Saudi Arabia

Article 2(1) of the Personal Data Protection Law applies it to processing 'related to individuals residing in the Kingdom by any means from any party outside the Kingdom', and expressly covers data about deceased people where it could identify them or a family member. Article 33(4) tells the regulator to build tools to monitor controllers and processors located outside the Kingdom and to set procedures for enforcing the law abroad; we found no published instrument doing so. Registration duty: under the Rules Governing the National Register of Controllers Within the Kingdom, a controller must register on the National Data Governance Platform if it is a public body, if its main activity is personal data processing, if it processes sensitive data, or if it is an individual processing beyond personal or family use. Those Rules cover controllers WITHIN the Kingdom only and state that 'Separate registration rules for Controllers located outside the Kingdom will be issued by the Competent Authority' — as at 18 August 2026 we could not locate them. A data protection officer is required under Article 32 of the Implementing Regulation where the controller is a public body processing at large scale, where core activities require regular and systematic monitoring, or where core activities involve sensitive data; the officer may be an external contractor and may sit outside the Kingdom.

SECTOR BY SECTOR, as at 18 August 2026: BANKING AND FINANCE — data can leave with the right paperwork, in practice the hardest wall. The Saudi Central Bank's Rules on Outsourcing (circular 41027017, 15 December 2019) require a written SAMA no-objection for ANY outsourcing arrangement with a service provider located overseas, material or not, plus a legal opinion and a written confirmation of SAMA's right of access. The application must explain 'why it cannot be done within KSA'. Separately the SAMA Cyber Security Framework, control 3.4.3, states that 'in principle only cloud services should be used that are located in Saudi Arabia', with explicit SAMA approval needed otherwise. Article 30(1) of the Personal Data Protection Law expressly preserves the Saudi Central Bank's powers, so the general privacy law does not soften any of this. GOVERNMENT AND CRITICAL NATIONAL INFRASTRUCTURE — the most commonly mis-reported area. Until 2024 the National Cybersecurity Authority's Essential Cybersecurity Controls contained sub-control 4-2-3-3: 'Entity's information hosting and storage must be inside the Kingdom of Saudi Arabia'. The 2024 edition (ECC-2:2024) DELETED that sub-control, and the Cloud Cybersecurity Controls (CCC-2:2024) deleted the two matching cloud sub-controls 2-3-P-1-10 and 2-3-P-1-11. The published reason is that 'Controls related to data localization have been transferred from the document to the National Data Management Office (NDMO) at the Saudi Data and Artificial Intelligence Authority ... and entities must refer to the National Data Management Office regarding data localization before taking any action in this regard.' We could find no replacement localisation rule published by that office. So the position for government bodies and critical infrastructure is now case-by-case referral, not an automatic ban. PAYMENTS, INSURANCE, SECURITIES — all sit under the Saudi Central Bank, the Insurance Authority or the Capital Market Authority. We confirmed the central bank rules above, which cover banks and finance companies. We could not verify a separate published localisation rule for insurance or for capital market institutions and we do not assert one. TELECOMS — the Communications, Space and Technology Commission runs its regulations on a separate platform that was unreachable from our network on 18 August 2026. We could not verify a telecom-specific storage rule and do not assert one. HEALTH — the Personal Data Protection Law adds extra controls for health data (Article 23) but no localisation. We could not verify a separate health storage rule. MAPPING AND GEOSPATIAL — the survey and geospatial authority's website was blocked from our network. Not verified, not asserted.

