Saudi organisations are placing mission-critical data in cloud, hybrid-cloud and software-as-a-service environments while national regulation is tightening expectations for data protection, service continuity and cyber resilience. This review synthesises 2020-2025 literature and Saudi regulatory guidance to examine how cloud-based disaster recovery and business continuity can protect essential datasets in government, healthcare, finance, energy, logistics and digitally enabled small and medium enterprises. A structured narrative methodology was used to screen recent peer-reviewed articles, international standards and official Saudi control documents. The review finds that cloud continuity is most effective when recovery is treated as a socio-technical capability rather than a storage service. Important themes include shared accountability across service models, recovery objective engineering, sovereign data governance, automated failover, immutable backup, identity resilience, service-level evidence and continuity exercises. The paper proposes a Saudi-aligned reference model that integrates business impact analysis, multi-region architecture, regulatory mapping, contractual assurance and continuous testing. It contributes a practical research synthesis for scholars and practitioners by clarifying how organisations can balance cloud elasticity with local compliance, supplier concentration, cyberattack recovery and executive oversight. The review concludes that cloud-based recovery can reduce downtime and data loss, but only when governance, architecture and rehearsed operating procedures mature together.