If your app or website collects personal data from people in Saudi Arabia, the Personal Data Protection Law (PDPL) applies to you, wherever your servers are. The law took effect on 14 September 2023, and the regulator, the Saudi Data and Artificial Intelligence Authority (SDAIA), has been able to enforce it since the one-year grace period ended on 14 September 2024. The PDPL does not require all personal data to be hosted inside the Kingdom, but transfers abroad must meet its conditions, and some sectors have stricter rules of their own.
This guide explains what the law means for hosting choices and what to build into an app from the start. It is practical guidance, not legal advice; for your specific case, ask a lawyer who works on Saudi data protection.
Does the PDPL apply to my app?
In general, yes, if you process personal data of people in Saudi Arabia. Personal data is anything that identifies a person directly or indirectly: name, phone number, email, ID number, address, location, photos, and account or order history linked to someone. Online stores, booking apps, CRMs and WhatsApp assistants all handle it.
Must the data be hosted in Saudi Arabia?
Not always. The original law nearly banned transfers abroad, but the 2023 amendments and the Transfer Regulation, revised in September 2024, allow transfers outside the Kingdom under set mechanisms, such as:
- a country SDAIA recognises as having adequate protection;
- standard contractual clauses in SDAIA's form;
- binding common rules within a group of companies;
- specific exceptions in the regulation.
Two caveats matter more than the general rule:
- Sector rules. Government entities and regulated sectors, such as financial services and health, often have their own data residency and cloud requirements. These can require hosting in the Kingdom regardless of the PDPL.
- Contracts. Large clients increasingly ask for data in Saudi Arabia as a contract term, even when the law allows otherwise.
Several major cloud providers now operate or have announced data centre regions in Saudi Arabia, so hosting in the Kingdom is easier than it was. Check each provider's current regions and services before deciding, since not every service is available in every region.
What should an app build in from the start?
| Requirement | What it means in the app |
|---|---|
| Clear privacy notice | A privacy policy that says what you collect, why, how long you keep it and who you share it with |
| Legal basis and consent | Ask for consent where needed, and record when and for what it was given |
| Collect only what you need | Do not ask for ID numbers, birth dates or location unless the service needs them |
| Data subject rights | Let users see, correct and request deletion of their data, and answer within the legal time limits |
| Security | Encryption in transit and at rest, access control, logs of who viewed or changed data |
| Retention | Delete or anonymise data you no longer need, on a schedule |
| Breach response | A written plan; the regulations require notifying SDAIA of certain breaches within 72 hours of becoming aware |
| Third parties | Contracts with processors such as hosting, email, SMS, analytics and AI providers that cover data protection |
What about analytics, AI and other services?
Most apps send data to many services: analytics, crash reporting, email and SMS, payment gateways, chat tools and AI models. Each one is a recipient of personal data, and many store it outside the Kingdom. List every service, what data it receives and where it stores it. Then remove what you do not need, mask what you can (for example, do not send full phone numbers to analytics), and check that the transfer is covered.
How do you choose hosting in practice?
- Check your sector first. If you are a government entity, or in finance, health or another regulated sector, your regulator's rules decide.
- Check client contracts. Some will require hosting in the Kingdom.
- Map your data. Separate personal data from everything else; static files and public content rarely raise the same questions.
- Pick the region that satisfies the strictest of the above, then choose the provider and services available there.
- Document the decision, including any transfer mechanism you rely on.
What we do
We build and host apps and systems with data protection designed in: hosting in the region your sector and clients require, encryption, access control, retention and deletion features, and a privacy notice that matches what the app actually does. Contact us to discuss your project.