Article 29(1) of the Law limits transfer to four purposes: performing an obligation under an agreement to which the Kingdom is a party; serving the interests of the Kingdom; performing an obligation to which the data subject is a party; and other purposes set out in the Regulations. Article 2 of the Regulation on Personal Data Transfer Outside the Kingdom adds three: central processing needed to run the controller's activities, providing a service or benefit to the data subject, and scientific research. Article 29(2) then imposes three cumulative conditions: no prejudice to national security or the Kingdom's vital interests; an adequate level of protection in the destination; and minimisation to the least data needed. Article 3 of the Transfer Regulation obliges the regulator to publish a list of adequate countries and organisations on its official website and to review it every four years; we could not find any published list as at 18 August 2026, and the same Article lets the regulator suspend transfers to a listed country at any time. Article 4 lets a controller escape the adequacy and minimisation conditions in five defined cases provided it applies standard contractual clauses, binding common rules, or an accreditation certificate. Both the Standard Contractual Clauses and the Binding Common Rules guidelines are version 1.0, September 2024. Two sharp edges in the clauses: rule 5 says any change to the approved wording 'shall not be recognized by the Competent Authority and shall be deemed a violation', and rule 8 requires the overseas data importer to submit to the jurisdiction of the Kingdom. Article 7 requires a documented risk assessment before transfer in the exemption cases and before any continuous or large-scale export of sensitive data. Article 5 applies the Law to onward transfers made by the overseas recipient.

The Saudi Data and Artificial Intelligence Authority (SDAIA) was named the competent authority for the Law. Its legislative arm is the National Data Management Office. Evidence it is operational, all checked on 18 August 2026: the National Data Governance Platform at dgp.sdaia.gov.sa is live and offers registration for public and private entities, a breach notification service, a compliance self-assessment and a public search of the national register; SDAIA has published Rules of Procedure on Committees for Reviewing Violations, which set out a full adjudication process — complaints registered within 10 days, charges filed within 60 days, the respondent replies within 5 days, the panel decides within 30 days, notification within 15 days, appeal to the competent court within 60 days — and confirm the panels may impose a warning or a fine. Article 36(2) of the Law requires each panel to have at least three members including a technical specialist and a legal adviser, and its decisions must be approved by SDAIA's president. Criminal cases under Article 35 go to the Public Prosecution and the courts, not to SDAIA. We found no register of published enforcement decisions, so we rate enforcement as waking rather than active. Sector regulators are separately and clearly operational: the Saudi Central Bank publishes a live consolidated rulebook, and the National Cybersecurity Authority actively revises its binding controls (both the essential and cloud control sets were reissued in 2024 and republished in July 2025).

Ceiling: Article 18(1) of the Law requires destruction without undue delay when the data is no longer needed, with the option to keep a version stripped of anything that could identify the person. Article 8 of the Implementing Regulation adds the four destruction triggers and requires destruction of all copies including backups, plus telling anyone the data was disclosed to and asking them to destroy it as well. Floor: Article 33(1) of the Implementing Regulation requires the record of processing activities to be kept throughout processing 'and till to five years after the date of end of any Personal Data Processing activity'. Conflict rule: Article 18(2)(a) says where a legal basis requires retention for a set period, destroy at the end of that period or when the purpose is met, 'whichever longer' — so a statutory minimum always beats the privacy duty to delete. Article 18(2)(b) adds a litigation hold: data tied to a case before a judicial authority is kept until proceedings end. Tax and accounting floors sit outside the privacy law: electronic invoices are governed by the E-Invoicing Regulation, which folds in the record-keeping rules of the value added tax rules, and Article 41 of the Law imposes a lifelong confidentiality duty that survives the end of employment or a contract. We could not open the value added tax implementing regulation text on the tax authority's site, so we do not state the exact number of years for tax records here.

Article 20 of the Law creates the duty; Article 24 of the Implementing Regulation sets the 72 hours and the required content: what happened and when, when you became aware, the categories and numbers of people affected, the risks, what you have done, and whether you have told the people. If you cannot supply everything inside 72 hours you may complete the notification later, and you must keep records of the breach and supporting documents. SDAIA's Personal Data Breach Incidents Procedural Guide confirms the notification runs through the National Data Governance Platform and that prior registration on the platform is a precondition — this is the operational trap, because a company that has never registered cannot file on the day it needs to. The same Guide opens with the words 'Without prejudice to submitting any report or notice of personal data breach pursuant to Regulations issued by the National Cybersecurity Authority', which is the express acknowledgement of a second, overlapping regime. Notification to individuals is required whenever the breach may damage their data or prejudice their rights or interests, and must describe the breach, the risks, and the steps taken. Processors must notify the controller without undue delay under Article 17 of the Implementing Regulation.

