Where Does My Data Go When I Modernize? PDPL, 90-Day Plan

When you modernize with AI, the tool reads your code and possibly database copies, usually in data centers outside the Kingdom. AWS Transform has no workspace region in the Middle East today per its Regions page, and the Saudi AWS region is due in December 2026 per the Saudi Press Agency. So before sending anything: separate code from personal data, send the minimum, and apply the Regulation on Personal Data Transfer outside the Kingdom to whatever leaves.

In part 6 you planned the move to the new system without stopping work. This final part answers the data question and turns the series exercises into a 90-day plan. For the basics of the law, see our practical PDPL guide.

What actually leaves your company during modernization

The word data hides 4 different things here, each with a different risk:

• The code itself: the software your developers wrote. It usually holds no customer data, but it may contain passwords written into it, your server addresses, or customer names in developers' comments.
• Copies of the database: needed for analysis and testing, and the most dangerous thing to send, because they hold customers' names, ID numbers and mobile numbers, and employees' salaries.
• Your questions and chats with the tool: whatever your team types into the chat window, where someone may paste a real record to explain a problem.
• The outputs: the new code, the documentation and the business rules you extracted in part 4, which describe how your company works from the inside.

The working rule: code is cleaned before it leaves, and real data leaves only when there is no alternative. In most conversion projects a masked copy is enough for testing, meaning data in which real names and numbers have been replaced with fake values of the same shape.

Where a tool like AWS Transform processes your data

We use AWS Transform as the example because Amazon has published the details, and the same questions apply to any other tool. What Amazon's official pages say today:

• Where it is stored: your data is kept in the Region where you created the workspace, according to the data protection page. The Regions page lists 11 Regions, including Frankfurt, London, Mumbai, Tokyo and Virginia, some for specific capabilities only, and none in the Middle East.
• Where it is processed: the cross-region processing page explains that the tool runs on Amazon Bedrock models and that requests and their results may be processed in another Region within the same geography; a request from Frankfurt, for example, may be processed in 6 European Regions. The same page announces that from 7 October 2026, chat requests originating in Mumbai and Seoul are routed across all commercial AWS Regions, while storage stays in the originating Region.
• Service improvement: Amazon says on its service improvement page that it may use your questions and the code the tool generates to improve the service, including model training, and that opting out is done through an AI services opt-out policy in AWS Organizations, set by your account administrator.

And the Saudi AWS Region expected in December 2026 does not automatically mean this tool will run from it. Open the Regions page yourself when your project starts; the list changes.

What the PDPL requires before data leaves

If personal data leaves the Kingdom, you are transferring it in the sense regulated by the Personal Data Protection Law and the transfer regulation, both published on SDAIA's National Data Governance Platform. What matters for a modernization project, in practical rather than legal language:

• The protection level in the receiving country: the competent authority publishes a list of countries that provide an adequate level of protection and reviews it every 4 years or when needed. Know where your data will be processed, then check the list.
• Alternative safeguards: in the exemption cases the regulation defines, the transfer is bound by appropriate safeguards, of which there are 3: standard contractual clauses, binding common rules within a group of companies, or an accreditation certificate for the receiving party.
• Risk assessment: the regulation requires the controller, meaning your company, to carry out a risk assessment before the transfer in the cases it specifies.
• Sensitive data: some exemption cases explicitly exclude sensitive data, such as health and personal financial data, so treat it with extra care.

The National Data Governance Platform offers practical services for this step, including a personal data processing impact assessment, a tool that tells you whether you must appoint a data protection officer, and a compliance self-assessment. We are a tech company, not a legal adviser, so take the transfer decision to your data protection officer or legal counsel. And if you are thinking of waiting for the local Region, we explained what really changes with it in A Cloud Region Inside the Kingdom.

6 questions to ask any tool or vendor before you send anything

1. In which Region is our data stored, and in which Regions may it be processed? Ask for the answer in writing with a link to the official page.
2. Are our questions or our code used to train models, and how do we stop that?
3. Can the analysis run on code only, without copies of the database?
4. Who on our team and on the vendor's team can access the workspace, and is every access logged?
5. When is our data deleted after the project ends, and how do we verify the deletion?
6. Can the sensitive stage run inside the Kingdom or on our own servers if needed?

If a vendor will not answer one of these in writing, that is an answer in itself. For the hosting options themselves, see our cloud migration guide.

A 90-day plan built from the series exercises

This plan does not modernize your system in 90 days. It gets you to a written decision and one pilot module ready for a parallel run, and it is built from the exercises of the six previous parts:

After day 90 you know what you did not know before: what you own, what is worth modernizing, and how AI tools behave with your own code rather than with vendors' examples. Only then does any talk of cost and duration rest on your reality.

The Origami view

We start modernization projects with the data map before the code map: what leaves, where to, and why. We prefer the analysis to run on cleaned code and masked data, and real data to stay inside your environment wherever possible, so that technical speed does not turn into a compliance problem later.

We use AI tools where they genuinely shorten the work, but the decision on what is sent to them stays yours, written and signed. To see how we work, take a look at our services.

Closing the series

We started 7 parts ago with one question: how do I modernize my legacy system with AI? The answer we reached is that AI speeds up reading, converting and testing, but the important decisions stay with the people who run the company: which system is worth it, which rule is right, who signs, and where the data goes. Your legacy systems kept the company running for years, and modernizing them calmly and with a plan is the best thing you can do for them. You will find every part of the series in the knowledge hub.

Sources

• Amazon: Supported Regions for AWS Transform — the Region list, with no Region in the Middle East.
• Amazon: Cross-region processing in AWS Transform — processing Regions and the 7 October 2026 change.
• Amazon: Data protection in AWS Transform — where data is stored.
• Amazon: AWS Transform service improvement — use of content for service improvement and how to opt out.
• Saudi Press Agency: AWS Region in Saudi Arabia in December 2026 — 1 September 2026.
• SDAIA, National Data Governance Platform: Personal Data Protection Law.
• SDAIA, National Data Governance Platform: Regulation on Personal Data Transfer outside the Kingdom — the country list, appropriate safeguards and risk assessment.
• National Data Governance Platform: services and tools.