Must Your Data Stay in Saudi Arabia or the UAE? The Rules and the New Cloud Regions

The short answer: no law in either country forces every system to stay inside its borders, but a defined set of workloads must. In Saudi Arabia, a bank or insurer supervised by SAMA needs the regulator’s explicit approval before a cloud service outside the Kingdom holds its data, and anyone holding government data must use a provider registered with the CST. In the UAE, banks must keep their master system of record in the country, payment firms must store personal and payment data there, health data may not leave without a regulator’s decision, and federal bodies and critical infrastructure operators follow a cloud security policy with sovereignty tiers. Personal data in general is governed by transfer conditions, not by a ban. What changes in late 2026 is supply: Microsoft opens its Saudi Arabia East region in November and AWS follows in December, so the argument that there was no hyperscale option inside the Kingdom is ending.

What Was Announced, and When

Neither launch is the first in-Kingdom option, as the table further down shows, but they are the two clouds most companies already run on, and the ones whose absence kept Saudi workloads in Bahrain, the UAE or Europe.

Saudi Arabia: Which Workloads Must Stay in the Kingdom

• Banks, insurers and other SAMA-supervised institutions. SAMA’s Cyber Security Framework (control 3.4.3) states that in principle only cloud services located in Saudi Arabia should be used, that SAMA’s approval is needed before a cloud service is used or a contract signed, and that a cloud service outside the Kingdom requires SAMA’s explicit approval. Private cloud is outside the control. An in-Kingdom region settles the location question; the approval, contract and exit requirements remain.
• Government data, wherever it is held. The CST’s Cloud Computing Services Provisioning Regulations, in force since 10 October 2023, require any subscriber whose data is classified as Saudi government agency data to use a provider registered with the CST. A contractor processing a ministry’s records is caught as much as the ministry is.
• Critical national infrastructure. The Essential Cybersecurity Controls 2024 (ECC-2) removed the explicit requirement that regulated entities host and store data inside the Kingdom, and the localisation controls moved to the National Data Management Office under SDAIA. The law firms that analysed the change advise consulting the NDMO before moving anything: a change of regulator, not a relaxation.
• Personal data. The Personal Data Protection Law has applied since 14 September 2023 and been enforceable since 14 September 2024. Its Transfer Regulation of August 2024 lets personal data leave for a permitted purpose when the destination offers adequate protection or, failing that, under standard contractual clauses, binding common rules or a certification, after a risk assessment. As of November 2025 SDAIA had not published its list of adequate countries. A transfer regime, not a localisation rule, but the paperwork is real.

The UAE: Which Workloads Must Stay in the Country

• Banks. The Central Bank’s Outsourcing Regulation (Circular 14 of 2021) requires a bank’s master system of record, which holds all its confidential data, to be continuously maintained and stored within the UAE. Confidential customer data may not be shared outside the UAE without the Central Bank’s approval and the customer’s prior written consent. A foreign bank’s branch may instead, with the Central Bank’s approval, keep a copy in the UAE updated at least daily.
• Payment service providers and card schemes. The Retail Payment Services and Card Schemes Regulation, published in the Official Gazette on 15 June 2021, requires personal and payment data to be stored and maintained in the UAE.
• Health data. Federal Law No. 2 of 2019 bars health data from being stored, processed, generated or transferred outside the UAE unless a health authority or the Ministry permits it by resolution. Ministerial Resolution No. 51 of 2021 introduced limited exceptions, while Abu Dhabi’s Department of Health prohibits its licensees from exporting health data at all. The law reaches the sector’s IT and cloud suppliers, and a breach carries a fine of AED 500,000 to 700,000.
• Federal government and critical information infrastructure. Version 2.0 of the National Cloud Security Policy, issued by the Cyber Security Council in September 2025 and approved by the Cabinet, applies to ministries, federal authorities and non-government operators of critical information infrastructure. It sets three tiers of security and sovereignty requirements matched to data classification, grants exceptions only case by case, and requires providers to maintain operational sovereignty, including on-site support for sovereign cloud environments.
• Personal data in general. Federal Decree-Law No. 45 of 2021, in force since 2 January 2022, has no general localisation rule: transfers abroad rest on adequacy or on safeguards such as contractual clauses. Its executive regulations, which carry the procedures and penalties, had still not been issued as of March 2026. The law excludes health and banking data, which the sector rules above govern, and the DIFC and ADGM run their own regimes, so a move between the mainland and a financial free zone counts as a cross-border transfer.

Where a Workload Can Run Today

A region inside the border is necessary for the regulated workloads above, but not sufficient. The UAE banking rule covers every copy of confidential data, SAMA wants its approval before the contract, and the CST rule turns on whether the provider is registered. Backups, log archives, monitoring tools, support staff connecting from abroad and SaaS products holding a copy of your records belong in the same assessment.

A Plan That Works Workload by Workload

1. Classify the data in each system. Banking, payment, health, government and critical infrastructure data on one list; personal data on a second; everything else on a third. The first list is where the location rules bite.
2. Attach the rule and the regulator step. For each system on the first list, note whether the rule demands an approval (SAMA), a registered provider (CST), in-country storage of all copies (the Central Bank, health and payment rules) or a sovereignty tier (the UAE cloud policy). Approvals take weeks, so they go on the plan first.
3. Trace the copies. Backups, replicas, exports to analytics tools, log and ticket data held by vendors, who can reach production from where, and who holds the encryption keys.
4. Choose the region and the timing. For Saudi workloads on Azure or AWS, the choice is between a region that is live today and the new ones in November and December. Systems with a hard residency rule move first; the rest follow when it suits the business.
5. Write down where everything lives. Region, zone, backup and key location for every workload, kept current: the auditor’s first question is where the data is, the second how you know.

What to Do This Quarter

The weeks before November and December are the planning window: the inventory, the regulator conversations and the landing zone can be ready before the regions open, so the move is a cutover rather than a project. UAE finance teams face a crowded calendar in the same period; our article on UAE e-invoicing covers the 30 October 2026 provider deadline. Start with the data classification: it decides every other choice.