saudi-arabia-grc

Applicability depends on organization type and sector. NCA ECC-2:2024 is mandatory for government entities and CNI operators, Saudi PDPL applies to anyone processing Saudi residents' personal data, SAMA CSF binds licensed financial institutions, and the CST framework governs cloud providers. These regimes stack rather than displace each other.

Saudi PDPL transfers require a lawful mechanism: SDAIA-assessed adequacy, SDAIA Standard Contractual Clauses in four modules (C2C, C2P, P2C, P2P), Binding Common Rules, or limited derogations. Controllers must also register on SDAIA's National Data Governance Platform and report breaches within 72 hours.

SAMA expects regulated entities (banks, insurers, financing companies, credit bureaus, fintechs) to operate at maturity level 3 minimum on its six-level scale, meaning structured and formalized processes. Entities conduct periodic self-assessments subject to SAMA reviews.

Yes, residency is classification-driven. Government data must remain in-Kingdom with narrow exceptions, and customer data classified Levels 3-4 under the CST Cloud Computing Regulatory Framework requires in-Kingdom hosting. CSPs must register with CST in a class matching the data levels they host.

Yes, ECC domains map naturally to ISO 27001:2022 Annex A, NIST CSF 2.0, and SOC 2 TSC, letting multinationals reuse existing evidence. Saudi-specific deltas remain: in-Kingdom residency, Arabic-language governance artifacts, NCA reporting channels, and SDAIA registration.

Fines reach SAR 5,000,000 per violation and may double for repeat violations, with criminal exposure up to 2 years' imprisonment for unlawful disclosure of sensitive data. SDAIA's violation committees issued roughly 48 decisions in the first enforcement wave of 2025-26.