Digital Economy Soundbite | Saudi Arabia's Bold Move: Data Embassies and the Future of AI

Saudi Arabia's draft Global AI Hub Law is the first legal framework to govern sovereign data centres or "data embassies" allowing foreign countries to host data within Saudi Arabia, but under their own jurisdictions.  Like traditional embassies, data embassies would be considered part of the originating country's territory and subject to its laws. This aims to address data sovereignty concerns, and is part of Saudi Arabia's drive to establish itself as a global AI hub - but how practical is it?

Retaining the home country's jurisdiction would potentially alleviate worries about data transfer abroad. However, its effectiveness depends on strong international agreements and the host nation's commitment to respecting these legal boundaries. Ensuring the security of data embassies is crucial, requiring robust cybersecurity and physical security measures, and close cooperation between host and originating countries.  It also raises questions about the applicability of sector-specific regulation from the home jurisdiction – for example, where a bank outsources a critical function. 

Geopolitical factors cannot be ignored. The stability of the host country, its infrastructure, the availability of resources and climate conditions could impact the viability of data embassies. Unstable regimes, scarcity of technology or bandwidth, or the likelihood of natural disasters could stand in the way of setting up data embassies and might pose significant risks to data security.

While data embassies present an intriguing solution to data sovereignty, their success hinges on robust international agreements, stringent security measures, and careful consideration of geopolitical factors.

Authors: Fiona Ghosh, Partner; Patricia Wade, Expertise Counsel; Anya Brown, Trainee