Cloud Computing in Saudi Arabia: Data Residency, Local Regions and Regulations (2026 Guide)
Key takeaways
- Google Cloud (Dammam), Oracle (Jeddah, Riyadh) and Alibaba Cloud via SCCC run in-Kingdom regions today; Microsoft opens Saudi Arabia East in November 2026 and AWS targets December 2026.
- Data classification decides hosting: match each dataset to a provider whose CST registration class covers that level.
- NCA's CCC-2:2024 sets cloud controls for providers and for tenants in government and Critical National Infrastructure.
- Under the PDPL, keeping personal data in an in-Kingdom region avoids most cross-border transfer obligations.
- Hybrid cloud with a secure landing zone is the most common fit for mid-size and large Saudi organisations.
Cloud computing in Saudi Arabia is the delivery of computing power, storage, databases and AI services over the network from data centres that are increasingly located inside the Kingdom. For Saudi organisations the real decision is regulatory as much as technical: data classification, the provider's CST registration, NCA cloud controls and the PDPL together decide where each workload may run.
What is cloud computing?
Cloud computing replaces servers you buy and run yourself with capacity you rent on demand from a provider, paying for what you use. It is normally described in three service models:
- Infrastructure as a Service (IaaS) – virtual machines, storage and networks. You manage the operating system and everything above it.
- Platform as a Service (PaaS) – managed databases, Kubernetes, AI model hosting and integration services. The provider runs the platform; you run your code and data.
- Software as a Service (SaaS) – complete applications such as ERP, CRM or email, delivered over the browser.
For a CFO, the shift is from capital expenditure on hardware every five years to operating expenditure that scales with demand. For a CIO, it is faster provisioning, managed security services and access to AI infrastructure that would be impractical to build in-house. For both, it changes who physically holds the data, which is why residency matters so much in the Kingdom.
Which cloud and data centre regions are available in Saudi Arabia in 2026?
Until recently most hyperscale services used by Saudi companies ran from Bahrain, the UAE or Europe. That is changing quickly. The table below reflects publicly announced status as of October 2026.
| Provider | Location in KSA | Status (Oct 2026) | What to know |
|---|---|---|---|
| Google Cloud | Dammam (me-central2) | Live | Purchased and supported through CNTXT for customers with a KSA billing address. Google states CST granted the region a Class C licence following an NCA assessment against the ECC and CCC. |
| Oracle Cloud Infrastructure | Jeddah and Riyadh (me-riyadh-1) | Live | Jeddah opened in 2020; the Riyadh region was released on 31 July 2024. Oracle has announced plans for a further region in NEOM. |
| Microsoft Azure | Saudi Arabia East (Eastern Province) | Opening November 2026 | Three availability zones. Microsoft announced on 31 August 2026 that the region will be available to customers in November 2026. |
| Amazon Web Services | Saudi Arabia region | Due December 2026 | First announced in March 2024 with more than USD 5.3 billion of planned investment; AWS said in August 2026 it is on track to launch in December 2026. |
| Alibaba Cloud (via SCCC) | Riyadh | Live | Saudi Cloud Computing Company, a joint venture of stc, Alibaba Cloud, eWTP Arabia Capital, SCAI and SITE, launched services in June 2022 with two Riyadh data centres. |
| HUMAIN | Riyadh and Dammam (under build) | Expanding | PIF-owned AI company launched in May 2025, building AI data centres and cloud platforms. AWS is a preferred partner and plans up to 50 MW in a Saudi "AI Zone" by 2028. |
Two practical warnings. First, a new region rarely launches with the full service catalogue, so check that the specific databases, AI models and security services you need are available in-Kingdom before you commit. Second, "a data centre in Saudi Arabia" is not the same as "compliant for my data". That depends on the rules below.
Which regulations govern cloud computing in Saudi Arabia?
