| NCA Essential Cybersecurity ControlsECC-2:2024 · National Cybersecurity Authority (est. 2017) | In forceThe 2024 update is the main baseline for government and critical national infrastructure119. | Applies to government entities, including their subsidiaries inside and outside the Kingdom, and to private firms that own, operate or host CNI22. Companion NCA controls cover data (DCC), critical systems (CSCC), OT (OTCC) and telework22. | Implication: government and CNI buyers ask for ECC control mapping from every supplier.
Response: an ECC gap assessment as the door-opener, then managed SOC, GRC and DR through local partners. |
| NCA Cloud Cybersecurity ControlsCCC-2:2024 · replaces CCC-1:2020 | In forceReleased 202421. The tenant track is mandatory for government bodies and private CNI operators21. | Two tracks: 37 main and 94 sub-controls for cloud providers; 18 main and 26 sub-controls for tenants19. The 2024 version dropped CCC's own localisation sub-controls; residency now follows NDMO and the wider framework, and secret and CNI data still face strict in-country rules21. | Implication: regulated tenants need CCC evidence from their providers.
Response: deliver on CST-registered Saudi partner clouds; XcellHost adds ISO 27017 evidence and the tenant-side managed services. |
| Non-CNI Private Sector Cybersecurity ControlsNCNICC-1:2025 · NCA | Issued · applied as notifiedIntroduced Dec 202519. Controls apply to entities "as notified" by the NCA, and no single deadline is published23. The NCA may assess compliance at any time24. | Category A, more than 250 staff or revenue above SAR 200M: 65 mandatory controls, an independent cyber unit led by Saudi nationals, and an NCA-licensed managed SOC. Category B, 6–249 staff or SAR 3M–200M: 26 mandatory controls, including MFA, email filtering, SPF/DKIM/DMARC, tested backups and incident notice to the NCA2324. | Implication: thousands of private firms gain a cyber baseline for the first time.
Response: fixed-fee NCNICC readiness, then DMARC, MFA and email security. SOC is delivered with an NCA-licensed partner, as XcellHost holds no NCA licence. |
| Licensing of cyber security servicesNCA framework · consultation | ConsultationThe NCA opened a public consultation in Feb 2026 on licensing cyber security services, products and solutions1. Outcome: Not re-verified. | Would set licence conditions for providers. NCNICC already requires large firms to use an NCA-licensed managed SOC24. | Implication: foreign SOC providers may need a local licence or a licensed partner.
Response: serve through licensed partners and track the final framework quarterly. |
| Personal Data Protection Law (PDPL)Royal Decree M/19 of 2021, amended by M/148 of 2023 · SDAIA | In force · enforceableIn force 14 Sep 202325; enforceable from 14 Sep 202426. | Breaches reported to SDAIA through the National Data Governance Platform within 72 hours. Fines up to SAR 5M, doubled for repeat offences; disclosing sensitive data to cause harm can bring 2 years' jail and a SAR 3M fine. DPOs are required for large-scale public, monitoring and sensitive-data processing25. Many controllers must register on the platform26. | Implication: every customer audits XcellHost as a processor.
Response: PDPL readiness with privacy operations, a Saudi processor agreement and Saudi hosting by default. |
| PDPL Transfer Regulation + SCCsRegulation on Personal Data Transfer outside the Kingdom | In forceAmended version issued 1 Sep 202427. | Transfers rely on adequacy or appropriate safeguards: four sets of standard contractual clauses (which must not be modified), binding common rules or accreditation certificates. A risk assessment is needed in some cases27. Remote access by an overseas affiliate can count as a transfer even when data stays in Saudi Arabia19. Banking transfers may need SAMA approval25. | Implication: Mumbai support access to Saudi data is itself a transfer.
Response: SCCs in every contract, a documented transfer risk assessment, and access logged with PAM. |
| Draft amendments to the PDPL Implementing RegulationSDAIA public consultation | DraftPublished 6 Oct 2026; responses due 5 Nov 2026. If approved, in force 60 days after publication in the Gazette28. | A draft Article 23(2) would require controllers to store personal data in the Kingdom, while still allowing transfers. The wording is ambiguous. Breach notice would also cover "damage" to data; DPIA triggers widen to AI and automated decisions; controllers that transfer data abroad would register with SDAIA28. | Implication: a storage-in-Kingdom rule may become general.
