Do you have to host in Saudi Arabia? PDPL and data transfers
A question I hear a lot: does my site have to be on a server inside Saudi Arabia? The short answer is not always. The Personal Data Protection Law doesn't ban transfers abroad outright, but it sets conditions. Some government-related projects have stricter requirements.
This is general information, not legal advice.
What counts as a transfer abroad?
It isn't only where the server is. If your customers' data passes through a tool with servers in another country, you're probably transferring it. Check:
- Email and customer management systems.
- Analytics and advertising tools.
- Chat and marketing messages.
- Backups.
- AI tools.
Many companies host inside the Kingdom while their data leaves every day through these tools, without anyone noticing.
How does a transfer become lawful?
The regulations provide specific routes, including countries with adequate protection, standard contractual clauses approved in the Kingdom, binding common rules, and certification. European clauses alone generally aren't enough. In some cases you'll need a risk assessment before transferring.
In October 2026 SDAIA opened consultation on proposed amendments to the regulations, so check the official publications before relying on any detail, including the list of countries.
When hosting inside the Kingdom is the better choice
- All your customers are in Saudi Arabia, so the site is faster for them.
- You handle sensitive data, such as health or financial records.
- You work with government or semi-government entities.
- You want less compliance work and simpler answers for clients and auditors.
When hosting abroad can be acceptable
- A brochure site with little or no customer data.
- An audience spread across several countries, with the right safeguards in place.
- A global service with no local alternative, under a clear contract.
Four steps to decide
- List every tool your customers' data passes through, and where its servers are.
- Classify the data: ordinary or sensitive.
- See what you can bring inside at a reasonable cost, starting with what matters most.
- For what stays abroad, put the legal basis in place and keep the documentation.
Moving to Saudi hosting
Moving a site doesn't have to stop your business. The usual steps are a full copy, testing on a temporary link, moving the database at a quiet time, then pointing the domain across, keeping the old copy for a while as a fallback.
Because speed affects your visibility on Google, a server close to your customers helps twice. Then work through the rest of the PDPL checklist.
Want to know where your customers' data travels today? Get in touch.