Moving personal data out of Saudi Arabia: a transfer playbook

Article 29 of the PDPL lets you transfer personal data outside the Kingdom for a set of permitted purposes, but only if the transfer does not prejudice national security or the Kingdom's vital interests, there is an adequate level of protection, and the data is limited to the minimum needed. The Transfer Regulation and its instruments fill in how.

Pick a transfer mechanism

• Adequacy: a SDAIA decision that a country or sector offers equivalent protection. As of late 2026 no adequacy list has been published, so treat this route as unavailable for now.
• Standard contractual clauses: SDAIA issues four modules (controller to controller, controller to processor, processor to processor, processor to controller). Use the right module unmodified; you may only fill the blanks and add non-conflicting terms.
• Binding common rules: for transfers within a group, approved as a set.
• Certification: a certificate from a licensed body.

Run the transfer risk assessment

A transfer risk assessment is mandatory before any safeguard-based transfer and before transferring sensitive data continuously or on a large scale. SDAIA's guideline frames it in four phases: preparation, the processing risk, the cross-border assessment, and an analysis of the Kingdom's vital interests. Record it, keep it current, and reference it in your Record of Processing.

Watch the 2026 draft amendments: SDAIA has consulted on making in-Kingdom storage the default and requiring any controller that transfers abroad to register. They are not in force yet, but they would change hosting and registration, so plan for them.

No adequacy list means the work is yours: the right clauses, a real risk assessment, and the evidence to back both.