Location
Cloud DevOps Consulting in Saudi Arabia
Saudi Arabia is undergoing significant technology investment under Vision 2030, with Riyadh and NEOM driving demand for cloud engineering expertise. The Kingdom has enacted its own data protection and cybersecurity frameworks that require specific technical controls for companies operating there.
We can help Saudi Arabia-based companies and international organisations with Saudi operations build cloud infrastructure that supports local regulatory requirements on AWS and Azure.
Cloud regions for Saudi Arabia
AWS does not yet have a generally available region in Saudi Arabia. It has announced one and said it is planned for December 2026, so check AWS's current announcements for the date. Until then, the nearest option is me-central-1 (UAE), subject to your residency requirements. For workloads that must stay in the Kingdom today, we can design with in-Kingdom hosting or co-location alongside cloud services.
Microsoft has announced a Saudi Arabia East region (Eastern Province), so check Microsoft's current announcements for its availability. Until it is available to your subscription, nearby Azure regions include Qatar Central and UAE North.
Google Cloud has a Dammam region (me-central2) with restricted access and special purchasing rules, so we confirm eligibility with you before designing for it.
Regional availability in this market changes quickly. We confirm current status with each provider before you commit to a design.
Saudi Data Protection Law (PDPL)
Saudi Arabia's Personal Data Protection Law (PDPL, Royal Decree M/19 of 2021, as amended by Royal Decree M/148 of 2023) came into force on 14 September 2023 and has been fully enforceable since 14 September 2024. It covers lawful bases for processing (consent or other grounds), data minimisation, data subject rights and restrictions on transfers outside the Kingdom. Technical controls we can implement to support it:
- Data residency controls: restrict sensitive personal data to approved regions/countries via SCPs
- Encryption at rest and in transit for personal data stores
- Audit logging and access control for personal data access
- Data subject rights workflows (access, correction, deletion)
Saudi PDPL legal guidance requires a Saudi-qualified legal practitioner. We implement the technical controls specified by your legal team, and we do not certify compliance.
NCA cybersecurity controls (ECC and CCC)
The National Cybersecurity Authority (NCA) publishes the Essential Cybersecurity Controls (ECC-2:2024), which apply to government entities and to owners and operators of critical national infrastructure, and the Cloud Cybersecurity Controls (CCC-2:2024), which apply to cloud service providers and to cloud service tenants. Whether and how they apply to you is a question for your compliance team. Technical controls we can implement to support them include:
- Identity and access management with MFA enforced for privileged access
- Vulnerability management: regular scanning (Trivy, Inspector, Defender for Cloud) and agreed patching timelines
- Security monitoring: centralised SIEM, GuardDuty or Microsoft Sentinel
- Incident response procedures with defined RTO/RPO targets
- Change management: IaC (Terraform) for all infrastructure changes with approval workflow
Time-zone coverage
Saudi Arabia operates in AST (Arabia Standard Time, UTC+3). Working hours and response arrangements are agreed per engagement. Managed DevOps cover can be business hours, extended or 24/7 depending on the plan, and is confirmed in the written scope.
Billing and invoicing
Billing currency, VAT treatment and invoicing details are confirmed in the written scope. Ask your finance or tax adviser what your entity requires.
How does remote delivery work for a Saudi team?
Delivery is remote and everything is built inside your own cloud accounts and repositories. At the start we agree a fixed scope in writing and name the senior engineer who is accountable for it. Your team keeps the code, the access and the documentation throughout.
Saudi Arabia uses Arabia Standard Time, UTC+3, with no daylight saving. The working week is generally Sunday to Thursday, with Friday and Saturday as the weekend, which differs from teams in Europe and North America. We agree a regular working window and the communication channels at kickoff, and we plan calls around the Saudi week rather than assuming a Monday to Friday pattern.
Public holidays and Ramadan hours shift each year, so we check dates before scheduling production changes. Risky changes are not scheduled on the day before a holiday.
- Time zone: UTC+3, no daylight saving
- Working week: generally Sunday to Thursday
- Production changes planned around holidays and Ramadan hours
- All work delivered into your accounts and repositories
Which cloud regions can Saudi workloads use?
