Do National Data Laws Carry Cyber-Risks for Large Orgs?

National data localisation laws are not just compliance headaches for multinationals; they may also widen cybersecurity gaps as data flows cross borders. The piece notes that China enacted such a rule in 2017 and the EU followed in 2018, with other economies including India, Russia, Saudi Arabia, and Nigeria adopting similar approaches, raising the stakes for organisations operating in multiple jurisdictions.

It highlights that parallel, locally compliant IT systems—such as Alibaba’s Saudi Cloud Computing Company platforms for international versus Chinese users—can become a recipe for cyber risk if contracts, data flows, and audit rights are not tightly managed. At Black Hat Middle East and Africa in Riyadh, Ismail Ahmed, CEO and founder of Yalla Hack, argues that nationalist data laws can create compliance and cyber vulnerabilities, including unmonitored data flows and backdoors through ambiguous agreements.

The author, Nate Nelson, frames the discussion around a proposed dual-jurisdiction assurance and compliance model (DJAC) to audit conflicts, enforce data-flow transparency, and build resilience against geopolitical and regulatory misalignment, stressing that the real threat may lie in the contracts that govern data. November 19, 2025.