Keeping data in the UAE or Saudi Arabia: what the rules say
Before you move systems to the cloud, you need to know where the data may live. Here is what the two countries’ data protection laws say about sending personal data abroad, where the rules are stricter, and how to decide.
The short answer
For ordinary personal data, neither country has a blanket rule that it must stay in the country. Both laws allow transfers abroad under conditions: to countries with adequate protection, or with safeguards such as standard contract clauses.
Sector rules are stricter. Government, banking, health and critical infrastructure data often has to stay in the country. If you are in one of those sectors, or serve one, plan for a local cloud region and confirm with your regulator or lawyer.
Saudi Arabia
- The Personal Data Protection Law (PDPL) has been fully enforceable since 14 September 2024, overseen by the Saudi Data and AI Authority (SDAIA)
- The Regulation on Personal Data Transfer outside the Kingdom allows transfers that do not harm national security or vital interests, limited to the minimum data needed
- Transfers to countries without an adequacy decision can rely on safeguards such as standard contractual clauses, binding common rules or certification
- Sector regulators can require in-Kingdom hosting for regulated data, for example in banking and government work
United Arab Emirates
- Federal Decree-Law No. 45 of 2021 on personal data protection has applied since 2 January 2022
- It allows transfers to countries with adequate protection, or with appropriate safeguards
- Free zones with their own data protection laws, such as DIFC and ADGM, follow those laws instead
- Government data, and health and banking data covered by their own sector laws, are outside its scope and often have stricter rules
How to decide where your data lives
- List the personal data each system holds, and whether any of it is sensitive (health, financial, ID numbers)
- Check your sector’s rules and your contracts: some clients require local hosting even when the law does not
- If local hosting is needed, choose a cloud region in the country and check that every service you use is available there
- Write down where data is stored, who can reach it and how it is backed up
Sources
DLA Piper, “Saudi Arabia’s new Personal Data Protection Law in force”, 2024; PwC, PDPL Part 3; Securiti, Regulation on Personal Data Transfer outside the Kingdom; US International Trade Administration, Saudi Arabia ICT cross-border data rules; Middle East Briefing and Clym on UAE Federal Decree-Law No. 45 of 2021. Checked on 14 October 2026. This is general information, not legal advice.
Move to the cloud with the data where it must be
keyt plans cloud moves with a written map of where each system’s data lives, and hosts in UAE or Saudi regions when the data must stay local.