Saudi Arabia

Article 2(1) of the Personal Data Protection Law covers data about people living in the Kingdom. It applies 'by any means from any party outside the Kingdom'. It also covers data about people who have died, where that data could identify them or a family member. Article 33(4) tells the regulator to build tools to monitor companies outside the Kingdom that handle this data. It also tells the regulator to set out how it will enforce the law abroad. We found nothing published that does either. On registration. Under the rules for the national register of companies inside the Kingdom, you must register on the National Data Governance Platform in four cases. If you are a public body. If handling personal data is your main activity. If you handle sensitive data. Or if you are an individual using personal data beyond personal or family life. Those rules cover companies inside the Kingdom only. They say separate registration rules for companies located outside the Kingdom will be issued later. As at 18 August 2026 we could not find them. You need a data protection officer under Article 32 of the Implementing Regulation in three cases. If you are a public body handling data at large scale. If your core activities need regular and systematic monitoring of people. Or if your core activities involve sensitive data. The officer can be an outside contractor and can sit outside the Kingdom.

INDUSTRY BY INDUSTRY, as at 18 August 2026: BANKING AND FINANCE — data can leave only if conditions are met This is the hardest area of all. The Saudi Central Bank's Rules on Outsourcing (circular 41027017, 15 December 2019) require the bank's written no-objection for ANY outsourcing to a service provider located overseas. It makes no difference whether the arrangement is major or minor. You also need a legal opinion and written confirmation of the central bank's right of access. The application must explain 'why it cannot be done within KSA'. Separately, the Saudi Central Bank's cyber security rulebook, control 3.4.3, states that 'in principle only cloud services should be used that are located in Saudi Arabia'. Anything else needs the central bank's explicit approval. Article 30(1) of the Personal Data Protection Law expressly preserves the Saudi Central Bank's powers. So the general privacy law does not soften any of this. GOVERNMENT AND CRITICAL NATIONAL INFRASTRUCTURE — the area most often reported wrongly. Until 2024 the National Cybersecurity Authority's Essential Cybersecurity Controls contained sub-control 4-2-3-3: 'Entity's information hosting and storage must be inside the Kingdom of Saudi Arabia'. The 2024 edition (ECC-2:2024) DELETED that sub-control. The Cloud Cybersecurity Controls (CCC-2:2024) deleted the two matching cloud sub-controls, 2-3-P-1-10 and 2-3-P-1-11. The published reason is that controls on keeping data in the country moved to the National Data Management Office. That office sits inside the Saudi Data and Artificial Intelligence Authority. It adds that entities must ask that office about keeping data in the country before taking any action. We could find no replacement rule published by that office. So government bodies and critical infrastructure now face a decision case by case, not an automatic ban. PAYMENTS, INSURANCE AND SECURITIES — these all sit under the Saudi Central Bank, the Insurance Authority or the Capital Market Authority. We confirmed the central bank rules above, which cover banks and finance companies. We could not verify a separate published rule on where data must sit for insurance or capital market firms, and we do not claim one exists. TELECOMS — the Communications, Space and Technology Commission runs its rules on a separate platform. We could not reach that platform on 18 August 2026. We could not verify a telecom rule on where data must be stored, and we do not claim one exists. HEALTH — the Personal Data Protection Law adds extra controls for health data in Article 23, but says nothing about where it must be stored. We could not verify a separate health storage rule. MAPPING AND GEOSPATIAL — we could not reach the survey and geospatial authority's website. Nothing verified, nothing claimed.

