PDPL no longer imposes blanket localisation, and it does not allow unrestricted transfer either, which leaves most organisations designing against one of two wrong readings of the law. The useful question is which categories of your data may leave the Kingdom and on what basis. That is a classification exercise, and it has to happen before a platform is chosen rather than after.
That reframing matters because the two halves have different owners. Whether a transfer is lawful in principle is a legal question, answered once, by counsel. Which of your datasets sit on which side of that answer is an engineering and data governance question, answered continuously, by the people who know what the systems actually hold. Projects stall when the legal opinion arrives and nobody has done the second half.
Accuracy note. This is the area of the law that has changed most. PDPL was issued by Royal Decree M/19 in 2021 and amended in 2023, with implementing regulations and a separate regulation on transfers outside the Kingdom following. Transfer conditions, adequacy assessments and sector rules continue to develop. Verify the current position with SDAIA's published texts and qualified counsel before designing around it. This is not legal advice.
What Changed, and Why It Matters
The original 2021 law was strict. Transfer outside the Kingdom was permitted only in narrow circumstances, which was widely read as a localisation requirement in practice, and it shaped a generation of architecture decisions accordingly.
The 2023 amendments changed the posture. Transfer is now permitted for specified purposes, subject to conditions including that it does not prejudice national security, that the destination affords an adequate level of protection, and that only the minimum necessary data is transferred.
The practical consequence is that architectures designed against the 2021 reading may be more restrictive than the law now requires, and architectures designed on the assumption that the amendments made transfer free are not restrictive enough. Both errors are common.
The Regulator and the Obligations
Oversight sits with SDAIA, the Saudi Data and Artificial Intelligence Authority. Beyond transfers, the obligations that shape infrastructure are:
Lawful basis and consent. Processing needs a basis, and consent where relied upon must be genuine and withdrawable, which has consequences for how you store and act on consent records.
Data subject rights. Access, correction and destruction, among others. A system that cannot locate and delete one individual's data cannot service these, and retrofitting that capability into a data lake is a substantial project.
Records of processing. You need to know what you hold, where, why, and for how long. This is the document that makes every other obligation answerable, and it is the one most often missing.
Breach notification. Notification to the regulator within a short window, so the detection and escalation path has to work before you need it.
Impact assessments. Required for higher-risk processing, which includes many cross-border arrangements.
Retention limits. Data kept only as long as necessary, which means deletion has to be implemented rather than intended.
Deciding What Can Leave the Kingdom
This is a data classification exercise, and it precedes any platform decision. Sort your processing into categories and the answer for each becomes tractable:
| Category | Typical posture |
|---|---|
| No personal data at all | Outside PDPL's scope. Static assets, anonymised aggregates, build artefacts |
| Ordinary personal data | Transferable for permitted purposes, subject to conditions and safeguards |
| Sensitive personal data | Higher scrutiny. Treat offshore placement as requiring specific justification |
| Sector-regulated data | Check the sector rule first. Financial and health regulators impose their own requirements independent of PDPL |
| Government or critical infrastructure data | Assume in-Kingdom unless you have specific written authority |
The row that catches organisations is the fourth. PDPL is not the only instrument in play: a financial institution answers to its own supervisor's outsourcing and cloud expectations as well, and a healthcare provider to health-sector rules. Satisfying PDPL does not discharge those, and the sector rule is frequently the stricter constraint.
A Workable Architecture Pattern
The design that survives this cleanly separates data by classification rather than treating the whole system as one jurisdictional unit.
Keep the identified personal data that carries a residency obligation in the Kingdom. Keep everything else where it makes engineering sense. In between, use pseudonymisation and aggregation deliberately: statistics, model training on de-identified data, telemetry and application logs stripped of identifiers frequently fall outside the restrictive categories, and separating them at the point of collection is far easier than untangling them later.
Two things to get right in that design. Reference data and joins, because a de-identified dataset that can be re-identified by joining another table you also hold is not de-identified. And backups, because a backup of an in-Kingdom database written to storage abroad is a transfer, and it is the most commonly overlooked one.
The Questions to Ask a Provider
In this order, because the first answer often ends the conversation:
Where exactly is the data stored, and where is it processed? These can differ, and a management plane in another country processes data even when storage is local.
Where do backups and replicas live? The most frequent unnoticed transfer.
Where is support delivered from, and what can support see? An engineer abroad with production access is a transfer path.
Where is the company incorporated, and to whose legal process is it subject? Separate from where the servers are, and increasingly asked in Gulf procurement.
What contractual safeguards are available? Data processing terms, subprocessor disclosure and notification of change.
What can be evidenced rather than asserted? Certifications and audit reports, because that is what discharges your due diligence obligation.
Where MassiveGRID Can Place It
Being precise about this is more useful to you than a compliance claim.
MassiveGRID deploys into partner facilities operated by Equinix, Digital Realty, Sparkle and NTT, a published footprint of more than 700 datacenters across 85 metros, 30 countries and six continents, and infrastructure can be ordered in any of them. So the answer to whether a deployment can sit where you need it is usually yes, with one qualification that matters for the Kingdom specifically.
Saudi Arabia is not among the metros currently listed on the datacenter page; the nearest published Gulf presence is Dubai, with Muscat in Oman also listed. Partner footprints change, so confirm current availability directly rather than relying on this article. Where in-Kingdom placement is required and not available as a standard deployment, colocation or a private cloud in a facility you or a partner arrange is the mechanism, with the platform, management and control environment layered on top.
Independent of location, the control environment is what the security-side obligations require: ISO 27001 certification, SOC 2 Type II audit coverage, ISO 27701 privacy management alignment, encryption at rest and in transit, access control with multi-factor authentication, audit logging, and resilience through Proxmox high-availability clustering over Ceph triple-replicated storage. That travels with the deployment wherever it sits, which is the point of a partner model.
The practical shape for a Saudi organisation is usually a split rather than a single location: in-Kingdom or nearest-region placement for the classified personal data, a convenient region for everything that may lawfully sit outside, and one control environment with one evidence set across both. Frankfurt is worth noting as a destination in that split, because it sits under GDPR, which is a recognised reference point when a destination's level of protection is being assessed.
See the PDPL infrastructure alignment, or read the wider picture in data residency across the GCC. The security frameworks that sit alongside PDPL are covered in NCA Essential Cybersecurity Controls and SAMA CSF.