Many Saudi enterprises have adopted SaaS platforms faster than their contracts have been updated. The agreements were often signed on the vendor's standard paper, with security language written for a general market. For teams working on NCA cloud controls SaaS contract clauses Saudi regulators are likely to expect, that gap is now a practical planning problem rather than a theoretical one.
A caution first. The NCA Cloud Cybersecurity Controls are the framework in question, and the appendix material discussed here is in draft. Final wording, numbering and effective dates may change. Treat the clauses below as a negotiating position built on the direction of the draft, and confirm the final text with the National Cybersecurity Authority once it is issued. The aim is to avoid reopening every contract later.
Why contracts are the weak point
Technical controls can be tested and fixed. A contract cannot be fixed by the security team alone. If the agreement gives you no right to timely incident notice, no right to verify where data sits, no access to logs and no vulnerability timelines, your control environment depends on the vendor's goodwill.
Legal teams usually negotiate commercial terms well. The difficulty is that security clauses need technical precision, and the CISO's office needs to supply it. The four clauses below are where that joint work pays off most.
Clause 1: Incident notification within 24 hours
The contract should oblige the vendor to notify you of a confirmed or reasonably suspected security incident affecting your data or service within 24 hours of becoming aware of it. Points to settle:
- A clear definition of "incident" that includes suspected compromise, not only confirmed breaches.
- A named notification channel and a 24-hour contact on both sides.
- A duty to provide follow-up updates, with content such as scope, affected data, containment actions and root cause.
- Cooperation with your own investigation and regulatory reporting.
Vendors often resist fixed hours because they fear liability for missing a deadline. That is why the amendment approach later in this article matters.
Clause 2: Data-residency attestation with audit rights
Where data is stored and processed is a core concern in the Kingdom. The contract should require:
- A written statement of the locations where your data, backups and support access occur.
- Advance notice and your approval before any change of location or sub-processor.
- Your right to audit, or to receive independent assurance reports, that confirm the attestation.
An attestation without audit rights is only a promise. Pair the two so that the statement can be verified.
Clause 3: Security-log retention and access for investigation
When an incident occurs, logs decide whether you can reconstruct events. Negotiate:
- A minimum retention period for security-relevant logs, aligned to your own policy.
- Your access to tenant-level logs, by export or API, during an investigation.
- A response time for log requests from your incident team.
- Preservation of logs on request when an investigation is open.
Agree the retention period internally before you go to the vendor, so legal is not negotiating a number that security has not set.
Clause 4: Vulnerability-disclosure timelines aligned to NCA ECC
The vendor should commit to timelines for disclosing vulnerabilities that affect your service, and for remediating them according to severity. Align these with the vulnerability-management expectations in the NCA Essential Cybersecurity Controls (ECC) that already apply to your organization. Include notice of material vulnerabilities, patch timelines by severity, and a route for you to report vulnerabilities you find.
The DPA amendment that closes the incident-notification gap
Vendors tend to push back on security-driven notification terms inserted into the master agreement. They tend to accept data-protection terms more readily, because they already operate under privacy obligations in several markets.
The approach is to place the 24-hour notice in the data-processing agreement as a personal-data-breach obligation under the Personal Data Protection Law (PDPL), which is overseen by SDAIA. Article 27 is the provision commonly associated with breach notification under the law, but have counsel confirm the article reference and its current wording before you cite it in the amendment.
The amendment should cover, in plain language:
- The processor notifies the controller of any personal data breach without undue delay and no later than 24 hours after becoming aware of it.
- The notice includes the nature of the breach, categories and approximate volume of data affected, likely consequences and measures taken.
- The processor supplies updates as facts develop and cooperates with the controller's regulatory notifications.
- The obligation extends to sub-processors, with the processor responsible for flowing the term down.
Framed this way, the vendor is agreeing to something it is already expected to do, and your organization secures a notification route that serves its security incident process as well. Keep one caveat in mind: this covers incidents involving personal data. If a security incident does not involve personal data, make sure the master agreement still carries a general incident-notice term.
Signs it is time to review your SaaS agreements
- Contracts were signed before your cloud security policy existed.
- No one can say where a vendor's backups or support staff are located.
- Your incident team has never tested a log request with a SaaS vendor.
- Renewal dates fall in or near Q4 2025 and legal has no security checklist.
What a good outcome looks like
A good outcome is a short list of standard clauses, approved by legal and security, that is applied at every new signing and renewal. Each SaaS platform has a documented split of responsibilities. Gaps in older contracts are recorded, ranked and scheduled for amendment. When the final NCA text arrives, you adjust wording rather than start again.
How the work is run
Contract clauses work best when they sit inside a wider view of cloud risk. Our Cloud & Application Security service covers cloud security governance and assessment against the NCA Cloud Cybersecurity Controls. The work typically runs 4–8 weeks. Cloud environments are assessed against NCA controls, and the shared-responsibility model is defined for each service, which gives legal a factual basis for what each clause must cover. Data residency and approvals are addressed before migration, so the attestation and audit clauses are settled before data moves.
The deliverables are a cloud security assessment report, a shared-responsibility matrix, a cloud security policy and baseline configuration standards, a secure development standard and threat models, and a remediation roadmap. We assess the major public cloud platforms and local cloud service providers, against the NCA controls and the provider's own security model.
Next step
If your SaaS renewals are approaching and your contracts do not yet carry these four clauses, start by listing the platforms that hold your most sensitive data. Our Cloud & Application Security team can help you assess them against the NCA controls and prepare a remediation roadmap that your legal team can act on before Q4 2025.