Article 29(1) of the Law allows a transfer for four reasons only. To carry out a duty under an agreement the Kingdom is party to. To serve the interests of the Kingdom. To carry out a duty under an agreement the person themselves is party to. And for other reasons set out in the Regulations. Article 2 of the Regulation on Personal Data Transfer Outside the Kingdom adds three more. Handling data centrally where that is needed to run your business. Providing a service or benefit to the person the data is about. And scientific research. Article 29(2) then adds three conditions, and you must meet all of them. The transfer must not harm national security or the Kingdom's vital interests. The destination must give a good enough level of protection. And you must send the smallest amount of data that will do the job. Article 3 of the Transfer Regulation requires the regulator to publish a list of approved countries and international organisations. The list goes on its official website and must be reviewed every four years. We could not find any published list as at 18 August 2026. The same Article lets the regulator suspend transfers to a listed country at any time. Article 4 lets you skip the approved-destination test and the smallest-amount test in five defined cases. To do that you must use the standard contractual clauses, binding common rules, or an accreditation certificate. Both the Standard Contractual Clauses and the Binding Common Rules guidelines are version 1.0, dated September 2024. Two sharp edges sit in the clauses. Rule 5 says any change to the approved wording 'shall not be recognized by the Competent Authority and shall be deemed a violation'. Rule 8 requires the overseas recipient to accept the Kingdom's courts. Article 7 requires a written risk assessment before a transfer that relies on an exemption. It also requires one before any continuous or large-scale export of sensitive data. Article 5 applies the Law to any onward transfer the overseas recipient makes.

The Saudi Data and Artificial Intelligence Authority was named the competent authority for the Law. Its legislative arm is the National Data Management Office. Here is the evidence that it is working, all checked on 18 August 2026. The National Data Governance Platform at dgp.sdaia.gov.sa is live. It offers registration for public and private bodies, a breach notification service, a compliance self-assessment and a public search of the national register. The authority has published Rules of Procedure on Committees for Reviewing Violations. These set out a full decision process. A complaint is registered within 10 days. Charges are filed within 60 days. The respondent replies within 5 days. The panel decides within 30 days. Notification follows within 15 days. An appeal to the competent court can be filed within 60 days. The panels can impose a warning or a fine. Article 36(2) of the Law requires each panel to have at least three members, including a technical specialist and a legal adviser. The authority's president must approve the panel's decisions. Criminal cases under Article 35 go to the Public Prosecution and the courts, not to the authority. We found no register of published enforcement decisions, so we rate enforcement as waking rather than active. Other regulators are clearly working. The Saudi Central Bank publishes a live consolidated rulebook. The National Cybersecurity Authority actively revises its binding controls, and both the essential and cloud control sets were reissued in 2024 and republished in July 2025.

The maximum. Article 18(1) of the Law requires destruction without undue delay when you no longer need the data. You can instead keep a version with everything that could identify the person stripped out. Article 8 of the Implementing Regulation adds the four triggers for destruction. It requires you to destroy all copies, including backups. You must also tell anyone you gave the data to and ask them to destroy it as well. The minimum. Article 33(1) of the Implementing Regulation requires you to keep your record of data activities while the activity runs. You must also keep it for five years after the activity ends. The clash rule. Article 18(2)(a) covers the case where a legal basis requires you to keep data for a set period. You destroy it at the end of that period, or when the purpose is met, whichever is longer. So a legal minimum always beats the privacy duty to delete. Article 18(2)(b) adds a litigation hold. Data tied to a case before a judicial authority is kept until the case ends. Tax and accounting minimums sit outside the privacy law. Electronic invoices are covered by the E-Invoicing Regulation, which pulls in the record-keeping rules of the value added tax rules. Article 41 of the Law adds a lifelong duty of confidentiality that survives the end of employment or a contract. We could not open the value added tax implementing regulation on the tax authority's site. So we do not state the exact number of years for tax records here.

Article 20 of the Law creates the duty. Article 24 of the Implementing Regulation sets the 72 hours and the content. You must say what happened and when. You must say when you became aware. You must give the categories and numbers of people affected, the risks, what you have done, and whether you have told the people. If you cannot supply everything inside 72 hours, you may complete the notification later. You must keep records of the breach and the supporting documents. The Saudi Data and Artificial Intelligence Authority's Personal Data Breach Incidents Procedural Guide confirms that you notify through the National Data Governance Platform. It also confirms that you must already be registered on the platform. That is the operational trap. A company that has never registered cannot file on the day it needs to. The same Guide opens by saying it does not displace any breach report required by the National Cybersecurity Authority. That is an open acknowledgement of a second, overlapping set of rules. You must tell the people affected whenever the breach may damage their data or harm their rights or interests. Your message must describe the breach, the risks and the steps you have taken. Under Article 17 of the Implementing Regulation, a supplier who handles data for you must tell you without undue delay.

