliance for websites and apps](https://www.ogblabs.com/guides/saudi-pdpl-compliance-websites-apps). Online stores also need the disclosures and return rules in [Saudi E-Commerce Law requirements](https://www.ogblabs.com/guides/saudi-ecommerce-law-online-store-requirements), invoicing systems need [ZATCA e-invoicing Phase 2](https://www.ogblabs.com/guides/zatca-e-invoicing-phase-2-saudi), and the domain is covered in [.sa domain registration](https://www.ogblabs.com/guides/sa-domain-registration). Serving Oman as well? Oman's own transfer rules are in [Oman PDPL compliance for websites and apps](https://www.ogblabs.com/guides/oman-pdpl-compliance-websites-apps).

## How OGB Labs helps

OGB Labs, a web and software development company in Muscat, Oman, with a team in Dubai, builds websites, apps, online stores and custom software for Saudi companies. We confirm the hosting requirement during discovery, deploy to a Saudi cloud region when the data or the client calls for it, keep the database, uploads and backups in the Kingdom, map every third-party tool, and hand over a data-location record your legal adviser can use for the PDPL. We are not lawyers; we work alongside yours. See [web and software development in Saudi Arabia](https://www.ogblabs.com/locations/saudi-arabia) and our [custom software](https://www.ogblabs.com/services/custom-software) and [website](https://www.ogblabs.com/services/websites) services, or message us on WhatsApp at +968 7111 0727.

## Frequently asked questions

### Do websites and apps for Saudi customers have to be hosted in Saudi Arabia?

Not as a general rule for private companies today. Government entities and Critical National Infrastructure operators are expected to host in the Kingdom under NCA's Cloud Cybersecurity Controls and the NDMO's localisation rules. Other businesses may host abroad if the transfer meets Article 29 of the PDPL and SDAIA's transfer regulation. SDAIA's October 2026 draft would add a requirement to store personal data in the Kingdom.

### Who do NCA's Cloud Cybersecurity Controls apply to?

Under CCC-2:2024, to government agencies and their companies and sub-entities, to private entities that own, operate or host Critical National Infrastructure, and to cloud providers serving them. NCA encourages all other entities to use the controls as good practice.

### Does the CCC still contain data localisation requirements?

No. CCC-2:2024 deleted the subcontrols that required services from inside the Kingdom, and Annex D says localisation controls moved to the National Data Management Office at SDAIA, which entities must consult before acting.

### Can I use AWS, Azure or Google Cloud outside Saudi Arabia for a Saudi app?

A private business can, if it treats the hosting as a PDPL transfer: a valid Article 29 purpose, the conditions or an exemption with safeguards such as SDAIA's standard contractual clauses, the minimum data, and a risk assessment where Article 7 requires one. Government and Critical National Infrastructure work should stay in the Kingdom.

### Which cloud providers have a region in Saudi Arabia?

As of 19 October 2026, Google Cloud lists Dammam (me-central2), Oracle lists Riyadh and Jeddah, and Alibaba Cloud lists a Riyadh partner region. Microsoft says its Saudi Arabia East region opens to customers in Q4 2026, and AWS says its first Saudi region launches in December 2026.

### Has SDAIA published a list of countries with adequate data protection?

Article 3 of the transfer regulation says SDAIA will publish one and review it every four years or when needed. We could not find a published list on SDAIA's platform in October 2026, so most transfers rely on the exemptions and safeguards in Article 4.

### Is a risk assessment required to host personal data outside the Kingdom?

Under Article 7 of the transfer regulation, yes when you rely on an Article 4 exemption, and when you transfer sensitive data abroad continuously or at scale. It records the purpose, the countries, the safeguards, data minimisation, the possible harm and the mitigations.

### Does a CDN for a Saudi website break the PDPL?

Serving public files such as images and scripts from a global CDN does not by itself transfer customer data. The question is where forms, accounts, orders and analytics data are stored and processed, which should be mapped and covered by a transfer route if abroad.

## Related

- [Custom Software](https://www.ogblabs.com/services/custom-software): Portals, dashboards and business systems shaped around the way your company really runs.
- [Websites](https://www.ogblabs.com/services/websites): Company websites and web platforms designed around your brand, built to rank and to turn visitors into customers.
- [Mobile Apps](https://www.ogblabs.com/services/mobile-apps): iOS and Android apps people open every day — designed, engineered and shipped to the stores.
- [How to get your business recommended by ChatGPT, Perplexity, Gemini and Google AI: a guide for Omani companies](https://www.ogblabs.com/guides/get-cited-by-chatgpt-perplexity-google-ai): What ChatGPT, Perplexity, Claude, Gemini and Google AI Mode actually read before they recommend a company, which crawlers to allow, what to publish, and what to skip.
- [How to measure AI search traffic in Google Analytics 4 and Search Console: ChatGPT, Perplexity, Gemini, AI Overviews and AI Mode](https://www.ogblabs.com/guides/measure-ai-search-traffic-ga4-search-console): GA4's new AI Assistant channel, custom channel groups for ChatGPT and Perplexity referrals, and Search Console's Generative AI report for AI Overviews and AI Mode.
- [VAT registration in Saudi Arabia for online stores and apps: thresholds, foreign sellers, marketplaces and penalties](https://www.ogblabs.com/guides/saudi-vat-registration-online-sellers): When a Saudi or foreign online store, app or SaaS must register for VAT with ZATCA: SAR 375,000 and 187,500 thresholds, marketplace rules, deadlines and fines.

## Contact

- WhatsApp: +968 7111 0727 (https://wa.me/96871110727)
- Contact form: https://www.ogblabs.com/contact
- Email: hello@ogblabs.com
- Hours: Sunday – Thursday, 9:00 – 18:00 Gulf Standard Time (GMT+4)
- Locations: Muscat, Dubai, Riyadh (Oman, United Arab Emirates, Saudi Arabia)