Skip to main content
    DuVolks

    Sector guide / Saudi Arabia

    IT & Software Services.
    Build the business.
    Define the service.

    Software, cloud, telecom or cybersecurity: identify your activity, the authorities involved and the checks before delivery.

    Check operational licensesPlan my setup

    A planning guide—not an eligibility or licensing decision.

    01 / Your starting point

    Activity & ownership

    Software services, product resale and telecom operations are different activities.

    Foreign ownership

    Foreign-owned service businesses can use the applicable investment-registration route. Regulated telecom services have separate activity-specific conditions.

    Ownership routes

    Saudi / GCC ownership

    Follow the applicable formation route. MISA registration is not a blanket requirement for Saudi/GCC-only businesses.

    Company registration

    Capital & costs

    Plan capital around the selected activity, legal form and operating needs. This sector overview does not impose a blanket investment-registration minimum.

    Plan the first-year budget

    02 / Formation to delivery

    Setup route

    Identify operating approvals early. Complete each requirement at the stage set by the relevant authority. Check authorities & permits before committing.

    1. 01

      Activity & owners

      Choose the activities the company will actually carry out and the correct ownership route.

      Working towards

      Defined activities & ownership

      DuVolks

      Find an activity
    2. 02

      Investment registration

      For the foreign-investment route, complete the relevant MISA registration. Saudi/GCC-only routes follow their applicable formation process.

      Working towards

      MISA registration, where applicable

      MISA

      MISA guide
    3. 03

      Company formation

      Complete the company documents and commercial registration with the selected activities.

      Working towards

      Company documents & CR

      Saudi Business Center / Ministry of Commerce

      Registration guide
    4. 04

      Service readiness

      Complete any applicable CST permission and the data-protection/security requirements of the service.

      Working towards

      Applicable permissions & delivery controls

      CST / relevant authorities · NCA where applicable

      Check the authorities

    Sequence, not application progress. Approval scope and timing depend on your activity.

    03 / Operating checks

    Data, people & premises

    Licensing and ongoing compliance are separate checks.

    SDAIA / Data protection

    Personal data (PDPL)

    Identify your controller or processor role. Check the applicable privacy, security and cross-border transfer requirements.

    Check whether controller registration applies. This is data-protection compliance—not a general software business license.

    SDAIA data governance platform ↗

    Delivery scope

    Record what you host, where data is processed and which customer requirements apply. Confirm service-specific obligations before signing.

    Planning your operation

    Nitaqat (Saudization)

    Plan both your entity’s Nitaqat position and the rules for the jobs you will hire.

    The technology sector does not carry a blanket Saudization advantage. Check the actual Qiwa activity and each relevant profession.

    Your team & Saudization

    Nitaqat: your entity’s workforce

    Nitaqat assesses the entity’s workforce using its registered economic activity and employee figures. A broad sector name alone does not determine the required percentage. Use the Nitaqat planner with your Qiwa activity and workforce.

    Profession-specific Saudization

    Profession-specific Saudization is a separate check. The applicable decision may depend on the occupation, covered workforce, workplace and effective date. Meeting a Nitaqat band does not replace this check.

    Roles to check: IT, sales, accounting and administrative roles. These are prompts for your hiring plan, not a statement that every listed role has the same quota.

    Calculate my Nitaqat planCheck profession Saudization

    Use the tool’s scope, effective date and source notes. These links do not transfer or infer your activity, headcount or job codes.

    HRSD — Nitaqat calculator ↗HRSD — decisions and regulations ↗

    Baladi (Municipality) — Commercial Activity License

    Your exact activity and premises determine the requirements. Check the Balady activity record before leasing or fitting out.

    • Distinguish an ordinary software office from a data centre, repair workshop or licensed telecom facility.
    • Check the premises requirements for the actual use rather than applying a retail checklist to every technology business.
    Your premises & municipality requirements

    Check the premises requirements before signing a lease or starting fit-out.

    Planning prompts, not a complete activity-code licensing checklist. Confirm the exact requirements in Balady and with the relevant site authority. Area and room-size figures are not provided in this overview.

    Check the activity in Balady ↗Find my ISIC activity code

    In Balady, choose ISIC search, enter the activity code and select the detailed activity. This link opens the official lookup; it does not preselect a code or provide a live feed to this page.

    Formation & service requirements

    Company formation

    Investment registration, where applicable

    For the relevant foreign-investment ownership route; not a blanket requirement for Saudi/GCC-only businesses.

    Company formation

    Company formation and commercial registration

    Register the entity and the activities it will carry out.

    Before providing that service

    CST permission for a regulated service

    Match cloud, telecom or other regulated digital services to the appropriate licence, registration or permit.

    04 / Competent authorities

    Operational licenses & approvals

    Check the service before launch. These routes are not interchangeable, and more than one can apply.

    CST

    Software & IT consulting

    Tech enterprise registration

    For tech enterprises within CST’s scope.

    Check CST’s enterprise classification and registration service. This does not replace a service-specific operating permission.

    CST tech registration ↗
    CST

    Cloud services

    Cloud service provider registration

    When the service falls within the cloud-provider rules.

    Confirm the delivery model and registration category before launch. A “SaaS” label alone does not settle the regulatory scope.

    CST cloud registration ↗
    CST

    Telecom & connectivity

    Activity-specific license, permit or registration

    When providing a regulated telecom or digital service.

    Match the service and infrastructure to the applicable CST category. Company registration is not the operating permission.

    CST regulatory framework ↗
    NCA

    Cybersecurity services

    Provider registration / MSOC licensing

    For cybersecurity provision; managed SOC services have a separate licensing framework.

    Check provider registration and, for managed Security Operations Centre services, the relevant license tier and current application route.

    NCA registration & licensing ↗
    Registration ≠ blanket permission to operate.

    Confirm the exact service, customer category and infrastructure. CST enterprise registration and NCA provider registration do not substitute for a separately required operating license.

    CST: Communications, Space & Technology Commission · NCA: National Cybersecurity Authority. Selected routes, not an exhaustive licensing list.

    05 / Your next step

    Prepare your service brief

    Local reading aid only. Nothing is saved or sent.

    0 of 4 prompts reviewed

    DuVolks / Practical support

    Move from service idea to setup plan.

    We review the requirement and agree the support we can provide. Regulatory decisions remain with the authorities.

    Discuss my IT business

    06 / Official references

    Sources & scope

    Official sources & scope6 official references · review scope

    Base sector guidance: 5 October 2026.
    Targeted authority review: 14 October 2026.

    Planning overview, not a complete legal audit. Confirm current scope, application availability and requirements with the named authority.

    Discuss Your Structure