1. National-interest screening. Article 29(2)(a) of the Law forbids a transfer that would prejudice national security or the vital interests of the Kingdom, and SDAIA's Risk Assessment Guideline of February 2025 devotes a whole phase to identifying factors for that analysis. It asks for the exact country of storage, whether it is public or private cloud, whether the impact reaches beyond the individual to their family or to society, and whether the recipient's own laws obstruct compliance. This is a sovereignty test bolted onto a privacy test, and it has no direct equivalent in European practice. 2. Word-perfect standard clauses and submission to Saudi jurisdiction. Rule 5 of the Standard Contractual Clauses treats any edit to the approved text as a violation; rule 7 blocks the route entirely where the recipient's local law prevents compliance; rule 8 requires the importer to submit to the Kingdom's jurisdiction and to enforce binding Saudi decisions; rule 9 requires the importer to answer the regulator's requests and cooperate with audits. 3. Criminal liability for individuals. Article 35 of the Law punishes disclosing or publishing sensitive data with intent to harm or to gain, with up to two years in prison or a fine up to 3 million Saudi riyals (about US$800,000), or both, and the fine may be doubled for a repeat offence. Sensitive data in Saudi Arabia expressly includes religious, intellectual or political belief, and data showing that one or both of a person's parents are unknown — categories that are not on the usual global list. 4. Supplier contracts must go further than a normal processing agreement. Article 17 of the Implementing Regulation requires the contract to state whether the processor is subject to another country's regulations and the effect on its compliance, and to remove any requirement for the individual's consent before a disclosure that Saudi law makes mandatory, provided the processor tells the controller. Sub-processors need the controller's prior acceptance, and a processor that ignores instructions is treated as a controller and is directly liable. 5. The deleted localisation rule. Sub-control 4-2-3-3 of the Essential Cybersecurity Controls and sub-controls 2-3-P-1-10 and 2-3-P-1-11 of the Cloud Cybersecurity Controls were removed in the 2024 editions and the mandate moved to the National Data Management Office. Anyone still citing 'ECC 4-2-3-3' as a live in-Kingdom hosting mandate is citing a deleted control. The duty that replaced it is a duty to ask that office before acting. 6. Bonus: you cannot file a breach report if you have not already registered on the National Data Governance Platform.

DORMANT SWITCHES, all traceable to text already in force: 1. The adequacy list. Article 3 of the Transfer Regulation requires SDAIA to publish a list of countries and international organisations with adequate protection, reviewed every four years or as needed. No list found as at 18 August 2026. Publication would immediately change which transfers need standard contractual clauses. Article 3(4) says the same tests apply to cities, special economic zones and global trade centres, so a jurisdiction could be listed or excluded in part. 2. Suspension of transfers. Article 3(3) lets SDAIA suspend transfer or disclosure to any listed country or organisation. No public procedure or notice period. 3. Withdrawal of an exemption. Article 6 of the Transfer Regulation lets SDAIA decide that a controller's safeguards are inadequate in a specific case, at which point the controller must halt the transfer and tell every recipient. That is a one-organisation kill switch. 4. The transferred localisation mandate. The National Cybersecurity Authority moved data localisation for government bodies and critical national infrastructure to the National Data Management Office in the 2024 control sets. That office has not published a replacement control. It could publish a binding in-Kingdom hosting rule at any time. 5. Registration rules for controllers based outside the Kingdom. The current register rules cover controllers within the Kingdom and state that separate rules for those outside will be issued. When they arrive, foreign companies serving Saudi residents acquire a registration duty they do not have today. 6. Rewriting the standard contract. Rule 11 of the Standard Contractual Clauses lets SDAIA change the clauses at its discretion, with transitional rules to follow. Article 4(4) of the Transfer Regulation lets it review the adequacy of safeguards every two years or as needed — the first such review window has already opened.