Keeping real data at home
Most of this gets simpler if real personal data never leaves the Kingdom. Build and test on synthetic or masked records, and let real personal data live only in production, hosted inside the Kingdom. Hosting location and engineering location are separate decisions. The penalties are large enough to justify the care: a fine of up to SAR 5 million for most violations, and up to two years in prison, a fine of up to SAR 3 million, or both, for disclosing or publishing sensitive data to harm the person or for personal benefit (DLA Piper). The sector regulators, banking and health among them, add their own rules on top, so check those with counsel.
Hosting custom software in Saudi Arabia
For many private-sector systems, the PDPL does not force in-Kingdom hosting. Buyers still often ask for it, because government customers, banks and operators of critical systems come with their own requirements. The National Cybersecurity Authority’s cloud controls were reissued as CCC-2:2024, and its controls page describes the update as reflecting data localisation changes. Which of your data falls under which class is a question for your security team, not for the software vendor.
What a team can do is check which regions exist today. Google Cloud opened its Dammam region on 15 November 2023. Amazon Web Services announced a Saudi region on 4 March 2024 for 2026, with three availability zones, and a 1 September 2026 report says it is on track for December 2026, which AWS itself repeats. As of this writing, that is a plan and not a region you can deploy to. If your contract says in-Kingdom hosting on AWS, put the region’s availability date in the schedule, and write down what happens if it slips.
Selling software to the Saudi government
Four points shape a public-sector project, and they change on a timescale of months. Treat the table as a reading list for your procurement team, not a summary of the rules.
| Rule | What the sources say | Why it matters to a software project |
|---|---|---|
| Etimad | The Ministry of Finance set up the government e-procurement platform in 2018 (US Commercial Service, May 2026) | Tenders run through it, and by early 2026 so did requests for exemptions, so a bid needs the supplier registered there |
| Regional headquarters rule | A December 2023 Council of Ministers resolution said that from January 2024 companies without a regional headquarters in the Kingdom could not take part in tenders or contracts with government entities (same source) | It limits who can hold the contract, and a foreign vendor usually sits below a Saudi company |
| Exceptions | Purchases below SAR 1 million, contracts for work carried out outside the Kingdom and tenders with a single qualified bidder were listed in Vistra’s February 2024 note; a February 2026 briefing describes a formal process in which the government entity requests an exemption through Etimad, and approval is not automatic | Do not plan a bid around an exemption the buying entity has not obtained |
| GCC price preference | The same US source describes a price preference of up to 10% for GCC products over non-GCC products where foreign suppliers take part | Mostly written for goods; ask how a service or software tender scores local content |
Read the tender document itself before relying on any of this. Vistra’s 2024 list predates the 2026 exemption process, so an exception that existed on paper then is not one you can assume now. If the regional headquarters rule applies, the practical question is whether a Saudi company or a local integrator holds the contract.
Hijri dates and the Arabic interface
Plan any Arabic, right-to-left interface from the first screen, because mirroring a finished layout costs far more than designing for it. The calendar is the part that reaches the contract.
The Umm al-Qura calendar is the Kingdom’s official Hijri calendar, and the browser can produce it if you ask: Intl.DateTimeFormat('ar-SA-u-ca-islamic-umalqura'). Ask explicitly rather than relying on a locale default, which varies between environments. We checked on Node 22: with the default ar-SA locale, the calendar came back as Gregorian. Store dates in one calendar internally, usually Gregorian in UTC, and convert at the edge. Contract terms and Hijri-dated official documents will not always agree with a computed table by a day, so let a person confirm any date that triggers a payment or a deadline.
Sunday to Thursday against an Ahmedabad week
Saudi Arabia moved its weekend to Friday and Saturday on 29 June 2013, which makes Sunday to Thursday the working week (Crowell and Moring). Our team works Monday to Friday. The Kingdom runs on UTC+3 all year and India on UTC+5:30, so 09:00 in Riyadh is 11:30 in Ahmedabad.
Monday to Thursday is shared, and we shift our day so that the Saudi working day is covered; our FAQ puts it as the whole working day in common with the Gulf. Sunday is a Saudi working day and our weekly rest day. Friday is the reverse. Anything raised on a Sunday waits for Monday unless it is agreed beforehand, and a written handover closes each of our days. The contract should say which day the sprint review falls on, so it never lands on a day half the people are away.
