Saudi Arabia: Issued Cloud Computing Services Provisioning Regulations including data localisation requirements

On 10 October 2023, the Communication, Space, and Technology Commission (CST) issued the fourth version of the Cloud Computing Services Provisioning Regulations (CCSPR) as a continuation of the previously issued Cloud Cybersecurity Controls (CCC). The CCSPR aims to enhance the reliability of cloud computing services. In particular, cloud computing service providers registered with the CST and cloud computing subscribers are prohibited from transferring data from Saudi government agencies outside the Kingdom in any form. However, exceptions may be made if a law or regulation specifically states otherwise.