Compliance guide · Saudi Arabia

Saudi cyber rules, made clear.

Saudi Arabia’s National Cybersecurity Authority sets the Essential Cybersecurity Controls for government and critical infrastructure, SDAIA enforces the Personal Data Protection Law, and SAMA sets the bar for banks and insurers. Here is what each asks, what is changing, and how to prepare.

Plan your Saudi readiness See the 108 controls
ECC-2:2024 and PDPL mappedOctober 2026 draft changes coveredServed remotely from Bengaluru
In plain words

If you serve Saudi government bodies or critical national infrastructure, the NCA’s Essential Cybersecurity Controls (ECC-2:2024) apply: 108 main controls in four domains. If you handle personal data of people in Saudi Arabia, the Personal Data Protection Law has been fully enforceable since 14 September 2024, with breach notices to SDAIA within 72 hours. Banks and insurers also follow SAMA’s Cyber Security Framework. We serve Saudi clients remotely from Bengaluru, where your rules allow a provider based outside the Kingdom.

Checked against official sources on . General information, not legal advice.

ECC version
ECC-2:2024, 108 controls
PDPL enforceable
Since 14 September 2024
Breach notice
72 hours to SDAIA
We serve from
Bengaluru, mostly remote
ECC-2:2024 at a glance

108 controls, four domains.

One square per main control. Most of the work sits in governance and day-to-day defence.

The 108 main controls of Saudi Arabia’s Essential Cybersecurity Controls, ECC-2:2024, in four domains: 35 in cybersecurity governance across 10 subdomains, 61 in cybersecurity defence across 15 subdomains, 4 in cybersecurity resilience in 1 subdomain, and 8 in third-party and cloud computing cybersecurity across 2 subdomains. 1 · GOVERNANCE35CONTROLS10 subdomains2 · DEFENCE61CONTROLS15 subdomains3 · RESILIENCE4CONTROLS1 subdomain4 · THIRD PARTY AND CLOUD8CONTROLS2 subdomains
ECC-2:2024 from the National Cybersecurity Authority: 108 main controls and 92 subcontrols in 28 subdomains. Defence, which covers everyday security such as identity, email, networks and vulnerability management, is the biggest share.
What changed in ECC-2

Five changes from the 2018 version.

  • Fewer, clearer controls

    114 controls became 108, with overlaps removed and pointers to NCA’s specialist control sets.

  • Wider reach

    Government entities now expressly include those set up outside the Kingdom, alongside private owners and operators of critical infrastructure.

  • Saudi professionals

    All cybersecurity positions inside the organisation must be held by full-time, qualified Saudi professionals, not just senior roles.

  • Hosting rules moved

    Explicit in-country hosting controls were removed from ECC. Data localisation now sits with the National Data Management Office at SDAIA.

  • Four domains, not five

    The separate domain for industrial control systems is gone from ECC. NCA covers operational technology in its own control set.

The rulebooks

Three rulebooks to know.

  • NCA Essential Cybersecurity ControlsECC-2:2024: 108 main controls in governance, defence, resilience, and third-party and cloud security. For government bodies, their affiliates and critical infrastructure operators.
  • Personal Data Protection LawEnforced by SDAIA and fully enforceable since 14 September 2024. Breach notices to SDAIA within 72 hours where harm is likely, and rules for transfers abroad.
  • SAMA Cyber Security FrameworkFor banks, insurers and finance companies supervised by the Saudi Central Bank.
Key dates

The data law is tightening.

SEP 2023PDPL takes effectSEP 2024Grace period endsOCT 2026Draft changes published TODAY · NOV 2026
  1. SEP 2023PDPL takes effect
  2. SEP 2024Grace period ends
  3. OCT 2026Draft changes published

SDAIA consulted on the draft amendments from 6 October to 5 November 2026. If adopted, they come into force 60 days after publication in the Official Gazette.

What may change next

The October 2026 draft, in brief.

Data kept in the Kingdom. Controllers would have to store personal data inside Saudi Arabia. Transfers abroad would still be possible under the law’s transfer rules.

Breach notices without exceptions. Notice to SDAIA within 72 hours would apply to every breach, not only those likely to cause harm. Telling the people affected would still depend on the risk of harm.

Impact assessments for AI. New triggers would include emerging technologies, automated decisions, large-scale monitoring and processing data of minors, which covers most AI products.

More registration. Registering in the National Register of Controllers would become mandatory for more organisations, including those that transfer data abroad. We will update this guide when the final text is published.

Questions

Saudi questions, answered.

Q01Does ECC apply to private companies?
Directly, to private organisations that own, operate or host critical national infrastructure. Indirectly, to many more: ECC’s third-party domain means government bodies and operators pass cybersecurity requirements on to their suppliers through contracts. Other organisations are encouraged to follow it.
Q02ECC-2 says cyber roles must be held by Saudis. Can a foreign firm still help?
Yes. ECC-2 requires the organisation’s own cybersecurity positions to be held by full-time, qualified Saudi professionals. Outside specialists can still provide testing, assessments and advice. We support your Saudi team; we do not replace it.
Q03Does the Saudi PDPL apply to companies outside Saudi Arabia?
Yes. It applies to processing of personal data about people in the Kingdom, including by organisations based abroad.
Q04What are the PDPL penalties?
Fines of up to SAR 5 million per violation, which can be doubled for repeat violations. Disclosing or publishing sensitive data with intent to harm can bring up to two years in prison and a fine of up to SAR 3 million.
Q05Do we have to keep data inside Saudi Arabia?
Today the PDPL has no general data localisation rule, although government and sector rules may require it. The October 2026 draft amendments would require controllers to store personal data in the Kingdom, so plan for it.
Q06Do you have an office in Saudi Arabia?
No. We serve Saudi clients remotely from Bengaluru, two and a half hours ahead of Riyadh. Where rules require Saudi nationals in specific roles, we work alongside them. See how we work with Saudi companies.
Q07Do cybersecurity providers need NCA registration?
Yes. Since 1 August 2022, any entity that provides cybersecurity services, solutions or products in the Kingdom must register with the NCA, and managed SOC services need an NCA licence: Tier 1 to serve government entities, Tier 2 for others. Owners and operators of critical national infrastructure must run their SOC work through a Tier 1 licensed provider. HanulSec is not NCA-registered, so where a project needs a registered provider, we support that provider or your own team.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings