04 — Sector

Technology & Digital

A SAR 199bn ICT market, fast-growing data-centre capacity and new hyperscale cloud regions make the Kingdom one of the region’s most active technology markets.

Key figures

ICT market size in 2025, growing about 8% a year
SAR 199bn1
Operational data-centre capacity in the first quarter of 2026, up from 68 MW in 2021
467 MW2
Hyperscale cloud regions live or launching by end-2026 (Google, Microsoft, AWS)
33
  1. Communications, Space & Technology Commission, July 2026
  2. Ministry of Communications and IT, May 2026
  3. Microsoft; Amazon, 2026

What is driving demand

  • Government and enterprise digital transformation
  • AI infrastructure, with HUMAIN targeting 1.9 GW of capacity by 2030
  • Data-residency expectations that favour hosting in the Kingdom
  • Cybersecurity, driven by the National Cybersecurity Authority’s mandatory controls for government and critical infrastructure
  • Cloud migration to in-Kingdom regions

Who buys

  • Government entities through Etimad, with local-content weighting in IT services tenders from April 2027
  • Banks, telecom operators and state-owned enterprises
  • System integrators and resellers as channel partners

Typical entry route

Software and services firms often start with a channel or system-integrator partner, then add local delivery and hosting as contracts grow and data-residency or local-content rules apply.

How we help

  1. 01

    Client introductions

    Government entities, banks, telecom operators and state-owned enterprises, each approached through the route it buys through.

  2. 02

    Channel partners

    System integrators and resellers vetted for the accounts, certifications and delivery capacity you need.

  3. 03

    Regulatory review

    What the NCA, SAMA, CST and data-protection rules mean for your product, hosting and contracts.

Request a sector briefing

Watch for

  • NCA Essential Cybersecurity Controls (ECC-2:2024), mandatory for government and critical infrastructure and passed down to their vendors; SAMA’s Cyber Security Framework for banking clients
  • Personal Data Protection Law and data-residency requirements
  • Local-content weighting in government IT services tenders of SAR 10m+ from April 2027
  • 40% Saudization of consulting roles for advisory-heavy offers

FAQ

Common questions

Does our product need certification to sell to government?

There is no single certificate for software. But government entities and critical-infrastructure operators must meet the NCA’s Essential Cybersecurity Controls and pass them on to vendors; cloud services need registration with the Communications, Space and Technology Commission at the right data level; cybersecurity providers register with the NCA; and banks apply SAMA’s Cyber Security Framework to their suppliers.

Do we need to host data in Saudi Arabia?

Often, for government and regulated-sector clients. The Personal Data Protection Law and sector rules shape where and how you can host data.

What changes for IT tenders from 2027?

Local content becomes a weighted criterion in government IT services tenders of SAR 10m or more from 1 April 2027.

How do foreign technology firms usually sell?

Through system integrators, resellers or a local partner first, then directly once there is a pipeline to support a local team.

Sources for this page: Communications, Space & Technology Commission (July 2026) and its Cloud Computing Regulatory Framework; National Cybersecurity Authority, ECC-2:2024 and CCC-2:2024; SAMA Cyber Security Framework; Ministry of Communications and IT (May 2026).

Have an opportunity in mind, or looking for one?

Tell us your sector and ambition. Within one business day we will reply with an honest first view of where the opportunity is and, if it fits, a scope for an Opportunity Scan.

Discuss an opportunity