The Tech & SaaS Company Setup Guide
to Saudi Arabia

Every foreign-owned tech company in Saudi Arabia is built on a MISA Services-LLC at SAR 500K capital — the same licence used by management consultancies and design firms. What separates a SaaS company from a consultancy, in regulatory terms, is the MCIT (Ministry of Communications and Information Technology) activity codes embedded in the MISA application and the Commercial Registration.

The activities that matter: Computer programming activities (ISIC 6201) for custom software and SaaS development; Computer consultancy activities (ISIC 6202) for implementation and integration; Data processing, hosting and related activities (ISIC 6311) for cloud infrastructure and managed hosting; Web portals (ISIC 6312) for marketplaces and aggregators; Software publishing (ISIC 5820) for licensed software products. Each unlocks a different set of customer contracts and a different MCIT compliance regime.

Get this wrong and you cannot bid for the contract you set up the company to win. Pick narrowly and you protect the licence; pick broadly and you trip MCIT scrutiny on activities you don't actually run. We cover the activity-selection mechanics in Volume 16 — MISA Activities & ISIC4.

The Personal Data Protection Law (PDPL), fully effective from September 2024, governs how personal data of Saudi residents is collected, processed and transferred. It is enforced by SDAIA (Saudi Data and AI Authority).

For a foreign SaaS company, three obligations matter most: (1) Lawful basis — you need explicit consent or a recognised legal basis to process Saudi resident data. (2) Data localisation — sensitive data (health, financial, biometric, children's data) must be processed inside Saudi Arabia unless an explicit cross-border transfer mechanism applies. (3) Cross-border transfer — non-sensitive personal data can leave the Kingdom only with an adequacy determination, an approved transfer mechanism, or explicit consent for each transfer.

In practice this drives a hosting decision early: AWS Middle East (Bahrain), Google Cloud Dammam, Oracle Jeddah, STC Cloud, Mobily Cloud or Microsoft Azure (KSA region, live since 2024). Selling to government, banking, healthcare or any sector with sensitive data effectively forces in-Kingdom hosting plus NCA Cloud Cybersecurity Controls (CCC-1) compliance.

Penalties under PDPL run to SAR 5M per violation, with criminal liability for the Managing Director on knowing breaches. This is not a year-two problem.

The National Cybersecurity Authority (NCA) issues two control frameworks that bind foreign technology suppliers operating in Saudi Arabia: ECC-1 (Essential Cybersecurity Controls) for organisations handling government data, and CCC-1 (Cloud Cybersecurity Controls) for cloud service providers and customers in regulated sectors.

ECC-1 covers 114 controls across five domains: governance, defence, resilience, third-party risk and industrial-control systems. CCC-1 layers cloud-specific obligations: data classification, encryption, key management (with the Saudi-resident Key Management Service requirement for Tier 3 and 4 data), and incident notification within four hours.

Compliance is evidenced through annual self-assessment plus, for higher-tier customers, an independent audit by an NCA-licensed assessor. Without a clean ECC-1 posture, you do not pass the procurement gate at any government entity, SAMA-regulated bank or NUPCO healthcare contract.

The Saudi technology talent stack runs through three institutions: KAUST (King Abdullah University of Science and Technology, Thuwal — graduate engineering and AI research); KFUPM (King Fahd University of Petroleum and Minerals, Dhahran — undergraduate engineering, especially data and software); and Misk Academy / Tuwaiq Academy (Riyadh — bootcamp pipelines for software engineering, product, design and data).

Compensation benchmarks for Saudi nationals in 2026: Senior software engineer SAR 28,000–45,000/month; Mid-level engineer SAR 18,000–28,000/month; Junior engineer SAR 10,000–16,000/month; Product manager SAR 25,000–40,000/month. Expat compensation runs 10–20% higher to offset Iqama, dependant levy and housing differential. See Cost of Hiring in Saudi Arabia for the full benchmark and the Saudization & Nitaqat Volume 14 for the headcount math.

The geography matters: KAFD (King Abdullah Financial District, Riyadh) is the default address for SaaS, fintech and product teams; ITCC (IT & Communications Complex, Riyadh) for cloud and infrastructure firms; Dhahran Techno Valley for industrial-tech and Aramco-adjacent suppliers.

The Saudi technology market in 2026 is dominated by the public sector and PIF-owned giga-projects. NEOM, ROSHN, Diriyah, Red Sea Global, Qiddiya, the Saudi Tourism Authority, the Ministry of Health, the Ministry of Education, NUPCO, SDAIA and the General Authority for Statistics together control the majority of greenfield enterprise IT spend.

All of them — by Royal Decree from January 2024 — require any foreign supplier bidding for contracts above SAR 1M to either operate from a Regional Headquarters licence inside the Kingdom or accept procurement disadvantage and ZATCA withholding tax penalties. The RHQ Programme is therefore the gating decision for any tech company chasing public-sector revenue.

The trade-off: RHQ gives you 30 years of 0% corporate tax and 0% withholding on RHQ activities, but the licence prohibits generating commercial revenue from operating activities inside Saudi Arabia. Most foreign tech firms therefore run a two-vehicle structure: an RHQ for regional coordination and public-sector qualification, plus an operating MISA Services-LLC for commercial Saudi sales. We cover the architecture in Volume 15 — The RHQ Programme.

Payment terms from public buyers run 60–90 days from invoice acceptance; from PIF-owned giga-projects, often longer. Working capital planning is not optional.