Saudi Arabia now has two major hyperscaler regions: AWS Middle East (Riyadh) and Microsoft Azure KSA North. Both launched in 2023 and 2024 respectively, transforming the cloud landscape for organisations bound by the Personal Data Protection Law (PDPL) and NCA data residency requirements.
Data residency requirements under PDPL and NCA
The PDPL requires that personal data related to Saudi nationals be processed and stored within the Kingdom unless explicit conditions for cross-border transfer are met. NCA’s Cloud Cybersecurity Controls (CCC-1:2020) additionally require government and critical sector organisations to use locally-located cloud services for sensitive workloads.
AWS Riyadh (me-central-1) and Azure KSA North both meet these requirements for the vast majority of enterprise workloads.
Choosing between AWS and Azure for KSA deployments
The choice is typically driven by your existing enterprise agreements, your team’s tooling familiarity, and your SAP landscape. Azure has a natural advantage for Microsoft-heavy organisations (M365, Active Directory, SQL Server) and for SAP workloads via Azure SAP-certified instances. AWS has historically had deeper managed service breadth and is often preferred for greenfield cloud-native architectures.
Migration factory approach
At NAS, we use a migration factory model: a small core team defines the migration runbook and tooling, and a larger delivery team executes waves of 20-50 workloads at a time. This approach has allowed us to complete 200+ workload migrations with a 98% zero-unplanned-downtime rate.
Key decisions for each workload: Rehost (lift & shift), Replatform (lift & optimise), Refactor (re-architect), or Replace (SaaS substitution). The 6Rs decision tree in our Cloud Migration Playbook helps you make this decision systematically.