The picture is changing quickly. Microsoft has confirmed a Saudi Arabia East region in the Eastern Province for customers from Q4 2026, and AWS has said its Saudi region is on track for December 2026. Neither should be assumed available to you until the provider confirms it for your account. Google Cloud has a Dammam region, me-central2, with restricted access and special purchasing rules.
In the meantime, nearby regions include AWS me-central-1 in the UAE and Azure UAE North and Qatar Central. Whether a nearby region is acceptable depends entirely on your regulator and your data classification. If your data must stay in the Kingdom, a nearby region will not satisfy that requirement and you should wait for an in-Kingdom option or use in-Kingdom hosting.
Because availability moves, we check each provider's current status before you commit, and we design so that a later move into a Saudi region is a planned migration rather than a rewrite. Infrastructure as code and region-neutral design make that practical.
| Provider | Saudi option | Status to confirm |
|---|---|---|
| AWS | Saudi Arabia region, three availability zones | Planned for December 2026. Not yet generally available. |
| Azure | Saudi Arabia East, Eastern Province | Confirmed for customers from Q4 2026. Confirm access for your subscription. |
| Google Cloud | Dammam, me-central2 | Restricted access. Confirm eligibility with Google. |
What data protection rules apply in Saudi Arabia?
The Personal Data Protection Law, issued by Royal Decree M/19 of 2021 and amended by Royal Decree M/148 of 2023, is the core statute. It came into force on 14 September 2023 and has been fully enforceable since 14 September 2024. It covers lawful bases for processing, data minimisation, the rights of individuals and restrictions on transferring data outside the Kingdom.
The transfer rules matter most for cloud architecture. Hosting or backing up personal data in another country can count as a transfer, so region choice, replication targets and support access all need review. Your legal adviser decides what is permitted, and we apply that decision in the platform, for example with policies that block resources outside approved regions.
Saudi legal guidance should come from a Saudi-qualified practitioner. We implement the technical controls they specify and we do not certify compliance.
How do the NCA cybersecurity controls fit in?
The National Cybersecurity Authority publishes the Essential Cybersecurity Controls, ECC-2:2024, and the Cloud Cybersecurity Controls, CCC-2:2024. ECC applies to government entities and to owners and operators of critical national infrastructure. CCC applies to cloud service providers and to cloud service tenants. Whether either applies to you is a question for your compliance team.
Some sectors have their own frameworks as well. For example, the Saudi Central Bank publishes a cybersecurity framework for the financial sector, and a bank would need to consider it alongside the NCA controls. Scope and applicability should be confirmed with the relevant regulator.
Where controls apply, the engineering work is concrete: identity and access management with multi-factor authentication for privileged access, centralised logging, vulnerability scanning, infrastructure changes through reviewed code and defined recovery objectives. We build these to support your control mapping, but the mapping and any assessment remain with your compliance function.
What should we expect on procurement and contracting?
Expect a written statement of work with scope, deliverables and a named senior engineer. Government related and regulated buyers often run a formal vendor onboarding process, which can include security questionnaires and review of how a supplier accesses production systems. We answer these from how we actually work: least privilege, work in your accounts and reviewed changes.
Saudi VAT is 15%, and invoicing requirements are set by the Zakat, Tax and Customs Authority. Your finance team should confirm what applies to your entity. Currency, payment schedule and acceptance criteria are written into the contract rather than assumed.
Contracts involving personal data should state where data may be stored, who acts as controller and processor, and how access is removed at the end of the engagement.
- Written scope and acceptance criteria
- Access and offboarding arrangements stated up front
- Data location and processor roles recorded for personal data
- VAT and invoicing details confirmed by your finance team
How does an engagement run from start to finish?
We begin with a working session on your current estate, constraints and target outcome. We then write the scope, including exclusions, so everyone knows what done means. Work proceeds as small, reviewed changes in your repositories, which keeps each change visible and reversible.
Handover includes runbooks and documentation in your repositories so your team can operate the result. Any ongoing support is a separate decision with its own written scope.
Frequently asked questions
Is there a Saudi region on AWS or Azure today?
Can we use a UAE or Qatar region for Saudi data?
Do the NCA controls apply to our company?
Can you prepare us for a later move into a Saudi region?
Do you provide legal advice or compliance certification?
Cloud DevOps for Saudi Arabia
We work with Saudi PDPL, the NCA ECC and CCC controls, and a changing regional cloud landscape. Book a working session to discuss your infrastructure requirements.