Saudi Arabia: AI, privacy and software law

AI law1 instrument, 1 in force

Research summary (139 words)

Saudi Arabia has no AI-specific statute.

The Saudi Data and AI Authority (SDAIA) publishes a set of policy documents addressing AI, including Principles and Controls of AI Ethics, described on SDAIA's own page as a draft, an AI Adoption Framework described as a guiding reference for AI adoption across sectors, Generative AI Guidelines for government employees and for the public, and a document on mitigating deepfake risks; SDAIA's own description characterizes each as a guideline, framework, or draft rather than as an enacted instrument.

No AI-training-specific transparency, risk-obligation, prohibited-practice or governance duty of general application enacted as law was located. The Control Requirements of the Saudi Central Bank's Counter-Fraud Framework, October 2022, Version 1.0, include that a counter-fraud system that uses Machine Learning or Artificial Intelligence should not be a black box and should be capable of being audited.

AI sector rules

Counter-Fraud Framework: fraud detection systems, machine learning and artificial intelligence

SAMA Counter-Fraud FrameworkText of the Counter-Fraud Framework, October 2022, Version 1.0, published by the Saudi Central Bank (SAMA)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived December 1, 2022. Publisher's page: https://www.sama.gov.sa/en-US/RulesInstructions/CyberSecurity/Counter_Fraud_Framework.pdf

In force. Binds private bodies.

What this law does

The Counter-Fraud Framework of the Saudi Central Bank (SAMA), October 2022, Version 1.0, defines Principles and Control Requirements for initiating, implementing, maintaining, monitoring, and improving Counter-Fraud controls within Member Organisations regulated by SAMA. The Framework defines a Member Organisation as all financial institutions or financial services providers regulated by SAMA.

The Framework is applicable to all Member Organisations operating in Saudi Arabia based on SAMA discretion, and Member Organisations required to implement and comply with it are notified by SAMA. The Framework states that it is mandated by SAMA and will be circulated to Member Organisations for implementation, and that the Member Organisations are responsible for implementing and complying with it.

The Control Requirements reflect the mandated Counter-Fraud controls that Member Organisations should consider when designing and implementing a Counter-Fraud Programme. When a Control Requirement cannot be implemented, a Member Organisation should follow an exception process that ends in a request to SAMA for a formal waiver, and approval of waiver requests is at the discretion of SAMA.

Implementation of the Framework at Member Organisations is subject to a periodic self-assessment based on a questionnaire, and SAMA reviews and audits the self-assessments to determine the level of compliance with the Framework and the Counter-Fraud maturity level of the Member Organisation. Member Organisations should at least operate at Counter-Fraud maturity level 3 or higher, which includes implementing fraud detection system capability to prevent and proactively detect fraud.

The Framework asks that a counter-fraud system that uses Machine Learning or Artificial Intelligence not be a black box and be capable of being audited, with the organisation able to test what the algorithms are designed to do and whether they are correctly implemented. The Framework defines a Black Box System as a complex system where the internal rules and mechanisms are not visible to or understood by the system owner.

The Framework defines Artificial Intelligence as the use of computer systems to perform tasks typically requiring human knowledge and logical capabilities, often in problem solving scenarios. Where the inherent risk of fraud is assessed as higher, the fraud detection standards should require additional detection controls, for example real time monitoring, additional data sources or Machine Learning models, or more stringent detection threshold criteria.

Fraud detection systems should operate 24/7 with appropriate resources in place to manage outputs on a timely basis.

Where a higher risk of fraud is identified in the Fraud Risk Assessment or higher incidences of fraud occur, Member Organisations should additionally implement system capability that includes overlaying Artificial Intelligence and Machine Learning algorithms, for example decision trees, random forests and neural networks, to enhance system decision making capability, predict the likelihood of fraud and learn from historical patterns of fraudulent and legitimate behavior.

Where a deviation from the baselined user behavior patterns is identified, a Member Organisation should either require further authentication of the user or the user's instructions, or generate an alert for further investigation to determine whether fraud has occurred.