Ramadan and the Eid holidays move across the Gregorian year, so a delivery plan built on Gregorian dates alone will collide with them. Put them in the project calendar at kickoff.
Whether a remote team suits the project at all is a separate question; we set in-house, remote and hybrid set-ups against each other in an earlier post.
Contract terms for custom software in Saudi Arabia
None of this is legal advice; ask a Saudi lawyer before signing. These are the clauses we expect a buyer to raise, and the reasons behind them.
Currency and tax
Our Saudi engagements are invoiced in SAR. VAT in the Kingdom has been 15% since 1 July 2020 (ZATCA). Where a foreign supplier with no Saudi presence bills a VAT-registered Saudi business, advisers describe a reverse-charge treatment in which the customer accounts for the VAT itself. Payments to non-residents can also attract Saudi withholding tax, which advisers such as Dariba describe as 5% for technical and consulting services and 15% for software licence fees, the rate to be settled by the substance of the deal and any tax treaty. Those are secondary sources, so confirm the rates with a tax adviser. For the contract, the important thing is to say who bears any withholding, and whether the price is gross or net of it.
Ownership, scope and payment
Ownership of the code should pass to your company in full when payment completes. Keep the repository under your organisation’s account from day one, rather than receiving a copy at the end, and pay against milestones that each carry written acceptance criteria. If you are still choosing between a fixed price, hourly billing and a monthly team, our post on pricing models sets out the options.
Law and disputes
Choosing governing law and a forum is the clause where a local lawyer earns the fee. Saudi Arabia’s arbitration law is Royal Decree M/34 of 2012 (Clyde and Co, 2025), and the Kingdom acceded to the New York Convention in 1994, applying it only to awards made in another contracting state (UNCITRAL). A Saudi court can still refuse an award, or part of one, that conflicts with Sharia or public policy, and Simmons & Simmons names awards of interest as the usual risk. We do not ask a client to contract under another country’s law, and the choice remains yours and your counsel’s.
Custom software in Saudi Arabia comes with local rules on data, hosting, government tenders and contracts, and each one changes what gets built. Enforcement of the Personal Data Protection Law began in September 2024. The government tender system has its own gatekeeping rules. The working week, the calendar and the language of the interface are all different from what a Western template assumes.
Our engineers sit in Ahmedabad and already keep Gulf hours for clients in the region. We have no office and no legal entity in the Kingdom, and our Saudi Arabia page says so plainly. What follows is what a Saudi buyer’s lawyer, security lead and finance team will ask about, and where a team working from India has to bend to fit.
Who signs for custom software in Saudi Arabia
Start here, because it decides which of the later rules reach you. A Saudi company hiring a foreign team for an internal system, a customer portal or a SaaS product is a private-sector buyer. A ministry or other government entity is a public buyer, and its purchases run through the government procurement law and the Etimad platform. State-owned companies often run their own procurement rules, so ask which set applies.
We cannot be the contracting party on a government tender, because we have no Saudi entity. If you are a Saudi company bidding for public work, the workable arrangement is that you hold the contract and we act as your engineering team underneath it. Whether a tender lets you name a foreign subcontractor is a question for its terms and for your procurement lawyer. We will say the same on the first call, so nobody finds out in week eight. If the system is small enough that a platform might do the job, our post on low-code versus full code for fintech and e-commerce in Dubai weighs that call for a Gulf buyer.
Custom software in Saudi Arabia and the PDPL
The Personal Data Protection Law was issued as Royal Decree M/19 on 16 September 2021 and amended by Royal Decree M/148 on 27 March 2023. DLA Piper’s country summary records it as in effect from 14 September 2023, with controllers generally having until 14 September 2024 to comply. CMS, in a note of 26 September 2024, treats 14 September 2024 as the enforcement date. The regulator is SDAIA, the Saudi Data and AI Authority.
For a build, the law turns into a short list of decisions:
Moving data out of the Kingdom
The transfer rules matter most for a team based abroad. The PDPL does not ban moving personal data out of the country. The transfer regulation allows it to countries SDAIA treats as adequate or under appropriate safeguards, and asks for a risk assessment when a safeguard or an exemption is the basis. Clyde and Co’s note lists binding corporate rules, standard contractual clauses and certificates from SDAIA-licensed bodies as the safeguards. Our client FAQ takes the same line, agreeing the position once, before the build starts.