Proceeding from the Communications, Space and Technology Commission (CST) proficiency to regulate and monitor the information technology sector, in accordance with its amended regulation by Cabinet Resolution No. (133) dated 21/5/1424 AH, which entrusted CST with regulatory tasks for the information technology sector and affirmed by Clause (Seventh) of Cabinet Resolution No. (292) and dated 27/04/1441 AH the authority exercises these powers in order to achieve the objectives of regulating the sector, which are contained in Article (Two) of the Communications and Information Technology Ordinance (the Act), issued by Royal Decree No. (M, 106) dated 2/11/1443 AH, that include developing information technology and its infrastructure, encouraging digital transformation, urging the use of information technology and benefiting from it in all fields. In addition to providing an attractive environment for investment in information technology sector and attracting leading multinational companies in the priority areas of the sector.

As the information technology sector is currently undergoing rapid change, it requires the authority to adopt Data Center regulation (Regulation) that is detailed in this document. The Regulations aim is to enhance Data Center services in the Kingdom of Saudi Arabia (KSA) and provide regulatory transparency, which in turn will serve a number of digital investment areas, such as Cloud Computing Service Providers, digital content delivery networks and digital platforms, video streaming service operators and video game publishers.

By regulating Data Centers, CST aims to promote investment and create a fair competitive environment. In addition, the regulation will contribute to improve the quality of Data Center Services, protecting customers and beneficiaries, and optimizing the use of the infrastructure of the communications and information technology sector.

The terms and expressions defined in the Telecom Act and its Bylaw and all other CST regulations shall have the same meaning in this Regulation, unless otherwise required by context, the following terms and expressions shall have the meaning assigned to them hereunder:

2-1  “Data Center” is a dedicated building or space to centralized accommodation, interfaces, information technology operation and network communications equipment that provides data storage, processing, and transportation services, together with all facilities and infrastructure for energy distribution and environmental control, as well as all necessary levels of flexibility and safety required to provide the availability of the required service.

2-2 “Data Center Services” (or ‘Services’) means colocation services that include space, power, and cooling provided by Data Center Service Providers to Customers to host “co-locate” servers, network components, storage equipment etc.

2-3 “Data Center Service Provider” (or ‘Service Provider’) shall mean any entity which owns or rents, in whole or in part, a Data Center in the kingdom, and has direct or effective control over the Data Center in the Kingdom, and has direct or effective control over the Data Center, and aims to provide Data Center Services for others.

2-4 “Data Center Customer” (or ‘Customer’) shall mean anyone who acquires the Services from the Data Center Provider.

2-5 “Carrier Neutral Data Center” is a Data Center facility that enables any connectivity providers to provide network connectivity services to Customers inside and outside the Data Center without any discrimination between connectivity providers. Data Center that is connected to one connectivity provider is not a Carrier Neutral Data Center.

3-1 This regulation is for the wholesale or retail Data Centers Service Providers who offer Data Center Services to others in the Kingdom.

3-2 The provisions of these regulations apply to data centers – during all stages of their development – from which the services referred to in Clause (3-1) will be provided.

4-1   Service Providers shall register with the CST for each of this Data Centers from where it will be offering Data Center Services to Customers as per the categories described below and through CST electronic portal according to the scope of this Regulation and in accordance with the procedures set forth in the “Data Center Service Provider’s Guide” that is published on the CST’S website.

4-2 Data Center Registration for (Qualifying) category

4-2-1 This registration is for the entities that will develop a new data center for providing data center services to others.

4-2-2 The data center in the qualifying category has the right to request an upgrade to one of the two categories (Standard, Advanced) upon completion of the development of the data center and the readiness to provide services.

4-3 Data Center Registration for (Limited) category

4-3-1 Limited registration will be for Data Centers that are either Tier I certified, hold any Tier design certification only, do not have any certifications, or did not fulfill one of the requirements mentioned in Articles (4-4) or (4-5).

 4-3-2 The registration of the Data Center in the “Limited” category will be for existing Data Centers and will not be issued for new Data Centers that are being established or under construction after the date of approval of this regulation.

4-4 Data Center Registration for (Standard) category

4-4-1 Standard registration is for Tier II constructed certified Data Centers (by certificated recognized by CST)

4-4-2 The Data Center must be a Carrier Neutral Data Center.

4-4-3 Service Providers shall provide energy management and sustainability plans to reduce their energy consumption, carbon emissions and electronic waste.

4-5 Data Center Registration for (Advanced) category

4-5-1 Advanced registration is for Tier III or above constructed certified Data Centers (by certificated recognized by CST)

4-5-2 The Data Center must be a Carrier Neutral Center.

4-5-3 Service providers shall provide energy management and sustainability plans to reduce the energy consumption, carbon emissions and electronic waste.

5-1 The registration is valid for a period of three (3) Gregorian years from the date of its issuance.

5-2 The registration may be renewed for a similar period in accordance with the procedures specified in Article 4.