Member Organisations should calibrate and test detection scenarios to validate that they work as designed, for example through rule logic review, threshold testing and precision and recall testing, and should implement feedback loops that review false positives, false negatives and alerts which identified fraud. Article 4 of the Saudi Central Bank Law lists, among the tasks the Bank performs, issuing the regulations and instructions relating to financial institutions and their business.

The Banking Control Law defines a bank as any natural or legal person who primarily engages in any banking business in the Kingdom.

Article 22 of the Banking Control Law provides that SAMA may, if it is established that a bank has violated any of the Law's provisions or the rules and resolutions issued for its implementation, take measures that include suspending or dismissing any of the bank's board members or staff and prohibiting the bank from extending loans or receiving deposits, on the approval of the Minister of Finance and National Economy.

Article 23 of the Banking Control Law punishes a person who violates any of the other provisions of the Law or the rules and resolutions issued for its implementation by a fine not exceeding 5,000 riyals.

What it requires

Privacy law7 instruments, 7 in force

Research summary (237 words)

Saudi Arabia's Personal Data Protection Law (Royal Decree No. M/19 of 9/2/1443H, 16 September 2021) is a three-instrument regime, all read at primary source directly from SDAIA's own document library, untruncated: the Law itself, Implementing Regulations that carry the operative consent-mechanics and destruction-duty detail, and a standalone Regulation on Personal Data Transfer Outside the Kingdom.

The Law folds biometric data directly into its Sensitive Data definition (Art. 1(11): "biometric or Genetic Data for the purpose of identifying the person"), with no separate "Biometric Data" definition and no worked example list, so a service creating an identity-linked voiceprint or faceprint needs the Data Subject's explicit consent under the Implementing Regulations.

The SDAIA-served text of the Law does not carry an amendment-history header in the pages read, so it is treated here as SDAIA's current, live consolidated text rather than an independently diffed 2021-versus-2023 comparison.

Cross-border transfer is gated by a national-security-plus-adequacy-plus-minimization structure (Law Art. 29), operationalized by the Regulation on Personal Data Transfer Outside the Kingdom (August 2024 version), the strictest posture read across the Gulf jurisdictions in this batch.

Enforcement is dual-track: criminal prosecution for unlawful disclosure of Sensitive Data and administrative fines for other violations, and Article 40 adds a civil route to compensation for a person who suffers damage from a violation. The Implementing Regulations require a Controller to act on a Data Subject's request to exercise a right under the Law within 30 days.

Breach notification

Personal Data Protection Law, breach notification

Royal Decree No. M/19, Art. 20; Implementing Regulations Art. 24(1)official statute text, SDAIA document library

In force since 14 Sep 2023. Binds public and private bodies.

What this law does

Art. 20 requires the Controller to notify the Competent Authority upon knowing of any breach, damage, or illegal access to personal data, in accordance with the Implementing Regulations, and separately to notify the Data Subject of any breach that would cause damage to their data or prejudice their rights and interests.

The Law itself states no fixed notification window; Implementing Regulations Article 24(1) sets it at a delay not exceeding 72 hours of becoming aware of the incident, where the incident potentially causes harm to the Personal Data, to the Data Subject, or to their rights or interests.

What it requires

Comprehensive regime

Implementing Regulations, record of processing activities, breach report copies and request records

Implementing Regulations of the Personal Data Protection Law, Arts. 3(1)(d), 24(3), 33official SDAIA document library, Implementing Regulations of the Personal Data Protection Law (official English text)

In force since 14 Sep 2023. Binds public and private bodies.

What this law does

Article 33 requires the controller to keep a record of personal data processing activities during all the period the data is processed and until five years after the end of any processing activity, in writing and accurate and up to date, and to give the Competent Authority access to it on request.

The record includes, at a minimum, the controller's name and contact details, the data protection officer where required, the purposes of the processing, the categories of data and of data subjects, retention periods where possible, the categories of recipients, a description of transfers outside the Kingdom and the security measures where possible.

Article 24(3) requires the controller to keep a copy of the reports it submits to the Competent Authority about a personal data breach and to document the corrective measures taken and any relevant documents or supporting evidence. Article 3(1)(d) requires the controller to take the necessary measures to document and keep a record of all data subject requests it receives, including oral requests.

