PDPL Cross-Border Data Transfers: Rules for Sending Saudi Personal Data Abroad The transfer rules, explained by Sumrite.

Transfers are where Saudi data protection meets cloud architecture. If you run a SaaS product from Europe or the US, use a group data centre abroad, or let offshore teams support Saudi customers, this guide is for you. For the full framework, start with our Saudi PDPL compliance guide.

When can Saudi personal data be transferred outside the Kingdom?

Saudi personal data can be transferred outside the Kingdom under PDPL Article 29 when the transfer serves a permitted purpose, does not prejudice national security or the Kingdom’s vital interests, and sends only the minimum data needed, with adequacy or appropriate safeguards in place. The Personal Data Protection Law sets the purposes and conditions, and SDAIA’s Transfer Regulation adds the mechanics.

The permitted purposes, combining Article 29 and Article 2 of the Transfer Regulation, are:

The national security and minimisation conditions do not apply in cases of extreme necessity to preserve the data subject’s life or vital interests, as PwC’s PDPL series notes. That is a narrow emergency route, not a business basis.

Which documents govern PDPL cross-border data transfers?

PDPL cross-border data transfers are governed by Article 29 of the PDPL, SDAIA’s Regulation on Personal Data Transfer outside the Kingdom, SDAIA’s Standard Contractual Clauses and SDAIA’s Risk Assessment Guideline for transfers. Each answers a different question.

Document	Issued	What it does
Personal Data Protection Law, Article 29	Royal Decree M/19, amended by M/148; in force 14 September 2023	Sets purposes and conditions for any transfer
Regulation on Personal Data Transfer outside the Kingdom	Version 2.0, August 2024; announced by the Saudi Press Agency on 1 September 2024	Adequacy, safeguards, exemptions, onward transfers, risk assessment
Standard Contractual Clauses	Version 1.0, September 2024	Fixed contract templates in four modules
Risk Assessment Guideline for Transferring Personal Data Outside the Kingdom	February 2025	Non-binding method for the risk assessment

The Saudi Press Agency described the August 2024 update as covering how adequacy is evaluated, additional transfer purposes, exemptions from the adequacy and minimum-transfer conditions, onward transfers, ending an exemption and assessing risk before a transfer.

What transfer mechanisms does SDAIA’s Transfer Regulation allow?

SDAIA’s Transfer Regulation allows transfers to countries SDAIA lists as adequate, or, where the controller relies on an exemption, transfers protected by Standard Contractual Clauses, binding common rules or a certificate of accreditation. In practice, most transfers in 2026 rely on SCCs or binding common rules.

Adequacy

Article 3 requires SDAIA to publish a list of countries and international organisations with adequate protection, reviewed every four years or as needed. The criteria include enforceable data subject rights, a supervisory body willing to cooperate with the Saudi authority, and onward-transfer rules. Clyde & Co reported in March 2025 and HFW in January 2026 that the list had not yet been issued. Check SDAIA’s site before relying on adequacy.

Safeguards and exemption cases

Article 4 exempts controllers from the adequacy and minimum-transfer conditions in five cases, each with its own safeguard:

Exemption case (Transfer Regulation Article 4(2))	Safeguard required
Public bodies implementing an agreement or serving the Kingdom’s interests	Data protection provisions in the agreement or memorandum
Non-recurring or limited transfers	SCCs, or an approval certificate held by the recipient; no sensitive data
Multinational groups, for central operations	Binding common rules or SCCs, or an approval certificate held by the recipient
Services that directly benefit the data subject	Approval certificate held by the recipient; no sensitive data
Scientific research	SCCs or an approval certificate; minimum data; no sensitive data

How the Saudi SCCs work

SDAIA’s SCCs come in four modules: controller to controller, controller to processor, processor to processor and processor to controller. HFW’s analysis notes that the parties may only fill in the blanks, that substantive changes are treated as a violation, that the importer submits to Saudi law and courts, and that the SCCs cannot be used where the importer’s home laws would prevent compliance. Keep commercial terms in a separate document. EU SCCs do not substitute for them; our Saudi PDPL vs GDPR comparison explains why.

