Hiring a Software Company in Saudi Arabia: 2026 Checklist

The short answer

Choosing a software development company in Saudi Arabia is only partly a technical decision. Before comparing rates or portfolios, confirm five things: the vendor can legally hold the contract; your data can sit where the vendor proposes to put it; any personal data leaving the Kingdom has a lawful transfer basis under the Personal Data Protection Law (PDPL); local content rules do not disqualify the arrangement if public money is involved; and withholding tax and e-invoicing are not quietly adding to your real cost.

Stalled software projects in the Kingdom are usually not engineering failures — they are projects where one of those gates was discovered after the contract was signed. This guide covers each with the rules as they stand in October 2026. Stratgik is a technology firm, not a law firm: nothing here is legal or tax advice, and you should confirm your position with qualified Saudi counsel and a licensed tax adviser.

Gate 1: can this vendor legally hold your contract?

A foreign software company cannot invoice a Saudi client from abroad and call it a local engagement. Operating in the Kingdom requires an investment licence from the Ministry of Investment (MISA), whose Investor Guide sets out the entity forms, documentation and sector conditions. A vendor pitching an "onshore" team with no MISA licence and no commercial registration is offering an offshore arrangement with local branding.

Government buyers apply a second, harder filter. Since the 2024 framework, companies without a Regional Headquarters (RHQ) in Saudi Arabia have effectively been excluded from government procurement above a SAR 1 million threshold. Rules refined in early 2026 let government entities request exemptions through the Etimad platform, but these are not automatic: a non-RHQ bid is generally accepted only where it is the sole technically compliant offer, or is technically best and at least 25% cheaper than the next best.

The result is a two-tier market. If your roadmap touches government buyers, a vendor's RHQ status is a commercial fact about your pipeline, not a compliance footnote. Ask for it in writing early.

Gate 2: where will your data and your code actually live?

Saudi Arabia's Cloud First Policy, issued by the Ministry of Communications and Information Technology, applies to civilian government entities and is the reference point most enterprise buyers end up working to. It requires entities to consider cloud for all new IT investment, prohibits building new data centre infrastructure except through government-owned providers such as the National Information Center (NIC), and prioritises SaaS, then PaaS, then IaaS. It also sets a four-level data classification and a staged hosting decision, states that all data in government and commercial government clouds must be geographically located inside Saudi Arabia, and recommends hosting stay in the Kingdom without remote access from outside it.

Private companies sit outside the policy's formal scope, but the classification habit is worth copying: it forces an answer to the question most contracts leave vague — which datasets may leave the Kingdom, and which may not. Two questions for any vendor. Which in-Kingdom region will production run in, named explicitly, not "the region closest to you"? And will engineers outside Saudi Arabia hold production access, to which environments? A vendor who cannot answer the second precisely has thought about hosting, not residency. Our Saudi Arabia hub covers how this shapes team structure.

Gate 3: can personal data leave the Kingdom at all?

The PDPL has been fully enforceable since 14 September 2024, and SDAIA issued an updated Regulation on Personal Data Transfer Outside the Kingdom on 1 September 2024, replacing the 2023 version. Transfers need a purpose recognised in Article 29 or the Transfer Regulation — an obligation under an agreement the Kingdom is party to, serving the Kingdom's interests, an obligation to which the data subject is a party, central processing within a multinational group, providing a service or benefit to the data subject, or scientific research.

A purpose alone is not enough: the transfer must also meet an adequacy decision or an appropriate safeguard. SDAIA is empowered to publish an adequacy list, and public commentary through 2026 indicates none has been published, so in practice almost every outbound transfer relies on one of three safeguards:

• Standard Contractual Clauses (SCCs). SDAIA publishes set forms, to be used without modification.
• Binding Common Rules (BCRs). Intra-group policies prepared under SDAIA's BCR Guidelines — relevant if your vendor is part of a multinational.
• Certificate of Accreditation. Issued by an SDAIA-licensed body; applicants must already be on the National Register of Controllers, and accreditation rules were issued in February 2026.

A documented risk assessment is required before transferring under a safeguard, and whenever sensitive data goes outside the Kingdom on a continuous or large-scale basis, repeated when volume, sensitivity or destination changes. An offshore development team is not a problem in itself; it is a problem if nobody has executed SCCs, nobody has run the risk assessment, and nobody can say which datasets that team touches. Our Saudi PDPL implementation work usually starts by mapping exactly that.

Gate 4: local content, if public money is anywhere near the project

The Local Content and Government Procurement Authority (LCGPA) has extended local content requirements into professional services, and the timetable now reaches IT. According to the Saudi Press Agency, local content weighting in the financial evaluation of government IT services procurement begins 1 April 2027 for tenders of SAR 10 million or more, with no company-level minimum for IT services. Management consulting is stricter: a 30% company-level minimum from the same date for tenders of SAR 10 million or more, extending to SAR 5 million from 1 January 2028, with bidders submitting a local content certificate and those below the threshold excluded.

For vendors bidding into government IT tenders, that certificate becomes a pricing instrument from April 2027, so the work of raising local content — Saudi hiring, local spend, local training — starts in 2026. For buyers, a vendor's local content position affects how competitive their bids are on anything you co-deliver.

Gate 5: the tax and invoicing mechanics that change your price

Payments to non-residents are classified under ZATCA's software payments guideline, and that classification sets the withholding rate. The royalty versus technical service distinction is where most budget surprises originate.

