LMS in Saudi Arabia: a guide for companies and training centers

What companies and training centers in Saudi Arabia need from an LMS today

Training in Saudi Arabia sits inside a national plan. The Human Capability Development Program, one of the Vision 2030 programs, has three pillars: a strong educational base for everyone, preparing for the future labor market at home and abroad, and lifelong learning. Its 2021–2025 delivery plan asks the private sector to help upskill and reskill citizens who have finished their education. For a corporate academy in KSA, that means more training, measured more closely.

Training centers face a second pressure: regulators who check. Private providers are licensed by the Technical and Vocational Training Corporation (TVTC), and online delivery falls under the National eLearning Center (NELC). Both expect records, not promises.

Put together, a Saudi buyer usually needs an LMS that works fully in Arabic, keeps evidence a regulator or funder will accept, handles personal data under Saudi law, and runs both self-paced and live training for staff or for client companies.

The rules for training in Saudi Arabia, and where a platform fits

NELC’s eLearning Regulation applies to every government, private and non-profit body that runs eLearning or training in the Kingdom (Article 3). Its Implementing Rules say any entity that delivers eLearning and grants completion certificates must hold the required licences before it starts (Article 7). Article 9 lists four conditions, including technical integration and data sharing with FutureX, the National eLearning Platform.

TVTC’s FAQ, last updated in 2023, says it will not issue a licence for e-training only: a provider first needs a TVTC training licence with its programs activated. In March 2026 NELC announced unified licensing with TVTC. From May 2026, private-sector providers get program licences from TVTC once their FutureX integration is complete. The announcement is short, so confirm how it applies to you with both bodies.

TVTC also publishes what it finds. In the first nine months of 2025 it issued 350 new licences and recorded 427 violations at private training institutions. The common ones include changing an approved program’s content or hours and tampering with registered data or results. A platform can’t hold your licence. It can keep the dated versions, attendance and results that show you ran what was approved.

Data protection and hosting under the PDPL

Saudi Arabia’s Personal Data Protection Law came into force on 14 September 2023, with a one-year grace period to 14 September 2024, according to SDAIA. It covers processing in the Kingdom and processing of residents’ data from abroad. When an LMS vendor processes learner data for you, you usually stay the controller, and Article 8 says you may only choose processors that give the necessary guarantees.

The law does not ban transfers abroad outright. Article 29 allows them for set purposes and under conditions, including an adequate level of protection and only the minimum data needed. Your sector may ask for more. The NCA’s Essential Cybersecurity Controls (ECC-2:2024) apply to government agencies and their companies, and to private entities that own, operate or host critical national infrastructure. Their cloud and hosting controls bind those entities when they use cloud services.

These rules may change soon. In October 2026 SDAIA put draft amendments to the Implementing Regulation out for comment, until 5 November 2026. Law firm Clyde & Co reports that they would require personal data to be stored in the Kingdom, with transfers still allowed under the law, and 72-hour notice of every breach. They are drafts as of 19 October 2026, so check the final text before you sign.

Classbase’s hosting region is confirmed during the demo, before anything is agreed. Whoever you talk to, ask these questions:

• In which country and data center is learner data stored, and where are backups kept?
• Which sub-processors can see the data, including AI model providers, and from where?
• How fast will you tell us about a breach? Today the controller must tell SDAIA within 72 hours when a breach may harm learners.
• Can we find and export one learner’s full record quickly, to answer a request within 30 days?
• Will you sign a data processing agreement that names the region and the sub-processors?

Arabic first, and other local fit

Many vendors list Arabic. Fewer get it right everywhere. Switch the interface to Arabic and check the player, admin screens, emails, certificates and exported reports. A translated menu on a left-to-right page is not Arabic support. Then type a course title that mixes Arabic with an English product name and a number, and see how it looks on a certificate.

Decide on numerals too. The W3C notes that Arabic-Indic digits (٠–٩) are used in eastern Arabic-speaking countries such as Saudi Arabia. Pick one style for certificates, scores and reports, and check the system keeps to it. If your documents use Hijri dates, ask to see them live in the demo rather than on a slide. If you train in Arabic and English side by side, ask for certificates in both languages on one page.

Running and reporting HRDF-supported programs

The Human Resources Development Fund (HRDF, or Hadaf) funds training; it does not license providers. Its Strategic Partnership Institutes product, for example, trains and hires job seekers in scarce specialisms through TVTC-licensed training entities. HRDF covers 75% of training costs, up to SAR 3,000 per employee a month for up to 24 months. Rates change, so check the product page on hrdf.org.sa before you budget.

Two habits keep a claim safe. First, get the support request approved before the first session: HRDF says it is not obligated to support anything before the request is processed. Second, record attendance and results as you go. HRDF doesn’t publish one checklist for every product, but a claim is easier to defend with the approved request, the program as delivered, attendance per session, results, certificates and matching invoices on file for each trainee.

Buying an LMS in Saudi Arabia: tender words and a checklist

Government entities buy through Etimad, the Ministry of Finance platform where tenders are offered, bids examined and contracts awarded. A tender is a munafasa (منافسة), and its requirements sit in the terms and specifications booklet (كراسة الشروط والمواصفات). Private companies often borrow the same shape for an RFP. Whatever the route, put these points in your requirements:

How Classbase is designed to help

Classbase is an LMS and LXP built around AI agents, for training centers and corporate academies. Its interface is complete in Arabic, fully right to left, as well as English and Turkish. Certificates come in one or two languages, with a code and QR anyone can verify. Live sessions run on Zoom, Teams or Meet, with check-in codes and attendance that counts toward completion. Reports export as CSV for a client or a claim.

A training center can run each client company as its own organization, so Harbour Logistics never sees another client. Classbase imports SCORM 1.2 and 2004, works with LTI 1.3, sends xAPI to your record store, and supports SSO with OIDC or SAML plus SCIM. You decide what the AI may do, and every action is in the activity log.

Be clear on what it isn’t. Classbase holds no NELC or TVTC licence and doesn’t give you one, and we don’t claim an official FutureX or HRDF integration. It is designed to keep the records those bodies ask for. We are building the rest step by step, and in the demo we say what is ready today. Book a demo with one of your own Arabic courses, and we’ll show you a group’s full record and confirm hosting.