Short answer: Oracle runs two public cloud regions inside Saudi Arabia: Jeddah, generally available since July 2020, and Riyadh, opened in August 2024 as part of a US$1.5 billion investment, with a further region planned in NEOM. Two in-Kingdom regions let businesses keep data in Saudi Arabia while running disaster recovery across two cities, which matters for ERP systems holding financial and personal data governed by the Personal Data Protection Law and NCA cybersecurity controls.
Oracle Cloud Infrastructure regions in Saudi Arabia
A cloud region is a set of data centers delivering cloud services from a specific location. The closer a region is to you, geographically and legally, the better the performance and the simpler local compliance becomes.
Jeddah (2020)
Oracle announced general availability of its Jeddah cloud region on July 20, 2020, with Oracle Cloud services including Autonomous Database. A government adopter quoted in the announcement said it chose the platform “to meet our data residency requirements, along with low latency, and strong data governance.”
Riyadh (2024)
On August 6, 2024, Oracle opened its second Saudi public cloud region in Riyadh, hosted by center3, as part of a US$1.5 billion investment to expand cloud infrastructure in the Kingdom. Oracle noted that the two regions together support high availability, backup and disaster recovery within Saudi Arabia.
NEOM (planned)
Oracle’s announcement refers to a “planned Oracle Cloud Region in NEOM,” so it had not opened as of that announcement.
| Region | Launch | Notes |
|---|---|---|
| Jeddah | July 20, 2020 | Oracle’s first region in the Kingdom |
| Riyadh | August 6, 2024 | Hosted by center3, part of US$1.5B investment |
| NEOM | Planned | Not officially opened |
Available services and deployment models
Oracle lists Autonomous Database, HeatWave MySQL, Container Engine for Kubernetes, OCI Generative AI and OCI AI Infrastructure among 100+ services. Beyond public regions, Oracle offers OCI Dedicated Region inside a customer’s data center, hybrid options such as Exadata Cloud@Customer, and Oracle Alloy for partners.
The regulatory picture
Personal Data Protection Law (PDPL)
The PDPL took effect on September 14, 2023, with a one-year grace period ending September 14, 2024. SDAIA’s transfer regulations allow transfers outside the Kingdom on defined grounds, such as an adequate level of protection in the receiving country or approved safeguards like standard contractual clauses and binding corporate rules, with risk assessments required in certain cases. In practice, offshore hosting is not banned outright, but it adds legal groundwork; keeping data in-Kingdom removes much of that burden.
NCA Cloud Cybersecurity Controls (CCC)
The National Cybersecurity Authority’s CCC-2:2024 extends the Essential Cybersecurity Controls and sets minimum requirements for cloud service providers and tenants. The NCA states the update reflects changes related to data localization requirements.
Vision 2030
Digital transformation is central to Saudi Vision 2030, and in-Kingdom cloud capacity from global providers is part of building a digital economy where data remains under national jurisdiction.
Why local hosting matters for ERP
An ERP is your system of record. It holds:
- Financial data: journals, bank accounts, receivables and payables.
- Personal data: payroll, employee IDs, customer contacts.
- Tax invoices: e-invoices connected to ZATCA.
- Trade secrets: costs, margins, pricing and contracts.
Where that data lives affects:
- Compliance: in-Kingdom hosting simplifies data transfer obligations and answers to regulators and government clients.
- Performance: lower latency for POS, warehouses and branches.
- Continuity: two regions allow disaster recovery without leaving the country.
- Trust: “Where is our data hosted?” is now a standard tender question.
Questions to ask your ERP provider
| Question | Why it matters |
|---|---|
| Where are the database and backups physically hosted? | Backups are data too and fall under the same rules |
| Is there a DR plan, and where is the DR site? | Some DR setups move data abroad without you knowing |
| Who can access the data? | Access control and auditing are core security controls |
| Can the system run on-premises? | Some sectors prefer in-house hosting |
| How is data exported if we leave? | Your data should remain yours |
What this means for Saudi businesses
If you plan to move to the cloud in 2026 or 2027, you now have genuine in-Kingdom options from global providers; the choice is no longer just offshore cloud versus an in-house server. Classify your data first (financial, personal, public), map each class to its requirements, then choose the hosting model. Do not let price be the only criterion.
How Riv-ERP helps
Riv-ERP is a Saudi-made ERP and accounting system built on Oracle Database and Oracle APEX, and is hosted on Oracle Cloud in the Jeddah and Riyadh regions, so your data stays inside the Kingdom. For organizations that prefer in-house hosting, RivDesktop is available with a perpetual (buy-once) license and runs on Windows, web and cloud, online or offline. Riv-ERP is ZATCA e-invoicing Phase 1 and 2 compliant and backed by a local 24/7 team in Jeddah. To discuss the right hosting setup for your data, request a quote from Riv-ERP.
Looking for a Saudi ERP with a local team? See Riv-ERP from Jeddah.
Related Articles
Frequently Asked Questions
Does Oracle have cloud data centers in Saudi Arabia?
Yes. Oracle operates two public cloud regions in the Kingdom: Jeddah since July 2020 and Riyadh since August 2024, with a region planned in NEOM.
Does the PDPL forbid transferring data outside Saudi Arabia?
Not outright. The transfer regulations require a legal basis such as adequate protection in the receiving country or approved safeguards like standard contractual clauses, plus risk assessments in specific cases.
What are the NCA Cloud Cybersecurity Controls?
CCC-2:2024 sets minimum cybersecurity requirements for cloud providers and tenants, extends the Essential Cybersecurity Controls, and was updated to reflect data localization requirements.
Why do two in-country regions matter?
They allow backup and disaster recovery between Jeddah and Riyadh while data stays inside the Kingdom, instead of relying on an offshore DR site.
Can I run an ERP on my own premises instead?
Yes, where the product supports it. Riv-ERP’s RivDesktop edition uses a perpetual license, runs on Windows and works online or offline.
Which Oracle services are available in the Riyadh region?
Oracle lists Autonomous Database, HeatWave MySQL, Kubernetes, OCI Generative AI and AI infrastructure among more than 100 cloud services.
Sources: Oracle Riyadh region announcement, Oracle Jeddah region announcement, NCA Cloud Cybersecurity Controls.