ZATCA's guideline on software payments was published in January 2024 under the domestic Income Tax Law. Treaty relief for royalties is generally obtained by refund rather than a reduced rate at source, so cash flow is affected even where a treaty exists. Standard VAT is 15%.

E-invoicing is the other mechanic, and its thresholds keep falling. Wave 25, published on 24 July 2026, covers taxpayers with taxable revenue above SAR 187,500 in any year from 2022 to 2025, with an integration deadline of 1 February 2027 — half the SAR 375,000 threshold used for Wave 24, whose deadline was 30 June 2026. ZATCA notifies affected taxpayers directly, generally at least six months ahead. Any ERP, billing or commerce system your vendor touches must therefore produce compliant invoices and integrate with ZATCA's platform. If that is not in the statement of work, it arrives as a change request. Our custom software practice treats it as a first-class requirement on Saudi finance and commerce builds.

Workforce and Saudization

Localisation targets shape what a blended rate can realistically be. A 30% Saudization requirement across 46 engineering professions took effect on 30 June 2026 for establishments with five or more employees in covered occupations. The list includes website design engineers; whether a given software or data role falls inside it depends on occupational classification, so check the MHRSD procedural manual against your vendor's job titles rather than assuming. A vendor promising a large in-Kingdom team at offshore rates is making a claim that is hard to sustain — price the localisation cost in, or accept a hybrid model and document it under Gate 3.

A practical vendor evaluation checklist

• Get the MISA investment licence number and commercial registration, and verify them independently.
• Ask whether the vendor holds an RHQ, if any part of your roadmap touches government procurement above SAR 1 million.
• Name the in-Kingdom production hosting region in the contract, not the proposal deck.
• Classify your datasets before writing the statement of work, using the four-level model as a starting point.
• List every dataset accessible from outside Saudi Arabia, naming the country for each.
• Confirm which transfer safeguard applies — SCCs, BCRs or accreditation — who signs it, and who maintains the risk assessment.
• Require named production-access roles with a joiner-mover-leaver process, not a shared vendor account.
• Ask for the local content certificate and current percentage if government tenders are in scope.
• Get tax treatment in writing: is each line item a royalty, a technical service or commercial profits, and who bears the withholding?
• Scope ZATCA Phase 2 integration explicitly for any invoicing, billing, ERP or commerce component.
• Require source code escrow or direct repository ownership, so an exit does not depend on goodwill.
• Agree a written exit plan before go-live: cloud account ownership, data return, and evidence of deletion at termination.

What this means for your budget

Add the gates up and it is clear why Saudi software budgets built from an offshore day rate are usually wrong by a wide margin. The build may be priced accurately; what gets omitted is in-Kingdom hosting rather than the cheapest region, the PDPL transfer paperwork and the engineering to restrict offshore access, e-invoicing integration, withholding tax on the offshore portion, 15% VAT, and the localisation cost of any in-Kingdom team. None of these are extras — they are the cost of operating lawfully. The useful first-meeting question is not "what is your rate?" but "walk me through how you handle data residency and cross-border transfer for a client in my sector".

If you are still deciding between building, buying and configuring, our build vs buy tool gives you a structured comparison before you go to market, and a technology decision sprint resolves the architecture and residency questions before a vendor is selected rather than after.

Frequently asked questions

Can a foreign software company work for a Saudi client without a local entity?

It can contract from abroad in some situations, but that is an offshore arrangement with the consequences above: withholding tax on payments to the non-resident, PDPL cross-border transfer obligations for any personal data, and exclusion from government procurement where RHQ rules apply. An established in-Kingdom presence requires a MISA investment licence. Take Saudi legal advice on your structure.

Do private companies have to host data inside Saudi Arabia?

The Cloud First Policy's in-Kingdom hosting requirement is framed for civilian government entities and their clouds; MCIT encourages private organisations to adopt similar policies rather than mandating them. Private companies are still bound by the PDPL, which governs cross-border transfer rather than imposing blanket localisation, plus any sector rules — financial services and healthcare in particular. The answer depends on your sector and data type, so it needs checking.

Is there an approved country list for transferring personal data out of Saudi Arabia?

SDAIA is empowered to publish an adequacy list, and public commentary through 2026 indicates none has been published. Until one exists, transfers generally need an appropriate safeguard — SDAIA's standard contractual clauses, binding common rules, or a certificate of accreditation — plus a documented risk assessment.

When does my software need to integrate with ZATCA e-invoicing?

Phase 2 applies in waves by revenue, and ZATCA notifies affected taxpayers directly, generally at least six months ahead. Wave 25, announced 24 July 2026, covers taxpayers exceeding SAR 187,500 in taxable revenue in any year from 2022 to 2025, with a 1 February 2027 deadline. Since thresholds keep falling, treat compliant e-invoicing as a requirement for any new finance or commerce system rather than waiting for a notice.

What is the most common mistake in Saudi software procurement?

Selecting on build price, then discovering the residency and transfer constraints. Reworking a live system to restrict offshore access and move production into the Kingdom costs far more than designing for it, and it usually surfaces during a compliance review or a tender. Classify your data and settle residency before the statement of work is written.

Saudi software procurement is as much a compliance exercise as a technical one. Settle the five gates in writing before you sign and the engineering becomes the straightforward part. For help with PDPL transfer obligations and data residency on a specific project, start with our Saudi PDPL compliance implementation page.

Written by the Stratgik team. Stratgik is a technology strategy and implementation firm headquartered in Gurugram, India, working with organisations in Saudi Arabia and across the Gulf. We are not a law firm or tax adviser; this is general information current as of October 2026.