Data Localization Saudi: Where Must App Data Be Hosted?

Data localization Saudi rules do not say that all personal data must sit on servers inside the Kingdom. The Personal Data Protection Law (PDPL) sets conditions for sending personal data out of Saudi Arabia, and stricter in-Kingdom rules apply only to specific data types, such as government, financial-sector and critical-infrastructure data. If you run an app with Saudi users, your job is to know which category your data falls into and to document every transfer.

This guide explains the rule in plain terms and gives you a checklist you can hand to your developers.

Does Saudi Arabia require all app data to be stored in the Kingdom?

No. The PDPL is a transfer-control law, not a blanket localization law. King & Spalding notes that there is still a lingering perception that Saudi Arabia is a localization jurisdiction for personal data. It also notes that other data types, such as state secrets, have their own local requirements.

The practical result is a two-layer question:

1. Layer one: Is this ordinary personal data? If yes, you may transfer or host it abroad if you meet the transfer conditions.
2. Layer two: Is it government, regulated-sector or critical-infrastructure data? If yes, sector rules may force in-Kingdom hosting, whatever the PDPL says.

Many apps mix both. A food-ordering app stores customer names and addresses (ordinary personal data). A fintech app may also hold regulated financial data. Treat them separately.

What does data localization Saudi mean under the PDPL transfer rules?

It means you can send personal data outside the Kingdom only if the transfer meets the conditions in SDAIA's Regulation on Personal Data Transfer outside the Kingdom. The regulation implements Article 29 of the PDPL. The PDPL was issued under Royal Decree M/19 and amended by Royal Decree M/148, as stated in the official SDAIA regulation text.

Under Article 2 of that regulation, a controller may transfer or disclose personal data to a party outside the Kingdom if:

• the transfer does not affect national security or the Kingdom's vital interests;
• the transfer does not violate any other Saudi law; and
• the transfer is limited to the minimum necessary, for example by using data maps.

The full text is also on the SDAIA data governance portal. SDAIA updated the regulation in 2024. Secondary sources disagree on the exact date, so check the portal for the version in force.

Note the words "minimum necessary". Even if your host is abroad, you should not copy the whole customer database there "just in case".

Which safeguards can you use to send data abroad?

You can rely on contractual or group-level safeguards when the destination country does not otherwise qualify. Dentons lists binding common rules (for groups), standard contractual clauses (SCCs), and certificates of accreditation.

SDAIA publishes SCC templates on its Standard Contractual Clauses page. The first template listed is Controller to Controller. Which template fits depends on the roles of the parties. A hosting or SMS vendor that only processes data for you is normally a processor, so ask your lawyer which template applies.

SDAIA also issued a Risk Assessment Guideline for transferring personal data outside the Kingdom in February 2025, according to King & Spalding. Secondary summaries say a risk assessment is needed before safeguard-based transfers and for continuous or large-scale transfers of sensitive data. Read the guideline itself before you decide you are exempt.

Which data may still have to stay inside Saudi Arabia?

Government data, financial-sector data and data linked to critical national infrastructure (CNI) may carry in-Kingdom requirements. These come from sector regulators and other laws, not from the PDPL transfer rules. The details differ by regulator and contract, so they vary. Ask the regulator or the government client in writing.

The National Cybersecurity Authority (NCA) also matters here. Its controls were updated in 2024. Law-firm summaries indicate that the in-Kingdom hosting control was removed from the Essential Cybersecurity Controls (ECC) and Cloud Cybersecurity Controls (CCC), with localization questions referred to the National Data Management Office (NDMO) at SDAIA. Confirm this against the current NCA and NDMO texts before relying on it.

A worked example: a Riyadh delivery app

Say a Riyadh restaurant group builds an ordering app. It stores customer names, phone numbers and Saudi National Address details. It uses a hosting region outside the Kingdom and a foreign SMS provider.

Both are transfers of personal data. The group should:

• record both flows in a data map;
• check each vendor's role (processor or controller);
• sign the matching SDAIA clauses, or another approved safeguard;
• send the SMS vendor only the phone number and message, not the full profile.

If the same app later serves a government canteen contract, the hosting question must be asked again for that data.

How do you check your app step by step?

Use this order. It works for new apps and for apps already live.

1. List every place personal data goes. Include hosting, backups, analytics, crash reports, SMS, email, payment gateways and any plug-in into a Salla or Zid store.
2. Classify the data. Mark ordinary, sensitive, government, financial and CNI-related data separately.
3. Check sector rules. Ask each regulator or client in writing whether in-Kingdom hosting is required.
4. Apply the Article 2 test. Does the transfer harm national security or vital interests, or break another Saudi law? Can you cut it to the minimum?
5. Pick a safeguard. Use the SDAIA SCC page and, where needed, the risk assessment guideline.
6. Update your contracts. Hosting, SMS and analytics vendors should be bound by the clauses.
7. Write it down. Keep the data map, risk assessment and signed clauses ready to show.
8. Review every year, and when you add a vendor or a feature.

Common mistakes

• Assuming "Saudi users" means "Saudi servers" for every data type.
• Assuming a foreign host means no rules apply. PDPL reach can extend to parties outside the Kingdom, according to law-firm summaries.
• Forgetting backups, logs and analytics tools.
• Copying full databases to a test environment abroad.
• Relying on a vendor's marketing page instead of the official SDAIA text.

Where does your development team fit in?

Hosting choices are easier to change early. If you are planning a new app, ask your developer to build the data map into the design: separate stores for sensitive fields, a clear list of vendors, and the option to move a data store to another region. Quickship builds mobile apps and custom software on a quote basis. We are a technology company, so the legal decision on hosting stays with you and your Saudi-qualified adviser.