Saudi Arabia. Data localisation / cross-border. Regulation
KSA Transfer RegulationRegulation on Personal Data Transfer outside the Kingdom
In force
§1Summary
- Synopsis
Sets when personal data may leave Saudi Arabia: to jurisdictions assessed as adequate, under appropriate safeguards, or for listed purposes, provided national security and vital interests are not prejudiced.
- Key themes
- Unique features
Saudi SCCs (C2P, C2C, P2C, P2P) must be used unmodified; using a safeguard relieves the data-minimisation-for-transfer limit but triggers a risk assessment, as do continuous or large-scale sensitive-data transfers. SDAIA can suspend transfers to particular places.
- SaaS relevance
Offshore-hosted SaaS must adopt the Saudi SCCs or another safeguard and complete transfer risk assessments.
§2Obligations
- Extraterritorial
- Yes
- Cross-border transfers
- Adequacy list / Saudi SCCs / binding common rules / accreditation; risk assessment; SDAIA may suspend
- Maximum penalty
- As PDPL
§3Dates
- Key dates
- Adopted
- In force
- Amended version issued by SDAIA 1 Sept 2024 together with Standard Contractual Clauses (4 modules)
§4Text and authority
- Text
- Authoritative text sdaia.gov.sa
- Authority
- SDAIA
§5Where it applies
- Domestic law of
- Saudi Arabia
§6Sources and verification
- Verification
High confidence.