The rule in one paragraph
The Personal Data Protection Law (PDPL) allows personal data to be transferred or disclosed outside the Kingdom for specified purposes and under conditions. The Regulation on Personal Data Transfer outside the Kingdom, amended by the Saudi Data and Artificial Intelligence Authority (SDAIA) on 1 September 2024, sets out how. Every transfer needs a purpose, a mechanism and a record.
If your organization uses a cloud region abroad, a SaaS tool hosted outside the Kingdom, an overseas identity verification vendor or a parent company that receives reports, you are transferring personal data.
Conditions that apply to every transfer
- The transfer must not prejudice the Kingdom's national security or vital interests.
- It must serve a purpose the law permits, such as performing an obligation to which the data subject is a party.
- It must be limited to the minimum personal data needed for the purpose, unless you rely on one of the appropriate safeguards below, which removes this limit.
The mechanisms
Adequacy
Transfers can go to countries and organizations that SDAIA assesses as providing an adequate level of personal data protection. Where adequacy applies, it is the simplest route.
Appropriate safeguards
Where adequacy does not apply, the regulation recognizes three appropriate safeguards:
- Standard contractual clauses (SCCs). SDAIA published four versions: controller to processor, controller to controller, processor to controller, and processor to processor. Modifying the clauses makes them invalid, and the rest of the contract must not contradict them.
- Binding common rules. Rules adopted within a multinational group of companies for transfers between group entities.
- A certificate of accreditation issued for the receiving party.
Exceptions
The regulation also allows a limited set of transfers without adequacy or safeguards. Treat them as narrow exceptions, not a routine basis, and document why each one applies.
When a transfer risk assessment is required
You must carry out a risk assessment when you:
- transfer personal data on the basis of an appropriate safeguard; or
- transfer sensitive data outside the Kingdom on a continuous or widespread basis.
Under the PDPL, sensitive data includes credit, health, biometric, genetic and location data, among others. A fintech sending credit data to an overseas scoring service, or biometric selfies to an identity verification vendor abroad, needs the assessment.
A useful assessment covers the purpose and legal basis, the categories of data and data subjects, the destination and its legal environment, the safeguards in place, the likely impact on data subjects, and the measures that reduce it.
Sector rules sit on top
The PDPL is the floor, not the ceiling.
- Financial institutions supervised by the Saudi Central Bank (SAMA) also follow SAMA's outsourcing and cloud requirements, including approval where the rules require it, before data moves to an outsourced or cloud provider.
- Government data follows the national data management and classification rules issued through SDAIA's National Data Management Office.
- NCA's Essential Cybersecurity Controls no longer state a hosting requirement directly since ECC-2:2024, which makes these data rules the place to look. See what changed in ECC-2:2024.
Check the sector rule first. A transfer the PDPL permits can still need your regulator's approval.
A decision flow you can document
- Map the flow. What data, about whom, to which party, in which country, for what purpose.
- Classify the data. Is any of it sensitive? Apply your data classification rules.
- Check sector rules. SAMA, the National Data Management Office or any other regulator that applies.
- Minimize. Send only what the purpose needs, or anonymize or pseudonymize before transfer.
- Choose the mechanism. Adequacy, then appropriate safeguards, then a documented exception.
- Sign the right SCC version unchanged, or confirm binding common rules or accreditation.
- Run the risk assessment where the regulation requires it.
- Record it. Update the record of processing activities and your privacy notice.
- Review on change. A new vendor, region, data category or purpose restarts the flow.
Common situations
| Situation | Typical route |
|---|---|
| CRM or support tool hosted abroad, vendor acts as your processor | Controller-to-processor SCCs and a risk assessment; for SAMA-regulated firms, check outsourcing requirements first |
| Reporting customer data to a parent company abroad | Binding common rules within the group, or controller-to-controller SCCs |
| Identity verification vendor processing biometric data abroad | Controller-to-processor SCCs and a risk assessment, because biometric data is sensitive |
| Production workloads in a cloud region outside the Kingdom | For SAMA-regulated firms, outsourcing and cloud approval first; an in-Kingdom region removes the transfer |
| Overseas processor using its own sub-processor | Processor-to-processor SCCs, with your prior approval of the sub-processor |
Where organizations slip
- No inventory of transfers, so nobody knows which SaaS tools hold personal data abroad.
- SCCs edited to fit a vendor's paper, which invalidates them.
- Sensitive data sent abroad continuously with no risk assessment on file.
- Relying on an exception for a routine, ongoing transfer.
- Privacy notices that do not mention transfers outside the Kingdom.
Limaz maps data flows, classifies data and puts the transfer mechanisms, contracts and assessments in place. See our PDPL compliance service, and our guide to the PDPL Implementing Regulations.