What it requires

Personal Data Protection Law, comprehensive regime and lawful basis

Royal Decree M/19 (9/2/1443H, 16 September 2021), comprehensive regime; Implementing Regulations Arts. 4, 11-12official statute and Implementing Regulations text, SDAIA document library

In force since 14 Sep 2023. Binds public and private bodies.

What this law does

The Personal Data Protection Law is Saudi Arabia's comprehensive personal-data statute, with the Implementing Regulations supplying the operative consent-mechanics detail (Arts. 4, 11-12).

Consent is the default lawful basis (Article 5), and Article 6 lists four cases in which processing needs no consent: processing that serves the actual interests of the Data Subject where communicating with them is impossible or difficult, processing under another law or in implementation of a previous agreement with the Data Subject, processing by a Public Entity for security purposes or to satisfy judicial requirements, and processing necessary for the legitimate interest of the Controller provided no Sensitive Data is processed.

A Controller/Processor structure is present. The Competent Authority is the authority to be determined by a resolution of the Council of Ministers (Article 1(3)), and the Law's supervision provision leaves in place the powers of the Saudi Central Bank under other legal provisions.

What it requires

Cross border transfer

Personal Data Protection Law, cross-border transfer

Royal Decree No. M/19, Art. 29; Regulation on Personal Data Transfer Outside the Kingdomofficial statute and Transfer Regulation text, SDAIA document library

In force since 14 Sep 2023. Binds public and private bodies.

What this law does

Law Art. 29 permits a Controller to transfer personal data outside the Kingdom only for one of four enumerated purposes (international-agreement obligation, Kingdom interests, a Data Subject's own contractual obligation, or a Regulations-specified purpose), and only where the transfer does not prejudice national security or Kingdom vital interests, an adequate level of protection at least equivalent to the Law's own applies per a Competent Authority assessment, and the transfer is limited to the minimum data needed.

The standalone Regulation on Personal Data Transfer Outside the Kingdom operationalizes this with defined "Appropriate Safeguards" the competent authority may impose where an exemption from the adequacy requirement is granted, and an "Operational Processes" basis for data tied to a controller's own internal operations.

No provision compelling in-Kingdom data storage as a default rule was found; this is a multi-factor national-security-and-adequacy gate rather than either a blanket ban or an open transfer policy, more restrictive in structure than the UAE's or Jordan's equivalent provisions in this batch.

The original sdaia.gov.sa path for the Regulation 404s; it is now served from SDAIA's Digital Government Platform, and the "Appropriate Safeguards" and "Operational Processes" quotations above are confirmed against that working URL.

What it requires

Data subject rights

Personal Data Protection Law, data subject rights

Personal Data Protection Law (Royal Decree No. M/19), Arts. 4 and 9; Implementing Regulations Arts. 3(1)(a)-(c), 5-8official statute and Implementing Regulations text, SDAIA document library

In force. Binds public and private bodies.

What this law does

Article 4 of the Law gives a Data Subject five rights against the Controller: to be informed of the legal basis and purpose of collection, to access their Personal Data, to request a copy in a readable and clear format, to request correction, completion or update, and to request destruction when the data is no longer needed.

The Implementing Regulations require the Controller to act on a request within 30 days and allow an extension of up to 30 more days where the request needs disproportionate effort or the Data Subject has made multiple requests, if the Data Subject is told the reasons in advance (Art. 3(1)(a)).

The Controller must also verify the requester's identity before acting (Art. 3(1)(c)), and may refuse a request that is repetitive, manifestly unfounded or needs disproportionate effort, giving the Data Subject its reason (Art. 3(2)). Article 8(1) requires destruction of Personal Data on the Data Subject's request, when it is no longer necessary for the purpose of collection, when consent is withdrawn and was the sole basis, or when the data was unlawfully processed.

What it requires

Enforcement supervision

Personal Data Protection Law, enforcement and penalties

Royal Decree No. M/19, Arts. 35-36, 40official statute text, SDAIA document library

In force since 14 Sep 2023. Binds public and private bodies.

