Data center rules in Saudi Arabia

Registers data centre service providers under its Data Centre Services Regulations, in force since 1 January 2024. New sites must be Tier II or Tier III and carrier neutral, and a registration lasts three years. CST also classes cloud providers, co-regulates the Cloud Computing Special Economic Zone, and drafted the Global AI Hub Law in April 2025, which was still not final by October 2026.

Issues the municipal licence for a standalone commercial data centre inside or outside city limits under rules set in April 2026. An operator needs Civil Defense approval, a commercial registration that covers the activity and approval from the sector supervisor. Buildings must follow the Saudi Building Code and meet cooling, fire, power and backup standards.

The national utility that connects and supplies data centres through its grid arm National Grid SA. Shareholders approved the rename from Saudi Electricity Company on 25 February 2026. On 2 September 2026 National Grid SA signed a deal to supply power to a HUMAIN AI data centre in Riyadh, and its project subsidiary signed a framework deal with center3.

Sets the framework for grid connection, capacity allocation, tariffs and reliability with the Ministry of Energy. It approved the heavy consumption tariff from 28 May 2025, which can fall to 12 halalas per kWh on the transmission network. Under the Electricity Law it sets the limit above which a large consumer may negotiate its own price.

Sets energy policy and oversees renewable power procurement. In March 2021 the Cabinet approved a cloud computing tariff of 0.18 riyals per kWh for companies licensed by the telecom regulator, which the energy minister announced.

Enforces the Personal Data Protection Law and its rules on sending data abroad, fully in force since 14 September 2024. It also builds government capacity. On 5 January 2026 it laid the foundation stone for Hexagon, a 480 MW Tier IV government data centre in Riyadh.

Leads the national data centre strategy unveiled in June 2025 with SDAIA, which targets up to 1.5 GW of capacity by 2030. In June 2026 it held a workshop with the Ministry of Investment and banks on private funding for AI data centres.

Under the Investment Law, a foreign investor must register with MISA before investing, in place of the old licence. Activities on the restricted list need MISA approval. MISA also works with MCIT to bring private money into AI data centres.

Oversees the special economic zones, including the Cloud Computing zone it regulates with CST. The zone rules approved in January 2026 took effect on 16 April 2026. Cloud zone companies may build data centres anywhere in the Kingdom if their headquarters is in Riyadh.

Leases land in industrial cities and technology zones. In February 2025 it signed a lease with DataVolt for a 55,000 square metre data centre site in the First Technology Park in east Riyadh.

Leases land and provides infrastructure in its Oxagon industrial city for a planned 1.5 GW AI campus. DataVolt and HUMAIN broke ground on the first 100 MW there in August 2026, with power expected in 2028.

Sets the Cloud Cybersecurity Controls that cloud providers and their customers must meet, now in a 2024 second edition. The controls build on its Essential Cybersecurity Controls and reflect data localisation rules.

Data centre service providers that rent out space, power and cooling must register with the Communications, Space and Technology Commission (CST). Its Data Centre Services Regulations took effect on 1 January 2024.

New registered data centres must be Tier II or Tier III and carrier neutral, meaning any telecom network may connect. Tier I registration is limited to existing sites. A registration lasts three years and requires an energy management and sustainability plan.

Cloud service providers must register with CST and receive Class A, B or C. The class sets which data classifications and sectors a provider may serve. Oracle reported in December 2023 that Class C requires hosting in a Tier 3 or higher data centre.

The Ministry of Municipalities and Housing set unified rules for standalone commercial data centres inside and outside city limits. Operators need Civil Defense approval, a commercial registration covering the activity and approval from the sector supervisor. Buildings must follow the Saudi Building Code.

CST published a draft law in April 2025 for hubs that host foreign data. It proposes private hubs for foreign governments with diplomatic protections, plus extended and virtual hubs where a foreign country's law can govern the data. Public comment closed on 14 May 2025.

On 19 November 2025 the US Commerce Department authorised Humain to buy about 35,000 Nvidia GB300 chips. The approval is a case by case licence with security and reporting conditions monitored by the Bureau of Industry and Security. Saudi Arabia has no country level US framework for advanced chips.

NEOM signed an agreement with DataVolt on 10 February 2025 for a 1.5 GW AI data centre campus in Oxagon. Oxagon leases the land and gives infrastructure support. DataVolt's first US$5 billion funds phase one. DataVolt and HUMAIN broke ground on the first 100 MW in August 2026 and expect power in 2028.