CST Cloud Computing Regulatory Framework
The Cloud Computing Regulatory Framework (CCRF) was issued by the former CITC, now the Communications, Space and Technology Commission (CST). Version 3 took effect on 3 December 2020. It requires providers that control cloud infrastructure in the Kingdom to register, and it states that Saudi Government data may not leave the Kingdom, even temporarily, unless another law expressly allows it. CST publishes a register of cloud providers by class:
- Class C – all data levels, including secret and top secret, for all sectors.
- Class B – public and confidential data for all sectors.
- Class A – public data only.
- Qualifying – individuals and private sector only; the financial sector is excluded.
NCA Cloud Cybersecurity Controls (CCC-2:2024)
The National Cybersecurity Authority's Cloud Cybersecurity Controls extend the Essential Cybersecurity Controls (ECC) to cloud. CCC-2:2024 was updated to reflect data localisation requirements and contains 37 main controls and 94 subcontrols for cloud service providers, plus 18 main controls and 26 subcontrols for cloud service tenants. Tenants in scope are government entities and private organisations that own, operate or host Critical National Infrastructure; NCA encourages every other organisation to adopt them. Our NCA ECC guide explains the base controls.
Personal Data Protection Law (PDPL)
The PDPL came into force on 14 September 2023 and became fully enforceable by SDAIA on 14 September 2024. Transferring personal data outside the Kingdom requires either an adequacy decision or an approved safeguard such as standard contractual clauses, binding corporate rules or certification, together with a risk assessment in defined cases. Hosting personal data in an in-Kingdom region removes much of that friction.
Cloud First Policy and sector rules
MCIT's Cloud First Policy (first version, October 2020) requires government entities to consider cloud before any new IT investment, bars them from building new data centres except in defined cases, and requires government cloud data to be stored inside the Kingdom. Financial institutions must also meet SAMA requirements, including the cloud computing subdomain of the SAMA Cybersecurity Framework.
What does data residency mean in practice?
Data residency is the legal and physical location of your data, including backups, logs and replicas. Start with classification. Saudi data classification policies based on the National Data Management Office approach use four levels: Top Secret, Secret, Restricted and Public. The level, not the department's preference, decides the hosting option.
- Classify each dataset and record the level in your cloud contract.
- Match the level to a provider whose CST class covers it.
- Pin primary storage, backups, disaster recovery copies and log archives to in-Kingdom regions.
- Control access: who at the provider can reach the data, from where, and under what approval.
- Prove it with configuration policies and continuous monitoring rather than one-off screenshots.
What is a sovereign cloud?
A sovereign cloud goes beyond residency. It also keeps operational control, support personnel and encryption keys under local jurisdiction. In the Kingdom, Google Cloud's Dammam region offers CNTXT-operated sovereign control packages with managed external key management and localised support, and a KSA data boundary option with access justifications. When evaluating any provider, ask three questions: where is the data, who can operate the platform, and who holds the keys? If the answers must all be "inside the organisation", an on-premise or private deployment may be the better fit, as we discuss in data sovereignty and on-premise AI.
Public, private or hybrid cloud: which fits a Saudi organisation?
| Model | What it is | Best for | Residency control | Watch-outs |
|---|---|---|---|---|
| Public cloud | Shared hyperscale infrastructure in a provider's region | Web apps, analytics, AI services, variable workloads | Strong if you use an in-Kingdom region and the right CST class | Service gaps in new regions, egress costs, skills |
| Private cloud | Dedicated infrastructure, on-premise or hosted | Secret or Restricted data, core banking, sensitive AI | Full | Higher fixed cost, capacity planning, in-house operations |
| Hybrid cloud | Private and public connected under one identity, network and monitoring layer | Most mid-size and large Saudi enterprises | Workload by workload | Integration complexity; needs strong architecture |
| Sovereign cloud | Public cloud with local operations and customer-controlled keys | Regulated sectors wanting cloud agility | High | Feature lag versus global regions; partner-dependent support |
How should a Saudi company migrate to the cloud?
