A common pattern in GCC AI products: the application runs in a regional data centre, but the model, the vector database or the analytics pipeline sits somewhere else. In Saudi Arabia, that pattern now has to stand up to the Personal Data Protection Law, which became enforceable on 14 September 202435.
This is an architect's view, not legal advice. Confirm the details with Saudi counsel, and check SDAIA's current publications, since the rules have changed more than once.
The transfer rules in brief
SDAIA issued an amended Regulation on Personal Data Transfer Outside the Kingdom in September 2024, elaborating on the PDPL's transfer article1. In outline, as described by law firm commentary:
- Adequacy and permitted purposes remain the first route, similar to the earlier version1. One firm noted in March 2025 that an adequacy list had not yet been issued4; check whether that has changed.
- Appropriate safeguards apply where adequacy doesn't: standard contractual clauses, binding common rules and certification, with binding codes of conduct removed from the list14.
- Standard contractual clauses come in four versions covering controller and processor combinations, and modifying them invalidates them2.
- Risk assessments are needed when relying on safeguards or certain exemptions, and for continuous or large-scale transfers of sensitive data14. SDAIA published guidelines on conducting them in 20254.
Where AI architectures create transfers
Teams often underestimate how many cross-border flows an AI feature creates. For each one, ask whether personal data leaves the Kingdom:
| Component | Hidden transfer |
|---|---|
| Hosted model API | Every prompt containing customer data |
| Embedding service | Documents sent for vectorisation |
| Vector database | Embeddings and stored text chunks |
| Observability tools | Prompt and response logs, traces |
| Evaluation and labelling | Production samples copied for testing or annotation |
| Support tooling | Vendor staff accessing data from abroad |
The model call is the transfer everyone notices. The logs, embeddings and evaluation sets are the ones that turn up in an audit.
The architecture I use
- Classify first. Tag data as personal, sensitive or non-personal at ingestion, so routing decisions can be automated.
- Keep sensitive processing in-country where possible: in-Kingdom cloud regions or on-premises models for sensitive data, which is where private LLMs earn their cost.
- Route through an AI gateway that redacts or blocks personal data before calls to models outside the Kingdom, and records every call with its legal basis.
- Keep logs local or capture metadata only, following the approach in LLM observability.
- Maintain a transfer register mapping each flow to its route (adequacy, SCCs, other safeguard) and its risk assessment, kept in step with the architecture.
One design for the region
Many companies serve Saudi Arabia, the UAE and the wider Gulf from one platform. The UAE PDPL, DIFC rules and the Saudi PDPL differ in detail, but the engineering controls overlap heavily: classification, in-region processing, gateways, logging and registers. I design one control set and map it to each regime, as I describe in UAE PDPL and AI architecture and DIFC Regulation 10, and pair it with the hosting choices in where to run models in the UAE.
How I can help
I design AI platforms for the GCC with data residency and transfer controls built in, so legal review confirms the design rather than reworks it. See my UAE and GCC practice, or analyse your challenge and bring the result to a call.
- 1
- 2Updates to Saudi Arabia's personal data protection regulations: SCCs, guidelines and moreMayer Brown · 9 Oct 2024
- 3
- 4
- 5