IT outsourcing in Saudi Arabia now sits inside a defined regulatory framework. The Personal Data Protection Law has been fully enforceable since 14 September 2024, the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC-2:2024) set specific contract terms for managed service providers, and the Communications, Space and Technology Commission's cloud regulations govern where data may be stored. A Saudi company can still use an external IT partner, including a remote one, provided the contract, data location and access arrangements are built around these rules.
Key takeaways
- •The PDPL is fully enforceable. It came into force on 14 September 2023 with a one-year grace period that ended on 14 September 2024. Fines can reach SAR 5 million and may be doubled for repeat offences.
- •Breaches have a clock. Controllers must notify SDAIA within 72 hours of becoming aware of a personal data breach.
- •ECC-2:2024 has specific outsourcing rules. Contracts with IT or cybersecurity managed service providers must include a prior risk assessment, and managed security operations centres that use remote access must be fully located in Saudi Arabia.
- •Cloud data location is regulated. Under the CST's cloud regulations (version 4, in force since 10 October 2023), a registered cloud provider must notify customers and obtain consent before moving their content outside the Kingdom.
- •Saudisation is calculated on your own workforce. The 2026 Nitaqat procedural guide replaced fixed percentages with a formula based on workforce size, sector and band.
Why Saudi companies outsource IT
The Kingdom's digital economy has grown quickly. Saudi Arabia's Ministry of Communications and Information Technology (MCIT) reported that the digital economy contributed nearly 16 per cent of GDP in 2025 and estimated the ICT market at about $53 billion (SAR 199 billion) that year. As more of a company's operations depend on cloud services, e-invoicing, e-commerce and government portals, the cost of downtime and of a data incident rises with it.
For many mid-sized firms, the options are to build an internal IT team, to outsource IT operations to a managed service provider, or to combine the two. Outsourcing tends to appeal when:
- •The company needs skills (security monitoring, cloud architecture, compliance evidence) that it cannot keep fully occupied in-house.
- •It needs extended or round-the-clock coverage.
- •It wants predictable recurring costs instead of building a team from scratch.
The rest of this guide covers the rules any of those arrangements must satisfy.
The Saudi PDPL and SDAIA
Timeline and regulator
The Personal Data Protection Law is supervised by the Saudi Data and Artificial Intelligence Authority (SDAIA). According to CMS:
| Milestone | Date |
|---|---|
| PDPL formally in force | 14 September 2023 |
| End of one-year grace period; full enforcement | 14 September 2024 |
| Maximum fine | Up to SAR 5 million, which may be doubled for repeat offences |
| Breach notification to SDAIA | Within 72 hours of becoming aware of the breach |
SDAIA also issued a Regulation on Personal Data Transfer outside the Kingdom and a set of standard contractual clauses for transfers. CMS noted at the one-year mark that the list of countries recognised for transfers had not yet been confirmed.
What it means when you use an IT partner
If your IT provider can access personal data in your systems, it is usually acting as a processor on your behalf. Chambers' Cloud Computing 2026 guide for Saudi Arabia points to Article 17 of the PDPL Implementing Regulations, which requires controllers to verify a processor's ability to comply and to assess its compliance periodically, including the use of sub-processors.
Chambers also notes a point that is easy to miss: data hosted in Saudi Arabia can still involve a cross-border transfer if overseas affiliates or sub-processors can access it. A remote IT partner's access model therefore matters as much as where the servers are.
In practical terms, a contract with an IT partner should cover:
- •The processing the partner may carry out, and nothing more.
- •Security measures and access controls, with logging.
- •Immediate notification to you of any breach, so you can meet the 72-hour window.
- •The location of staff and systems that can access your data.
- •Sub-processors, and your right to approve them.
- •Return and secure deletion of data when the contract ends.
NCA Essential Cybersecurity Controls (ECC-2:2024)
Scope
The National Cybersecurity Authority published the second edition of its Essential Cybersecurity Controls in 2024. It contains 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols.
The controls apply to government agencies in Saudi Arabia, their affiliated companies and entities (inside and outside the Kingdom), and private sector organisations that own, operate or host Critical National Infrastructure. The NCA "strongly encourages all other entities in the Kingdom" to use them as best practice. Many private companies meet them anyway because their government or CNI customers require it in contracts.
The third-party controls
Domain 4-1 of the ECC deals with third-party cybersecurity, explicitly including IT outsourcing, cybersecurity outsourcing and managed services. The key requirements are:
| Control | Requirement (summarised from ECC-2:2024) |
|---|---|
| 4-1-1 | Cybersecurity requirements for third-party contracts must be identified, documented and approved |
| 4-1-2 | Contracts that could affect the entity's data or services must include non-disclosure and secure data removal at the end of service, incident communication procedures, and an obligation to apply the entity's cybersecurity requirements |
| 4-1-3 | Contracts with IT or cybersecurity outsourcing and managed service providers must include a cybersecurity risk assessment before signing; managed security operations centres that use remote access must be fully located in Saudi Arabia |
| 4-1-4 | Third-party cybersecurity requirements must be reviewed periodically |
Control 4-1-3 is particularly relevant for anyone considering a remote partner. Helpdesk, device management and infrastructure work can be delivered remotely, but if your organisation falls within ECC scope, a managed SOC that monitors you over remote access has to be fully based in the Kingdom.
