Saudi Arabia. Data localisation / cross-border. Regulatory framework
CCRFCST Cloud Computing Regulatory Framework
In force
Partly verified
Low confidence.Current version/date of CCRF not verified (CST pages not readable).
§1Summary
- Synopsis
Regulates cloud service providers serving Saudi customers, including registration, customer data protection, breach reporting to CST and data location rules tied to data classification.
- Key themes
- Unique features
Higher-classification customer content must remain in the Kingdom; CSPs must notify CST of security incidents.
- SaaS relevance
SaaS offered to Saudi customers may count as a cloud service requiring CST registration and compliance.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- CST (cloud incidents)
- Cross-border transfers
- Classification-based localisation
§3Dates
- Key dates
- Adopted
- In force
- Issued by CITC (now CST); later revisions
§4Text and authority
- Text
- Authoritative text cst.gov.sa
- Authority
- Communications, Space & Technology Commission (CST)
§5Where it applies
- Domestic law of
- Saudi Arabia
§6Sources and verification
- Sources consulted
- Verification
Low confidence.
Partly verified
Low confidence.Current version/date of CCRF not verified (CST pages not readable).