What this law does

Art. 35 imposes criminal penalties, imprisonment up to two years or a fine up to SAR 3,000,000, or both, doubled on recidivism, on any individual who discloses or publishes Sensitive Data (including identifying biometric data) with intent to harm the Data Subject or gain personal benefit, prosecuted by the Public Prosecution before the competent court. Art. 36 sets administrative fines up to SAR 5,000,000, doubled on repeat violation, for other violations.

Article 40 separately lets any individual who suffers damage as a result of a violation of the Law or the Regulations apply to a competent court for proportionate compensation for the material or moral damage.

What it requires

Sensitive categories

Personal Data Protection Law, sensitive data categories and processing

Royal Decree No. M/19, Art. 1(11); Implementing Regulations Arts. 8, 11(2)(a)official statute and Implementing Regulations text, SDAIA document library

In force since 14 Sep 2023. Binds public and private bodies.

What this law does

Art. 1(11) defines Sensitive Data as Personal Data revealing racial or ethnic origin, or religious, intellectual or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual's parents are unknown; biometric data enters through the identification-purpose clause, with no standalone "Biometric Data" term and no worked-example list, unlike the UAE, Oman, and ADGM statutes.

Implementing Regulations Art. 11(2)(a) requires explicit consent whenever processing involves Sensitive Data, reaching identifying biometric data by the Art. 1(11) definition. No modality-specific (voice or face) language was found.

Implementing Regulations Art. 8 requires the Controller to destroy Personal Data on enumerated grounds (purpose fulfilled, consent withdrawn), notifying every party the data was disclosed to and destroying all system copies; this is the general destruction duty applying to biometric data as Sensitive Data, with no biometric-specific retention ceiling found.

What it requires

Scraping law7 instruments, 5 in force, 2 no longer in force

Research summary (817 words)

Saudi Arabia has no scraping-specific statute, so general law governs each dimension separately. The Anti-Cyber Crime Law (Royal Decree No. M/17, 8 Rabi I 1428H, 26 March 2007) punishes unlawful access to a web site in Art. 3(3) without requiring any further intention, and Art. 1(7) defines unauthorized access as the deliberate access by any person to computers, websites, information systems or networks that the person is not authorized to enter.

The Law has no security-measure element and no exception for a page open to everyone, and no provision or reported Saudi decision says whether reading a public, unauthenticated page is unauthorized.

The Law's other access offences pair access with a further intention or purpose: to threaten or blackmail (Art. 3(2)), to obtain funds, services or information through access to bank, credit or securities-ownership data (Art. 4(2)), to delete, leak, damage, alter or redistribute private data (Art. 5(1)), or to obtain data jeopardizing the security of the State or its national economy (Art. 7(2)). Art. 5(2) and (3) separately punish halting a network or obstructing a service.

The Copyright Law published in the Official Gazette (Umm Al-Qura) on 13 February 2026 replaces the Copyright Protection Law issued by Royal Decree No. M/41 (Art. 59) and takes effect 180 days after its publication in the Gazette (Art. 61), which is 12 August 2026 counting from the publication date.

Art. 26(4) permits copying a work without the author's permission or compensation to develop artificial intelligence products and algorithms, where the work was lawfully published, the copy was lawfully acquired and the copying stays within what the purpose needs. The exception carries no rights-holder reservation, so the Law recognizes no opt-out mechanism, robots.txt included, and a robots.txt directive has no legal weight.

The Implementing Regulation, dated 31 July 2026, adds conditions in its Art. 30: no republishing, distributing or direct commercial exploitation of the work; no use in a purely commercial framework unless the use is non-essential to the work or does not affect its normal exploitation; records of each work's type, source, purpose and date of use for any authority hearing a dispute; and no altering, republishing, making available or unnecessary embedding of the work in final products without permission, unless it is in the public domain.

Art. 37(1) of the Law applies the normal-exploitation and legitimate-interest limits to every exception in Arts. 26 to 36.

The Law protects a database only where its selection or arrangement is original, and the protection does not extend to the data or materials themselves (Art. 3(12)); it creates no separate database right. The superseded Law likewise protected a database only where its selection or arrangement was creative, and its twelve exceptions in Art. 15 did not extend to AI development.