- Map data and obligations. Classify data, list applicable rules (PDPL, NCA ECC/CCC, SAMA, sector regulators) and agree risk appetite with leadership.
- Assess the portfolio. For each application decide whether to rehost, replatform, refactor, replace with SaaS, retain or retire.
- Select regions and providers. Confirm CST class, CCC alignment and in-Kingdom availability of every service you need.
- Build a secure landing zone. Identity, network segmentation, logging, key management and policy guardrails before the first workload moves.
- Migrate in waves. Start with a low-risk pilot, measure, then move business-critical systems with tested rollback.
- Operate and optimise. FinOps reviews, continuous compliance monitoring and disaster recovery testing.
In one engagement, a hybrid AWS architecture with unified identity, centralised monitoring and automated DevOps delivered a 40% reduction in infrastructure overhead and continuous NCA compliance monitoring. Read the cloud migration case study, and our cloud migration strategy for Saudi enterprises for a deeper planning framework.
What drives cloud cost in Saudi Arabia?
Prices vary by provider, region and commitment, so treat any single figure with caution. The main cost drivers are compute and storage volume, data egress between regions and to the internet, software licensing brought into the cloud, managed security and backup services, reserved versus on-demand capacity, and the people needed to run it. A disciplined landing zone and tagging policy from day one is the cheapest way to keep spending visible.
Next step
With Microsoft and AWS adding in-Kingdom regions alongside Google, Oracle and local providers, 2026 is a sensible moment to revisit where your workloads run. Amwaj Solutions designs cloud and hybrid architectures with KSA data residency and NCA-aligned security built in from the start. Explore our cybersecurity and compliance services or contact us for an architecture review.
IT Integration
Frequently Asked Questions
Is AWS available in Saudi Arabia?
AWS does not yet operate a live region in Saudi Arabia as of October 2026. It announced the region in March 2024 with more than USD 5.3 billion of planned investment, and in August 2026 said it was on track to launch in December 2026. Until then, Saudi customers typically use the Bahrain or UAE regions, subject to their data classification.
Does Microsoft Azure have a data centre in Saudi Arabia?
Yes. Microsoft's Saudi Arabia East region is located in the Eastern Province with three availability zones. Microsoft announced on 31 August 2026 that it will be available to customers in November 2026, allowing eligible workloads and data to be hosted inside the Kingdom. Check which specific Azure services are available at launch before planning a migration.
Can a Saudi company store data on a cloud outside the Kingdom?
It depends on the data. Saudi Government data may not leave the Kingdom under the CST cloud framework. Personal data can be transferred abroad under the PDPL only with an adequacy decision or approved safeguards such as standard contractual clauses, plus a risk assessment in some cases. Non-personal commercial data has more flexibility, but sector regulators such as SAMA may impose their own conditions.
What is the difference between data residency and data sovereignty?
Data residency is where your data physically and legally sits, including backups and logs. Data sovereignty adds who controls it: which jurisdiction governs the provider, who operates the platform, who can access the data and who holds the encryption keys. A provider can offer residency in Saudi Arabia without full sovereignty, so ask about operations and key management as well as location.
Do private companies have to follow the NCA Cloud Cybersecurity Controls?
The CCC is mandatory for cloud providers serving in-scope tenants, and for tenants that are government entities or private organisations owning, operating or hosting Critical National Infrastructure. Other private companies are not strictly bound, but NCA encourages them to adopt the controls, and many enterprise customers and regulators now expect them as a baseline.
Which cloud model is best for a Saudi enterprise?
Most mid-size and large Saudi enterprises end up with hybrid cloud: sensitive or Secret-classified systems stay private or on-premise, while web applications, analytics and AI services run in an in-Kingdom public region. The right mix depends on data classification, regulatory scope, existing licences, in-house skills and how quickly workloads need to scale.