5-3 There is no fee for obtaining or renewing the registration.

6-1 Service Providers must keep their commercial registration, registration, certifications, and Data Center registration valid at all times.

6-2 Data Center Service provider under the classifications (Standard, and Advanced) shall enable other CST licensed connectivity providers to connect with the Data Center and ensure the Data Center is carrier Neutral Data Central without discrimination.

6-3 The Service Provider is obligated to provide the necessary physical security for the Data Center Facility, and ensure only authorized individuals are allowed to access.

6-4 Services Providers shall present, In advance, the financial fees for the services provided, their characteristics and the technical details of the Data Center with complete transparency to Customers and those interested (either current or new).

6-5 Service Providers are obligated, with respect to Service Level Agreements (SLA) and Quality Standards, to:

6-5-1 Provide Service Level Agreements (SLAs) to their Customers.

6-5-2 Notify Customers, upon request, of the actual level of achievement of any SLA convention requirements (if possible) for the last twelve (12) months or the period since the start of the Services contract, whichever is shorter.

6-5-3 Adhere to any rules or guidance issued by CST in relation to SLAs, business continuity disaster recovery and risk management for Data Centers.

6-6 Service Providers shall bear the responsibility in front of CST and its individual Customers for any damage occurred as a result of any acts or negligence by them, its agents, subcontractors, or employees (acting within the framework of their company, employment, or sub-contract with the Service Provider), incurring liability to such Customers under this clause or any other regulations in force in the KSA, irrespective of whether such acts or negligence occurred within or outside the KSA.

6-7 Service Providers are not entitled to vacate their contract liability towards their Customers for the losses and damages resulting from a lack of physical security or Data Center outages if such losses and damaged can logically be attributed, in whole or in part, to intentional acts, negligence or omission of the Service Provider, its agents, subcontractors or employees acting within the framework of their company, employment or sub-contract with the Service Provider.

6-8 Customers may agree to limit the liability of service providers from the Services mentioned in clauses (6-6, 6-7) in accordance with their signed contracts.

6-9 Service Providers must notify their Customers of any insurance coverage they have against any liability for their Customers to enable Customers to assess their exposure to risk and decide on their insurance coverage accordingly.

6-10 If, due to any reason, a Service Provider decides to shut down their Data Center, or decide to stop offering the Data Center Services to their Customers Permanently, the Service Provider must:

6-10-1 Notify both CST and their Customers, electronically and in writing, within fifteen (15) days of such decision.

6-10-2 Mutually agree with Customers to stop the Services by waiting at least three (3) months duration – Unless a shorter is period is agreed upon – so Customers can plan and migrate to other Data Center.

6-10-3 Force Majeure scenarios that are impossible to comply with all or some of the provisions of clause (6-10) are excluded.

7-1 If the Data Center Service Provider also provides Cloud Computing services -, it must register with CST as a Cloud Computing Service Provider according to the CST’s regulations, separately from its registration as a Data Center Service Provider.

7-2 If the Data Center Service Provider holds a license to provide a Telecommunications Service, the regulations related to Telecommunications Services shall apply to the data center services provided by him to the client who holds a license to provide Telecommunications Services.

7-3 Services Providers shall maintain accurate and updated information of their Data Centers such as space, power capacity (used and available), other connectivity providers, list of certifications etc with CST all the times.

7-4 Service Providers shall be obligated to provide CST with any reports or information requested.

7-5 Service Providers must cooperate fully with CST’s inspectors, facilitate the inspector to conduct an inspection, and make available the required  resources to carry out the inspection, CST has the right to appoint an independent auditor to conduct inspections, checks and controls on its behalf.

7-6 CST has the right to review the Service Provider’s registration compliance, when necessary, with the relevant regulations.

7-7 Data Center registration is not transferable to any other entity.

7-8 CST will have the right to reject any registration request, at its discretion if the relevant Service Provider does not sufficiently demonstrate that it meets the required minimum technical qualifications such as minimum required certifications, energy plans, proven experience, quality standards, financial resources, and other conditions defined in this Regulation.

7-9 In case of any non-compliance or violation of this Regulation, Service providers will be subject to the penalties and fines as per the regulations of CST. Including revoking or suspension of the registration or other appropriate penalties.

7-10 Data Centers Service provider shall abide by the laws, regulations, controls, decisions, rules and policies issued by the competent authorities in KSA.

7-11 The validity, interpretation, and construction of the Service Provider’s agreements with their Customers shall be governed by and constructed in accordance with laws of the KSA. Disputes shall be overseen by the courts of the KSA. If thirty (30) days have passed without any settlement, then the concerned party shall refer the dispute to the relevant court in the KSA to oversee the matter.

7-12 The Arabic version is the official language in the interpretation and implementation of this regulation. English language may be used to implement this Regulation or part of it. In case there is any conflict in interpretations, the Arabic version shall prevail.