When is a PDPL transfer risk assessment required?

A PDPL transfer risk assessment is required under Article 7 of the Transfer Regulation whenever a transfer relies on an Article 4 exemption, and whenever sensitive data is transferred outside the Kingdom on a continuous or widespread basis. The assessment must be completed before the transfer.

Purpose and legal basis

Why the data leaves the Kingdom and which Article 29 purpose applies

Nature of the transfer

Processing activities and geographic scope

Safeguards

SCCs, binding common rules or certificate, and whether they give adequate protection

Minimisation

How only the minimum data needed is sent

Potential harms

Material or moral harm to data subjects and how likely it is

Controls

Measures that prevent risks or reduce their impact

SDAIA’s February 2025 guideline organises the work in four phases, according to Clyde & Co: preparation (decide whether an assessment is needed and map the data journey), risk identification and mitigation, transfer and compliance evaluation (including the recipient’s PDPL compliance and security), and national interest considerations. The guideline is not legally binding, but it shows what SDAIA expects to see. Note that a transfer risk assessment is separate from the impact assessment the PDPL requires for high-risk processing.

The security part of the assessment is where evidence matters. A cloud security assessment of the receiving environment and API security testing of the interfaces that carry the data give the assessment facts rather than vendor assurances.

What happens to onward transfers, and when must a transfer stop?

Personal data sent abroad stays subject to the PDPL when it is transferred onward, under Article 5 of the Transfer Regulation, and a controller must halt a transfer and notify recipients when its exemption no longer applies under Article 6. Both rules reach your vendors’ vendors.

An exemption falls away if the controller has not implemented the required safeguards or if SDAIA finds the safeguards inadequate for a specific case. In either event the controller must stop the transfer or disclosure and notify the entities that received the data.

Does Saudi Arabia require data localisation under the PDPL?

As of November 2026, the Saudi PDPL does not impose a general data localisation rule, although it does not override localisation requirements in other laws, and SDAIA’s October 2026 draft amendments propose an express in-Kingdom storage duty. Treat the draft as a proposal until approved text appears in the Official Gazette.

The point about other laws comes from the OneTrust DataGuidance and Clyde & Co comparison; check your sector regulator’s hosting rules separately.

On 6 October 2026 SDAIA published draft amendments to the PDPL Implementing Regulation for comment until 5 November 2026, as reported by the Saudi Press Agency. According to Reed Smith and Clyde & Co, draft Article 23 would require controllers to store personal data inside the Kingdom while still allowing transfers and disclosures abroad under the PDPL and its regulations. Reed Smith reads two possible meanings: a local copy of all data processed abroad, or local storage by default with lawful transfers allowed to replace it.

The same draft would make registration on the SDAIA National Register of Controllers mandatory for any controller that transfers or discloses personal data outside the Kingdom. Our analysis of the October 2026 draft amendments covers both proposals. Until approved text is published, the current rules apply.

How should a foreign SaaS provider set up compliant PDPL transfers?

A foreign SaaS provider should map every flow of Saudi personal data, pick a PDPL purpose and mechanism for each, sign SDAIA’s SCCs or adopt binding common rules, complete risk assessments where required, and prove the security of the receiving environment. The steps below follow that order.

Buyers will ask for this evidence in procurement; our guide to selling SaaS into Saudi Arabia shows how it fits a vendor security questionnaire, and our PDPL compliance checklist tracks the remaining duties.

How Sumrite helps

Sumrite maps Saudi personal data flows, prepares transfer registers and risk assessments, and tests the environments and APIs that receive the data, so your transfer file rests on evidence. We deliver end to end with our verified NCA-registered partner firm and have served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Our Saudi PDPL compliance page describes the engagement, and our Saudi Arabia page explains how we deliver a Sumrite VAPT report for Saudi reviews in 48 hours.