The rules are moving: on 6 October 2026, Saudi Arabia's data authority SDAIA proposed requiring personal data to be stored in the Kingdom. This guide covers the rules by type of data, a worked example, the cloud regions available, and ten questions for any cloud ERP vendor.
Which data must stay in the UAE?
The UAE's federal data protection law has no general localisation rule: personal data can be transferred abroad to approved countries or under safeguards such as contracts or consent. Localisation comes from sector rules.
| Type of data | Must it stay in the UAE? | Rule |
|---|---|---|
| General personal data | No, if a transfer ground applies | Federal Decree-Law No. 45 of 2021 (PDPL), Articles 22 and 23 |
| Health data | Yes, except in cases a ministerial decision allows | Federal Law No. 2 of 2019 on ICT in health fields, Article 13 |
| Banks' core operating data | Yes; customer data needs Central Bank approval to leave | Central Bank Outsourcing Regulation, 2021 |
| Payment and stored-value data | Yes | Central Bank payment and stored-value regulations |
| Confidential or restricted government data (the policy also covers critical-infrastructure companies) | Yes, with encryption keys managed in the UAE | National Cloud Security Policy, version 2.0 |
| E-invoices | No, since 1 October 2026 | Ministerial Decision No. 197 of 2026 |
| Other tax records | No express location rule; the FTA must get access on request | Tax Procedures Executive Regulation; FTA Decision No. 4 of 2026 |
Companies in the DIFC and ADGM follow their own data protection laws, which also allow transfers on adequacy or safeguards. The PDPL's executive regulations had still not been issued at the time of writing, so details of the transfer rules may change.
Which data must stay in Saudi Arabia?
For most private companies, the rule that matters is ZATCA's: VAT records must be kept inside the Kingdom, and where they sit on a server, the server must be in the Kingdom too. Personal data can currently leave the Kingdom under the PDPL's transfer rules, but that may change.
| Type of data | Must it stay in Saudi Arabia? | Rule |
|---|---|---|
| VAT records and invoices | Yes, including the server holding them | ZATCA Guideline for Tax Invoicing and Records, version 3 (May 2026), section 8.3.1 |
| Income tax books | Yes | Income Tax Implementing Regulations, as amended in 2021 |
| Personal data | Not at present, if transfer conditions are met; a draft rule would require storage in the Kingdom | PDPL and its Transfer Regulation; SDAIA draft of 6 October 2026 |
| Government data | Yes | Regulations on the Use of ICT in Government Entities; CST cloud regulations |
ZATCA's guideline has one exception: a permanent establishment may use a central system abroad if it can access the records from a workstation in Saudi Arabia. Records are also expected in Arabic.
In practice, Saudi accounting data should be hosted in a Saudi region, unless the vendor can show the exception applies to you.
What has changed since 2024?
The UAE has loosened localisation for tax data while tightening it for government cloud use. Saudi Arabia has moved localisation from its cybersecurity rules to its data rules, and is now consulting on a broader requirement.
| When | Country | Change |
|---|---|---|
| 6 October 2026 | Saudi Arabia | SDAIA's draft amendment to the PDPL Implementing Regulation would require controllers to store personal data in the Kingdom; comments close 5 November 2026 |
| 1 October 2026 | UAE | Ministerial Decision No. 197 of 2026 removes the requirement to store e-invoice data in the UAE |
| 30 July 2026 | UAE | FTA Decision No. 4 of 2026: a third party may keep tax records, but the FTA must get access on request, including encryption keys |
| 2026 | UAE | National Cloud Security Policy version 2.0 requires confidential and restricted government data to stay in the UAE; the policy also covers critical-infrastructure companies |
| 2024 | Saudi Arabia | NCA's updated cloud and essential cybersecurity controls drop their in-Kingdom hosting rules and refer entities to SDAIA's data management office |
| 14 September 2024 | Saudi Arabia | PDPL fully enforceable; transfer rules updated with standard contract clauses |
It is not yet clear whether the Saudi draft would require all personal data to be held in the Kingdom or only a local copy.
