PDPL and data residency: what the official texts say about transferring personal data outside Saudi Arabia

"Does the PDPL require us to keep data in Saudi Arabia?" is one of the most common questions when choosing hosting. The official texts answer it in a more specific way than most summaries: the law does not forbid transfers outside the Kingdom, but it allows them only for listed purposes, under conditions, and with documented safeguards and risk assessments in many cases.

This article reads the official texts published by SDAIA: the Personal Data Protection Law (PDPL), its Implementing Regulation, and the Regulation on Personal Data Transfer outside the Kingdom. It is educational, not legal advice. Sector regulators may impose their own rules, and specific decisions should be checked with your legal adviser or data protection officer.

Which version to read

SDAIA's National Data Governance Platform knowledge centre publishes the Arabic texts. The Transfer Regulation there is marked version 2.0, August 2024. The English translation of the regulations on sdaia.gov.sa dates from 2023, so for transfers rely on the current Arabic text. The summary below follows version 2.0.

What the law says: Article 29

Under Article 29 of the PDPL, a controller may transfer personal data outside the Kingdom, or disclose it to a party outside the Kingdom, for one of these purposes: performing an obligation under an agreement to which the Kingdom is a party; serving the interests of the Kingdom; performing an obligation to which the data subject is a party; or other purposes set out in the regulations. The transfer must also meet three conditions:

1. It must not prejudice national security or the Kingdom's vital interests.
2. There must be an adequate level of protection outside the Kingdom, at least equivalent to the PDPL, based on an assessment by the competent authority.
3. It must be limited to the minimum personal data needed.

The conditions do not apply in cases of extreme necessity to preserve the data subject's life or vital interests, or to prevent, examine or treat disease. The regulations may grant exemptions from conditions 2 and 3, with controls.

What the Transfer Regulation adds

• Other permitted purposes (Article 2): operational processes needed for centralised processing so the controller can carry on its activities; providing a service or benefit to the data subject; and scientific research and studies.
• Adequacy list (Article 3): the competent authority publishes on its website a list of countries and international organisations offering an adequate level of protection, reviewed every four years or when needed, against criteria such as data protection laws and rights (including compensation), an enforcing supervisory authority and willingness to cooperate. It may remove a country from the list or suspend transfers to it. Check the platform for the list's current status rather than assuming.
• Appropriate safeguards (Article 4): standard contractual clauses, binding common rules for multinational groups, or an accreditation certificate. Where a transfer falls under one of the listed exemption cases (for example infrequent transfers about a limited number of people, central operational processes within a multinational group, a direct service to the data subject, or scientific research), the controller may be exempted from the adequacy and/or minimum-data conditions, but the transfer is then bound to these safeguards. Several cases exclude sensitive data. SDAIA has published standard contractual clauses (version 1.0, September 2024).
• Onward transfers (Article 5): the PDPL continues to apply when data already transferred abroad is passed on again.
• Losing the exemption (Article 6): if safeguards are not applied or prove insufficient, the exemption no longer applies; the controller must stop the transfer and notify the recipients.
• Risk assessment (Article 7): required before transferring under an Article 4 exemption, and before continuous or large-scale transfers of sensitive data. It must cover the purpose and legal basis, the nature and geographic scope of the transfer, the safeguards and their adequacy, minimisation measures, possible material or moral impacts and their likelihood, and mitigating controls. SDAIA's knowledge centre includes a guide on assessing transfer risks.

The Implementing Regulation is relevant too: Article 17 requires the controller's agreement with a processor to state whether the processor is subject to laws of other countries and how that affects its compliance, and to identify sub-processors.

A checklist for hosting decisions

Transfers are not only about where the main server sits. Map every place personal data goes:

• Production servers and databases, and their replicas.
• Backups and disaster-recovery copies, including off-site copies made by scripts.
• Email, file sharing and collaboration tools.
• Logs, monitoring, error-tracking and analytics services that receive IP addresses, user identifiers or form contents.
• Support and administration: which vendors or contractors can access the data, and from where.
• AI, translation, payment and messaging APIs that receive customer data.

For each flow, record where data is stored and accessed and who the sub-processors are. Flows that stay entirely within the Kingdom fall outside the transfer rules, though every other PDPL obligation still applies. For each flow that leaves the Kingdom, document the Article 29 purpose, whether the destination is on the adequacy list or which safeguard you rely on, whether an Article 7 risk assessment is required, and how you keep the data to the minimum needed.

Skyline publishes its own data-residency guide for Skyline Cloud, which runs cloud servers, business email and storage on Saudi-resident infrastructure.

What you should do

• Read the current Arabic Transfer Regulation (version 2.0) rather than older summaries or translations.
• Inventory every system and vendor that stores or can access personal data, including backups, logs and support access.
• Prefer in-Kingdom hosting and backups where you can, which removes those flows from the transfer rules.
• For any remaining transfer, document the purpose, the adequacy basis or safeguard (such as SDAIA's standard contractual clauses), and the risk assessment where Article 7 requires it.
• Ask processors whether they are subject to foreign laws and which sub-processors they use, as Article 17 of the Implementing Regulation expects.
• Review the analysis whenever you add a vendor or SDAIA updates its texts.

Sources

• dgp.sdaia.gov.sa/wps/portal/pdp/knowledgecenter
• dgp.sdaia.gov.sa/wps/wcm/connect/666d32b6-b6fd-4296-8be2-cce891ebca52/%D9%84%D8%A7%D9%8...
• dgp.sdaia.gov.sa/wps/wcm/connect/d60cac13-b94f-4e58-9af5-14c4979c376d/%D9%86%D8%B8%D8%A...
• dgp.sdaia.gov.sa/wps/wcm/connect/c863ed7e-4bdf-4bb7-b30d-704db0a8b4b9/%D8%A7%D9%84%D9%8...
• dgp.sdaia.gov.sa/wps/wcm/connect/6a37fc53-96ab-4e9a-9108-d9a0cdcda9c4/%D8%A7%D9%84%D8%A...
• sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Rev...
• sdaia.gov.sa/en/SDAIA/about/Documents/ImplementingRegulation.pdf
• sdaia.gov.sa/Documents/StandardContractualClausesForPersonalDataTransferEN.pdf
• cloud.alskyline.com/data-residency-saudi-arabia
• cloud.alskyline.com