NCA Cloud Cybersecurity Controls: Data Residency in Saudi Arabia

Picture a cloud provider that has just won a pilot with a Saudi bank. The platform runs in the Kingdom. Then the bank’s security team asks one question: where do your backups, logs and support tickets live?

If the honest answer is “we’d have to check”, the deal slows down. This guide from Wattlecorp’s security team covers how data residency fits within the National Cybersecurity Authority’s (NCA) Cloud Cybersecurity Controls (CCC) in Saudi Arabia, and what to fix before an assessor asks. It also covers where NCA cloud security compliance work usually goes wrong. It’s written for cloud service providers and the Saudi organizations that buy from them.

What Do the NCA Cloud Cybersecurity Controls Say About Where Data Lives?

The CCC is the NCA’s set of cybersecurity requirements for cloud computing, which some teams call the NCA cloud computing controls. They build on the NCA’s Essential Cybersecurity Controls (ECC).

The CCC addresses two audiences. One is the cloud service provider. The other is the tenant, meaning the organization that buys and runs workloads on a cloud. For a provider, hosting location under the NCA cloud cybersecurity controls is something you should expect to evidence. For a tenant, the job is to choose a service that fits the sensitivity of what it stores, and to ask the provider for proof.

Name the edition you’re being assessed against, because requirements can differ between editions. The NCA publishes the current text on its official website.

For a provider, the consequence is access to buyers. Buyers in regulated sectors often ask about hosting location early, and a vague answer can end the conversation before security ever comes up. That’s the bank’s question from the opening, and it’s the one to prepare for.

Residency, Localization and Sovereignty: Three Words, Three Questions

Teams use these words as if they meant one thing. They don’t.

Data residency is where the data is physically stored. A region, a country, a data center. It’s the question to settle first, because a configuration export can show it, and the other two build on it.

Data localization is a stricter rule that says data must stay in a country. Data sovereignty is about which country’s law can compel access to the data, wherever it sits. A provider can get residency right and still face a sovereignty question, for example when the provider has a foreign parent company. So list who can reach production, and under which agreement, as part of your review (step 5 below).

Also read : Saudi PDPL Amendments 2026: What Businesses Must Know

Where Data Residency Actually Breaks

Almost nobody puts the production database in the wrong country. The failures hide in places no one reviewed after the first architecture diagram.

• Backups and disaster recovery. A secondary region chosen for resilience sits outside the Kingdom because it was the default pairing.
• Logs and telemetry. Security and application logs often carry user identifiers, and they ship to a central monitoring service somewhere else.
• Analytics and AI services. A managed service copies data to its own processing region without anyone noticing.
• Support access. Engineers in another country can open a session on a production system. This is an access question rather than a storage one, but a bank’s security team will ask about it in the same breath.

A misconfigured storage bucket exposes data to the internet. A residency failure is quieter. The data is still in your cloud estate, but it sits in a region you didn’t mean to use.

How Data Sensitivity Shapes Where Data May Live

When you map the NCA cloud cybersecurity controls to your data, hosting questions follow sensitivity. Sensitivity is one input. The more sensitive the classification, the narrower the places the data is likely to be allowed to sit, and for the most sensitive tiers you should expect an in-Kingdom answer to be required. Lower tiers aren’t automatically free to go anywhere, so check each one.

Classification in Saudi Arabia draws on the national data governance framework overseen by the Saudi Authority for Data and Artificial Intelligence (SDAIA), alongside the cloud regulatory work of the Communications, Space and Technology Commission (CST).

Classify the data before you pick the region, not after. Otherwise you find out at audit time that several workloads needed a different home. A data mapping and classification exercise records three things for every dataset: what it is, its classification, and every place it lives, backups and logs included.

Also read : Security Architecture Review for Saudi FinTech Platforms: Identity, API and Cloud Controls

PDPL and the CCC Overlap but Don’t Replace Each Other

Saudi Arabia’s Personal Data Protection Law (PDPL) governs personal data, and it puts conditions on sending that data out of the Kingdom. The NCA cloud cybersecurity controls cover how cloud services are secured, and hosting location is a question assessors can be expected to raise. Meeting one doesn’t mean you’ve met the other.

Take a provider that hosts everything in the Kingdom. If a support team abroad exports customer records to a spreadsheet, that can raise a residency question and a PDPL transfer question at the same time. Answering one doesn’t answer the other.

SDAIA publishes the law and its regulations through the national data governance platform. Our breakdown of Saudi Arabia’s PDPL covers who it applies to. Banks also answer to the Saudi Central Bank’s (SAMA) cloud requirements, so check those alongside the NCA’s.

This guide covers cloud service providers and the Saudi organizations that use their services within the controls’ scope. Entities outside that scope, and classified or defense workloads, are out of scope.

A Residency Check to Run Before an Assessor Does

Start with a gap review against the NCA cloud cybersecurity controls. Here’s the order we’d work in.

1. Map every data flow. Production data, backups, replicas, logs, tickets, analytics exports. Auditors ask about the one you forgot, and a diagram of a platform you don’t actually run is the fastest way to fail.
2. Pin regions in configuration. Check that each service that supports regional pinning is locked to an in-Kingdom region and can’t silently fall back to another, and list the global services that can’t be pinned.
3. Check the backup and recovery pairing. Confirm where each recovery copy sits, and test a restore from it.
4. Trace logs and telemetry. Find where security events and application logs end up and what personal data they carry.
5. Review support and subprocessor access. List who can reach production, from where, and under which agreement. That includes any parent company.
6. Keep evidence you can regenerate. Export configurations and region settings on request. Screenshots age badly.

Tenants can run the same list as a request to their provider. Ask for the data-flow map, the region settings and the backup location, and ask what the support access model is.

A cloud configuration review covers the configuration parts of steps two to four. It gives you a record where you’d otherwise have an assumption.

How We Assess This: Wattlecorp’s work on cloud security posture management covers infrastructure-as-a-service (IaaS), platform-as-a-service (PaaS) and software-as-a-service (SaaS) misconfiguration detection and remediation. That carries over to residency work in one way: a region setting that changed is a misconfiguration, and automated checks can flag a changed setting. It doesn’t replace the NCA’s own assessment process.

If you want the wider picture first, our guide to NCA cloud security controls for IaaS, PaaS and SaaS covers the control families.

Show an Assessor Where Your Data Lives Before They Ask

Back to the provider and the bank. The pilot survives if the answer to “where do your backups, logs and support tickets live?” is a data-flow map and a set of region settings, handed over the same day. It stalls if the answer is “we’d have to check”.

Wattlecorp’s NCA compliance work includes cloud, and a data-flow review is a sensible place to start on the NCA cloud cybersecurity controls. Begin with our NCA cloud security compliance service to scope what your assessment will look at.

Nca Cloud Cybersecurity Controls FAQs