How does this work for a company in both countries? A worked example
A Dubai-based medical supplies distributor runs one ERP for its UAE head office and its VAT-registered Riyadh branch. It also sells to two UAE clinics that share patient data for deliveries. Here is where each kind of data can live.
| Data | Where it can be hosted | Why |
|---|---|---|
| UAE accounting records and e-invoices | Any region, with FTA access on request | No UAE location rule for these records since 1 October 2026 |
| Saudi branch VAT records and invoices | Saudi region | ZATCA requires VAT records and their server in the Kingdom |
| Saudi employee and customer personal data | Any region today, under PDPL transfer safeguards; possibly Saudi only if the draft is adopted | PDPL Transfer Regulation and SDAIA's October 2026 draft |
| Patient details shared by UAE clinics | UAE region | The UAE health data law restricts storing health information abroad; take advice on whether it covers you |
| Product and price lists | Any region | No localisation rule |
The simplest compliant design is two hosting regions: a UAE region for the head office and anything touching health data, and a Saudi region for the Riyadh branch's accounting data. A single non-Saudi region would leave the branch's VAT records outside the rule, unless the permanent-establishment exception applies and is documented.
Which cloud regions are available in the UAE and Saudi Arabia?
Microsoft, AWS and Oracle have UAE regions, but Saudi coverage is thinner: AWS and Microsoft are only arriving in late 2026. Ask which region your ERP vendor actually uses, not which regions its cloud provider offers.
| Provider | UAE | Saudi Arabia |
|---|---|---|
| Microsoft Azure | Dubai and Abu Dhabi regions, since June 2019 | Saudi Arabia East, open for workloads from Q4 2026 |
| Amazon Web Services | Middle East (UAE), since August 2022 | Region planned for December 2026 |
| Google Cloud | None; nearest is Doha, since May 2023 | Dammam, since November 2023, sold in the Kingdom through CNTXT |
| Oracle Cloud | Dubai (October 2020) and Abu Dhabi (November 2021) | Jeddah (February 2020) and Riyadh (August 2024) |
Backups, disaster-recovery copies and support access can sit elsewhere even when the main database is in-country, so ask about all three.
What should you ask a cloud ERP vendor about data residency?
Ask where every copy of your data lives and who can reach it, in writing. A vendor that answers only "our cloud is in the region" has answered one question of ten.
- Which cloud provider and region hosts the main database? Ask for the region name, not the country.
- Where are backups and disaster-recovery copies kept? They are copies of your records and count just as much.
- Can UAE and Saudi entities be hosted in different regions? This matters for ZATCA's VAT record rule.
- Where can support staff access the data from? Remote access from abroad can be a transfer of personal data.
- Who holds the encryption keys, and where? The FTA can now ask for access including keys.
- Which subcontractors process the data? Ask for the list and their locations.
- What transfer safeguards do you use for personal data? Look for standard contract clauses under the PDPL rules.
- Can you export all records in a readable format? You must keep UAE tax records for at least seven years (15 for real estate) and Saudi VAT records for six years in general, 11 for capital assets and 15 for real estate, even after you change system.
- What certifications cover the hosting and the application? ISO/IEC 27001 is the common baseline.
- What will you do if Saudi Arabia adopts the October 2026 draft? Ask whether a Saudi region can be added without migration.
Where do data residency reviews usually go wrong?
In the security reviews HYP ERP goes through with buyers, the main database location is rarely the problem. The gaps are in the copies and access around it.
| What we see | Why it matters | Ask for |
|---|---|---|
| Backups replicated to another country by default | The backup is a full copy of your records | Backup and recovery locations in the contract |
| One region chosen for a two-country group | Saudi VAT records end up outside the Kingdom | Separate hosting for each country where needed |
| Support access from offshore teams | Remote access can count as a transfer of personal data | The support locations and the safeguards in place |
| Encryption keys held only by the vendor | You may not be able to give the FTA access on request | Your own key access, or a documented process |
| Data export never tested | Records may be unreadable after you leave | A test export of one full year before signing |
HYP is ISO/IEC 27001 certified, and these are the questions we expect buyers to put to us as well as to any other vendor.
Sources
- Federal Decree-Law No. 45 of 2021 on Personal Data Protection (UAE)
- DLA Piper: data protection laws of the UAE
- Al Tamimi: new data sovereignty rules for cloud in the UAE, 15 October 2026
- Ministry of Finance: amendments to the e-invoicing regulations, 19 October 2026
- Grant Thornton: FTA issues three key decisions, 21 August 2026
- ZATCA: Guideline for Tax Invoicing and Records under VAT Provisions, version 3
- Reed Smith: SDAIA consults on amendments to the PDPL Implementing Regulation, 16 October 2026
- Mayer Brown: updates to Saudi data protection regulations, 9 October 2024
- NCA: Cloud Cybersecurity Controls, CCC-2:2024
- Microsoft: Saudi Arabia datacenter region, 10 February 2026
- Amazon: AWS cloud region in Saudi Arabia, 31 August 2026
- Oracle: public cloud regions