The 2024 edition also removed an earlier sub-control requiring hosting inside Saudi Arabia, noting that data localisation requirements have moved to the National Data Management Office at SDAIA. Data location rules still apply; they now sit in a different set of documents.
Data residency and cloud: the CST framework
The Communications, Space and Technology Commission (CST, formerly CITC) regulates cloud service provision. Chambers summarises the position as of 2026:
| Element | Position |
|---|---|
| Current regulations | Cloud Computing Services Provisioning Regulations, version 4, in force since 10 October 2023 |
| Customer content outside the Kingdom | Registered providers must notify customers in advance and obtain consent before storing, processing or transferring content outside Saudi Arabia (Article 3-3-7) |
| Government agency data | May not be transferred outside the Kingdom in any form, including backups, unless another law expressly permits it (Article 3-3-5) |
| Provider registration | Tiered: a Qualifying Category and Classes A, B and C, linked to the sensitivity of data served |
| NCA Cloud Cybersecurity Controls (CCC-2:2024) | Separate control sets for providers (37 main controls) and tenants (18 main controls); in-scope organisations must meet both CCC and ECC |
For most private companies, the practical question is which data must stay in the Kingdom, which may leave with consent or safeguards, and how backups and support access are configured. A cloud and DevOps review can map this before migration.
Saudisation (Nitaqat) and how a remote partner fits
Nitaqat is the system the Ministry of Human Resources and Social Development (MHRSD) uses to measure each employer's Saudisation. According to Clyde & Co's June 2026 summary of the Developed Nitaqat Programme Procedural Guide 2026:
- •The bands are Platinum, High Green, Medium Green and Low Green, with Red below them.
- •Fixed percentages have been replaced by a formula based on workforce size, sector and band, so targets rise gradually as headcount grows.
- •Saudisation is assessed at entity level across branches carrying out the same activity.
- •Low Green carries restrictions on services such as new visas and profession changes; Red is fully restrictive.
- •The thresholds are set for 2026 to 2028.
Al Tamimi & Company published a 2026 to 2027 Saudisation overview in September 2026 that sets out the wider picture for the coming period.
How a partner fits depends on the model:
| Model | Effect on your Nitaqat calculation | Points to check |
|---|---|---|
| Hiring IT staff directly | They count in your headcount and Saudisation ratio | Any profession-specific targets that apply to the roles |
| Local managed service provider | Its staff are employed by the provider, which has its own Nitaqat obligations | Provider's own band and licensing |
| Remote partner outside the Kingdom | No local headcount added | ECC 4-1-3 (in-Kingdom SOC where applicable), PDPL transfer rules |
| Hybrid: Saudi IT lead plus remote partner | One Saudi role in-house, specialist work outsourced | Clear division of responsibilities |
The hybrid model is common: a Saudi national leads IT internally, owns the vendor relationships and compliance evidence, and an external partner handles monitoring, patching, cloud operations and out-of-hours support. Rules on how outsourced arrangements interact with Nitaqat can change, so confirm the treatment for your activity with MHRSD or an employment adviser.
Vision 2030 and the digital agenda
Vision 2030 sets the direction for this regulatory build-out. Published indicators include:
- •Technology sector growth. Arab News reported in December 2024 the goal of raising the technology sector's contribution to GDP from 1 per cent to 5 per cent by the end of the decade.
- •Digital government. In the UN E-Government Survey 2024, Saudi Arabia rose 25 places overall and reached fourth place globally on the Online Service Index, a 67-place improvement on that index.
- •Digital economy. MCIT reported that the digital economy contributed nearly 16 per cent of GDP in 2025.
The direction is clear: more services move online, more data is regulated, and customers increasingly expect suppliers to show evidence of security and data protection. Companies that sell to government entities or CNI operators will find ECC and PDPL clauses in their contracts.
A checklist for choosing an IT outsourcing partner in Saudi Arabia
- •Classify your data and confirm which of it must stay in the Kingdom.
- •Decide whether ECC applies to you directly or through customer contracts.
- •Ask where the partner's people and tools are located, especially any security operations centre with remote access.
- •Require a processing agreement that meets the PDPL Implementing Regulations, including breach notice and sub-processor approval.
- •Check cloud provider registration with the CST and the regions used for data and backups.
- •Agree response times and reporting, including evidence you can show auditors and customers.
- •Plan your Saudisation position alongside the outsourcing decision, not after it.
- •Review exit terms: documentation, credentials and data return.
More detail on local considerations is on our Saudi Arabia and Riyadh pages, and the cybersecurity and managed IT services pages describe how the operational side is usually organised.
Sources
- •CMS – One year anniversary: Saudi Personal Data Protection Law
- •National Cybersecurity Authority – Essential Cybersecurity Controls (ECC-2:2024)
- •Chambers and Partners – Cloud Computing 2026: Saudi Arabia, Trends and Developments
- •Clyde & Co – Saudi Arabia's Developed Nitaqat Programme: key updates from May 2026 (25 June 2026)
- •Al Tamimi & Company – Saudi Arabia's 2026–2027 Saudisation overview (22 September 2026)
- •Asharq Al-Awsat – Saudi Arabia marks its National Day with a digital economy nearing one-sixth of GDP (23 September 2026)
- •Arab News – Saudi Arabia to boost ICT sector (3 December 2024)
- •Arab News – Saudi Arabia ranks top in region, fourth globally on UN digital government services index (17 September 2024)
For a broader view of how managed IT is structured, see our managed IT services overview.