1. National interest screening. Article 29(2)(a) of the Law forbids a transfer that would harm national security or the vital interests of the Kingdom. The Saudi Data and Artificial Intelligence Authority's Risk Assessment Guideline of February 2025 gives a whole phase to working this out. It asks for the exact country of storage. It asks whether the cloud is public or private. It asks whether the impact reaches beyond the individual to their family or to society. And it asks whether the recipient's own laws would stop them complying. This is a national sovereignty test bolted onto a privacy test. It has no direct equivalent in European rules. 2. Word-perfect standard clauses, and Saudi courts. Rule 5 of the Standard Contractual Clauses treats any edit to the approved text as a violation. Rule 7 blocks the route entirely where the recipient's local law prevents compliance. Rule 8 requires the recipient to accept the Kingdom's courts and to enforce binding Saudi decisions. Rule 9 requires the recipient to answer the regulator's requests and cooperate with audits. 3. Individuals can go to prison. Article 35 of the Law punishes disclosing or publishing sensitive data with intent to harm or to gain. The penalty is up to two years in prison, a fine of up to 3 million Saudi riyals (about 800,000 US dollars), or both. The fine may be doubled for a repeat offence. Sensitive data in Saudi Arabia includes religious, intellectual or political belief. It also includes data showing that one or both of a person's parents are unknown. Those categories are not on the usual global list. 4. Supplier contracts must go further than usual. Article 17 of the Implementing Regulation requires the contract to state whether your supplier is subject to another country's rules, and the effect on its compliance. It also requires you to drop any need for the person's consent before a disclosure that Saudi law makes compulsory. The supplier must tell you about it. Sub-suppliers need your prior acceptance. A supplier that ignores your instructions is treated as the company that decides how the data is used, and becomes directly liable. 5. The deleted rule about keeping data in the country. Sub-control 4-2-3-3 of the Essential Cybersecurity Controls was removed in the 2024 edition. So were sub-controls 2-3-P-1-10 and 2-3-P-1-11 of the Cloud Cybersecurity Controls. The mandate moved to the National Data Management Office. Anyone still citing 'ECC 4-2-3-3' as a live requirement to host inside the Kingdom is citing a deleted control. What replaced it is a duty to ask that office before acting. 6. One more. You cannot file a breach report if you have not already registered on the National Data Governance Platform.

POWERS THE GOVERNMENT ALREADY HOLDS, all traceable to text already in force: 1. The approved-country list. Article 3 of the Transfer Regulation requires the Saudi Data and Artificial Intelligence Authority to publish a list. The list names countries and international organisations that protect data well enough. It must review the list every four years, or sooner if needed. We found no list as at 18 August 2026. Publishing one would immediately change which transfers need standard contractual clauses. Article 3(4) says the same tests apply to cities, special economic zones and global trade centres. So a country could be listed or excluded in part. 2. Suspending transfers. Article 3(3) lets the authority suspend transfer or disclosure to any listed country or organisation. There is no public procedure and no notice period. 3. Withdrawing an exemption. Article 6 of the Transfer Regulation lets the authority decide that your safeguards are not good enough in a specific case. You must then stop the transfer and tell every recipient. That power can shut down one company on its own. 4. The transferred mandate on keeping data in the country. The National Cybersecurity Authority moved this question for government bodies and critical national infrastructure to the National Data Management Office in the 2024 control sets. That office has not published a replacement control. It could publish a binding rule requiring hosting inside the Kingdom at any time. 5. Registration rules for companies based outside the Kingdom. The current register rules cover companies inside the Kingdom. They say separate rules for those outside will be issued. When they arrive, foreign companies serving Saudi residents will pick up a registration duty they do not have today. 6. Rewriting the standard contract. Rule 11 of the Standard Contractual Clauses lets the authority change the clauses when it chooses, with transitional rules to follow. Article 4(4) of the Transfer Regulation lets it review whether safeguards are good enough every two years, or sooner if needed. The first review window has already opened.