The Cabinet approved a power tariff of 0.18 riyals per kilowatt hour (kWh) for cloud computing companies licensed by the telecom regulator in March 2021. The Saudi Electricity Company tariff table still lists Cloud Computing at a flat 18 halalas per kWh. A halala is one hundredth of a riyal.

Commercial users pay 22 halalas per kWh for the first 6,000 kWh a month and 32 halalas above that. Industrial users pay a flat 20 halalas per kWh. Government users pay 32 halalas per kWh.

Eligible industrial, commercial and farm users where power is 20 percent or more of operating cost pay 18 halalas per kWh on the distribution network and 12 on the transmission network. Users where power is 10 to 19.9 percent of cost pay 24 and 18. The rate cannot exceed the user's normal category rate.

From 28 May 2025 industrial, commercial and farm users that do not qualify for the heavy consumption tariff pay an extra 2 halalas per kWh. The Saudi Electricity Company said this rate will be updated from time to time.

The Electricity Law defines a Large Consumer as one whose use exceeds a limit set by the regulator. Article 12 lets a licensed power company agree prices with a Large Consumer that differ from the approved tariff.

The Crown Prince launched a Cloud Computing Special Economic Zone on 13 April 2023. CST regulates it with the Economic Cities and Special Zones Authority. It targets cloud providers and firms in AI and other advanced technology.

The Cabinet approved regulatory frameworks for four zones including the Cloud Computing zone in January 2026. They took effect on 16 April 2026. Cloud zone companies may build data centres anywhere in the Kingdom if their headquarters is in Riyadh.

At launch the zones were promoted with 5 percent corporate income tax for up to 20 years, zero withholding tax on profits sent abroad and zero customs duty on capital equipment. The 2026 zone frameworks refer back to the Tax Law and its incentives without stating a flat rate.

The Special Integrated Logistics Zone at King Khalid International Airport opened in October 2022 with exemptions from certain taxes and labour rules. Its launch named technology, communications, aviation and pharmaceuticals as focus industries. Data centres were not named.

The industrial cities authority MODON signed a land lease agreement with DataVolt in February 2025 for a 55,000 square metre data centre site. The site is in the First Technology Park in east Riyadh.

The Personal Data Protection Law took effect on 14 September 2023 with a one year grace period. Full compliance became mandatory on 14 September 2024. It also covers foreign firms that process data of Saudi residents.

An amended regulation on transferring personal data outside the Kingdom took effect on 14 September 2024. Firms may rely on standard contract clauses, binding group rules or an accreditation certificate. A risk assessment is required in some cases including sensitive data.

Government agency data must remain inside Saudi Arabia with only narrow exceptions set by law. Offshore hosting of financial institution data needs prior approval from the Saudi Central Bank.

The National Cybersecurity Authority sets Cloud Cybersecurity Controls in a second edition dated 2024 for cloud providers and their customers. The controls extend its Essential Cybersecurity Controls and were updated to reflect data localisation requirements. The NCA page was last updated on 24 June 2026.

Public bodies, firms whose main activity is processing personal data and firms handling sensitive data must register on the National Data Governance Platform.

The 2026 municipal rules require commercial data centres to meet local and international standards for cooling systems, fire protection, power and backup. No water use limit for data centres was found.

From 16 December 2015 government bodies and large businesses paid 9 riyals per cubic metre for water and sanitation and 6 riyals for water only. No newer official rate for data centres was confirmed.

On 14 July 2026 the US moved the UAE into Country Group A:5, which lets named users buy advanced chips without a licence. Saudi Arabia received no such rule. Fortune reported on 9 September 2026 that the Kingdom still lacks the designation.

No final approval of the Global AI Hub Law was found after public comment closed on 14 May 2025. The consultation text says the law would take effect 60 days after publication in the official gazette.

The investment and communications ministries held a workshop on 10 June 2026 with banks, investors, Humain and the AI Enablement Office. It discussed ways to raise private sector funding for AI data centres.

Fortune reported on 9 September 2026 that Humain is seeking outside investment as the state limits spending. An expert quoted linked this to a possible US arrangement similar to the one G42 obtained.

The Saudi Electricity Company said the surcharge on users outside the heavy consumption tariff will be updated periodically. Data centre operators should watch for revised rates.