Data Residency
PDPL and SAMA data residency requirements.
A free NCA CCC-2:2024 compliance checklist — the provider and tenant control sets, all four classification levels, and the evidence each subdomain needs.
A guide to NCA Cloud Cybersecurity Controls (CCC-2:2024) — the CSP and CST control sets, four classification levels, and the data localisation change.
A free NCA CSCC compliance checklist — the seven criticality criteria, all 21 subdomains, and the review, patching and testing cadences inspectors ask for.
A guide to NCA Critical Systems Cybersecurity Controls (CSCC) — the seven identification criteria, 32 controls, and the in-Kingdom access and hosting rules.
A guide to NCA Data Cybersecurity Controls (DCC-1:2022) — four classification levels, 19 controls across the data lifecycle, and third-party sharing rules.
A guide to the NCA National Policy for MSOC and the licensing framework — the Tier 1 requirement, the 90-day report, and what in-house SOCs must do next.
SDAIA is enforcing PDPL with SAR 5M fines. Saudi banks, government entities and enterprises in Riyadh and Dammam — here is why you should act now.
How to handle PDPL cross-border data transfers from Saudi Arabia — adequacy, safeguards, SaaS vendor flows, and data residency strategies explained.
A practitioner guide to PDPL data subject rights in Saudi Arabia — access, correction, destruction, objection and the 30-day response clock explained.
On-premise GRC software for Saudi Arabia — when sovereignty matters, deployment options, PDPL data residency, NCA CCC and SAMA outsourcing implications.
A step-by-step PDPL Saudi Arabia implementation checklist — lawful basis, DPO, records of processing, data subject rights, breach notification and transfers.