Response: design for Saudi primary storage now; re-check the final text when it is gazetted. |
| CST Cloud Computing Services Provisioning Regulations4th version · Communications, Space & Technology Commission | In forceIn force 10 Oct 2023. CST launched a Cloud Market Maturity Index on 3 Sep 202619. Earlier, CCRF v3 from 3 Dec 202020. | Cloud providers register in tiers: Qualifying, then Classes A (public data), B (confidential) and C (secret and top secret). The Qualifying tier cannot serve government. Government data may not leave the Kingdom unless another law permits it, and subscribers must consent before content moves abroad19. | Implication: XcellHost is not a CST-registered provider.
Response: resell and manage on registered partner clouds, at the class the customer's data needs. |
| Electronic Transactions LawRoyal Decree M/8 of 2007 · amended Oct 2023 · Implementing Regulation 2024 | In forceAmended by Cabinet Decision 293/1445 (24 Oct 2023); Implementing Regulation issued 13 Mar 202432. | Digital certificates come from the National Information Centre or a provider licensed by the Digital Government Authority. Only certificate-based signatures are binding today. Civil-status and most real-estate deeds are excluded32. The DGA licenses trust service providers for signatures, seals and time stamps33. | Implication: XcellHost is not a DGA-licensed trust provider.
Response: partner with a licensed provider for legal signatures. Lead with managed PKI, Cloud HSM, CLM and private CA. |
| SDAIA AI governance instrumentsAI Ethics Principles · Generative AI guidelines · Deepfakes guidelines · AI Adoption Framework | GuidanceNo AI-specific law and no announced process to create one, as of 17 Feb 202634. | Non-binding principles and guidelines for public, private and non-profit bodies, including transparency and watermarking for deepfakes. The PDPL applies to AI training, inference and deployment34. | Response: vCAIO advisory and ISO/IEC 42001 as a neutral AI-governance baseline. |
| Draft Global AI Hub LawCST · "data embassies" | DraftPublished 14 Apr 2025; consultation closed 14 May 202535. Still a draft at 17 Feb 202634. Later status: Not re-verified. | Three hub types: private hubs for foreign governments, extended hubs with a Saudi operator, and virtual hubs where Saudi-incorporated providers host data under the client's home law35. | Implication: could let foreign customers host in Saudi DCs under their own law.
Response: watch; relevant to GPU and AI hosting with partners. |
| SAMA Cyber Security FrameworkSaudi Central Bank · v1.0 | In forcePublished May 2017. Cyber Resilience Fundamental Requirements for new licensees from Jan 202231. | Banks, insurers, finance companies, credit bureaus and market infrastructure must operate at maturity level 3 or higher. Material outsourcing and cloud adoption need prior SAMA approval; contracts need audit rights and incident notice31. | Implication: long approval cycles; every bank deal goes through outsourcing review.
Response: supply the BFSI Cloud evidence pack, audit rights and an exit plan; start with non-material workloads. |
| Health dataPDPL extra requirements · MoH, Saudi Health Council, CHI rules | In force · guidance pendingThe PDPL adds requirements for health data. SDAIA has yet to issue further guidance29. | Strict need-to-know access, data minimisation and mapping of data flows. The health ministry and councils may set their own rules29. Providers remain controllers when they outsource to cloud or AI vendors; DPIAs are almost always triggered30. | Implication: hospitals need Saudi-localised processing agreements and DPIAs.
Response: Healthcare Cloud on Saudi partner DCs only, with remote L2/L3 under access controls. |
| E-invoicing (FATOORA) Phase 2ZATCA integration waves | Rolling wavesWave 24: turnover above SAR 375,000, 1 Apr–30 Jun 2026. Wave 25: above SAR 187,500, from 1 Feb 2027, announced 24 Jul 202636. | Taxpayers integrate their invoicing systems with ZATCA's platform in waves set by past revenue. Wave 25 is the first to count 2025 revenue36. | Implication: ERP and finance-system projects reach small firms.
Response: host ERPs such as SAP Business One and integrate with the customer's e-invoicing solution. |
| Entity, tax & workforceMISA licence · RHQ rule · CIT · VAT · WHT · Nitaqat | CurrentRHQ rule on government contracts from 1 Jan 202440. Nitaqat procedural guide updated 202641. | CIT 20% on foreign shares; zakat 2.5% on Saudi and GCC shares; VAT 15%37. WHT 5% on technical services, 15% on royalties including software and SaaS, 20% on management fees38. Without an RHQ, government bids must be 25% below the lowest bid, except below SAR 1M40. Saudisation targets now follow a formula by activity and headcount41. | Response: see pricing & tax. Get Saudi tax advice for each contract structure, especially SaaS. |