Know exactly where your data lives, and prove it

Three layers of Saudi rules touch hosting, and they work together. The Communications, Space and Technology Commission (CST) publishes the Cloud Computing Regulatory Framework, which registers cloud providers and sets obligations according to the sensitivity of the content customers store. The National Data Management Office classifies government and regulated data into levels, and the National Cybersecurity Authority sets cloud cybersecurity controls on top. For the higher classification levels, hosting must be inside the Kingdom.

The Personal Data Protection Law (PDPL), supervised by SDAIA, adds rules for personal data in particular. Transferring personal data outside the Kingdom is allowed only under specified conditions and in line with the transfer regulations. A company hosting only in Riyadh can still breach those rules if an analytics tool, a support platform or a backup service copies records abroad.

Sector regulators add their own requirements. Banks and insurers follow the Saudi Central Bank's rules on outsourcing and cloud, and health organizations follow health-data requirements. We read the rules that apply to your sector at the start, and write the interpretation down so your legal team can confirm it. We do not give legal advice, and your counsel makes the final call on any ambiguity.

In-Kingdom capacity is now offered by several providers: AWS, Google Cloud and Oracle with regions in the Kingdom, STC Cloud as a local provider, and Alibaba Cloud in Riyadh. They differ in which services are available locally, which matters more than the headline price. A managed database, a container service or an AI service may exist in one provider's Saudi region and not another's, and the list changes often.

We therefore start from the services you need, not the provider's brand. For each candidate we check service availability in the Saudi region, the support model and local contracting terms, how encryption keys are handled, whether a second in-Kingdom site exists for disaster recovery, and the price at your expected usage. The output is a one-page comparison with a recommendation and the trade-offs, and you decide.

Some organizations choose a hybrid pattern: sensitive data in an in-Kingdom region, less sensitive workloads in a wider cloud. It is allowed when the classification supports it, but it adds integration work and must be designed carefully so data does not drift across the boundary through shared services.

Placement is the easy half. Control is harder. After workloads move, we set policies that deny creating resources in non-approved regions, lock the backup and replication settings to approved locations, and alert when any configuration changes. This turns residency from a one-time project into a standing rule the platform enforces.

Encryption keys deserve attention. Data encrypted with a key held outside the Kingdom may still raise questions in an assessment. We keep keys in an in-Kingdom key service where available, restrict who can use them, and log every use. For the most sensitive data, customer-managed keys give you the ability to revoke access.

The final deliverable is an evidence pack: the data map, the architecture diagrams, region and policy settings, access logs, and a record of each classification decision. A project from first assessment to first placement usually takes 3 to 6 weeks, and a full migration follows the timeline set out in our cloud migration service.