Saudi Data Localization and Transfers: PDPL and Sector Rules

No, not as a general rule any more. Early PDPL drafts leaned toward hard localization, but the 2023 amendments and 2024 Transfer Regulations settled on a GDPR-like architecture: transfers are lawful with adequacy, safeguards, or derogations. What survives is sectoral localization: government data under NCA cloud controls, certain SAMA-regulated financial workloads, CST's Class C data in its cloud framework, and health-sector rules. So the analysis is per-dataset and per-sector, a fintech and a retailer face different maps.

Three instruments under the Transfer Regulations: standard contractual clauses in the form SDAIA publishes (executed as-is, without conflicting amendments), binding common rules for intra-group transfers approved per the regulations, and certifications of an accredited compliance standard. Absent adequacy or safeguards, narrow derogations apply, performance of an agreement with the data subject, the data subject's vital interest, and specified public-interest cases. EU SCCs, DPF certification, and other foreign instruments do not substitute for the Saudi forms.

When transferring on safeguards rather than adequacy, and in the other cases the regulations enumerate (including continuous or large-scale transfers of sensitive data). The assessment covers the purpose and scope of the transfer, the destination's legal framework and the likelihood of onward government access, the categories and volume of data, and mitigations. It is SDAIA's analogue to the post-Schrems II transfer impact assessment, and it is a producibility document: written before the transfer, kept for inquiries.

SAMA: banks, insurers, and finance companies face outsourcing rules requiring SAMA non-objection for material cloud/outsourcing arrangements and expectations that certain core systems and data remain in-Kingdom. CST: the Cloud Computing Regulatory Framework tiers data by sensitivity; higher-classification content is restricted to compliant, often in-Kingdom, cloud providers. NCA: the Essential Cybersecurity Controls and cloud controls require government and critical-national-infrastructure data to be hosted in Saudi Arabia with cleared providers. These are license-conditioned regimes; violating them threatens the authorization to operate, not just a fine.

Classify first: government or CNI data (NCA localization), regulated financial data (SAMA approval path), high-tier cloud data (CST framework), and everything else (PDPL transfer mechanics). For the PDPL layer, execute SDAIA SCCs with each foreign recipient, run the risk assessments, and minimize transferred fields. Hyperscalers' Saudi regions (launched by Alibaba, Oracle, Google Cloud, and others, with AWS's Saudi region announced) make in-Kingdom hosting a realistic default for sensitive workloads, keeping the transferable remainder small. Document the classification and per-flow mechanism in the RoPA.