Art. 47(5) makes circumventing, without justification, a technical protection measure that a rights holder uses to protect rights in a work an offence punishable by up to one year's imprisonment and a fine of up to one million riyals, or either. A CAPTCHA, IP block or rate limit falls within it only if it protects rights in a work, whereas the access offence above applies either way.

Art. 12 binds the buyer or user of software, applications and databases to the licence accompanying them unless its terms are contrary to public order or morals, and Regulation Art. 29 gives no effect to a licence term that waives statutory rights or restricts use the exceptions allow. Neither provision mentions a website's terms of use as such, though Regulation Art. 29 reaches databases available over networks.

The Civil Transactions Law (Royal Decree No. M/191) lets offer and acceptance be expressed by any means, explicitly or implicitly (Art. 33), and does not treat an offeree's silence as acceptance unless an agreement or presumptive evidence of acceptance exists, with narrow exceptions for prior dealings and for offers made for the offeree's sole benefit (Art. 37).

The Electronic Transactions Law (26 March 2007) deems a contract concluded by electronic means valid and enforceable if concluded in accordance with its provisions (Art. 10). Terms a crawler actively agrees to therefore bind it, while terms posted only behind a link bind a crawler only where its conduct shows it accepted terms it had notice of.

Saudi law has no separate trespass-to-chattels doctrine; harm to a site's systems falls under the general rule that a fault causing harm entails compensation (Civil Transactions Law Art. 120).

The Personal Data Protection Law (Royal Decree No. M/19, 2021) does not exempt publicly available personal data from its scope, but Arts. 10 and 15 both list a Data Subject's personal data already being publicly available, or having been collected from a publicly available source, as one of several grounds on which a Controller may collect, repurpose, or disclose it without the Data Subject's consent; data collected on this ground remains subject to the Law's other duties (purpose limitation, security, breach notification, data subject rights).

Contract terms of service (ToS)

Copyright Law (2026), licence terms for software, applications and databases

Royal Decree No. M/169 (14/8/1447H), Art. 12 and Implementing Regulation Art. 29, Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 12 subjects computer programs, applications and databases to the licence accompanying or affixed to them, whether it appears on the carrying medium, on downloading the program or on storing it in the computer. It binds the buyer or user to the licence's terms unless they are contrary to public order or morals. The Implementing Regulation's Article 29 applies to programs, applications and databases installed on a user's device or available over networks or cloud services.

It treats the user's agreement to licence terms that appear electronically at download, installation or operation as binding. It gives no effect to a licence term that waives rights the Law and Regulation confer or restricts use the statutory exceptions allow.

What it requires

Copyright and text and data mining (TDM)

Copyright Law (2026), circumventing technical protection measures

Royal Decree No. M/169 (14/8/1447H), Art. 47(5), Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 47(5) makes it an offence to circumvent, without justification, the technical protection measures that rights holders use to protect the rights in their works, performances, sound recordings or broadcast programmes under the Law. Article 47 punishes each listed offence with imprisonment of up to one year, a fine of up to one million riyals, or either, without prejudice to any heavier penalty another law sets.

What it requires

Copyright Law (2026), copying to develop artificial intelligence products and algorithms

Royal Decree No. M/169 (14/8/1447H), Art. 26(4) and Implementing Regulation Art. 30, Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 26(4) lets a person copy the original of a work, without the author's permission and without compensation, to develop artificial intelligence products and algorithms, provided the work was lawfully published, the copy was lawfully acquired and the copying stays within what the purpose needs. Article 37(1) requires every use under Articles 26 to 36 not to conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders.

The Implementing Regulation requires the copying and analysis not to extend to republishing, distributing or directly exploiting the work commercially. It bars use of the work in a purely commercial framework unless the use is non-essential to the work or does not affect its normal exploitation. It requires the developer to keep records of the type, source, purpose and date of each use and to give them to any competent authority hearing a dispute.

It bars altering, republishing, making available or unnecessarily embedding the work in final products without the rights holder's permission unless the work is in the public domain. Under Article 60 of the Law the Regulation applies from the Law's own commencement.

What it requires

Copyright Law, exceptions article and absence of a text-and-data-mining exception

Royal Decree No. M/41, Art. 15 exceptions, no text-and-data-mining exception (2 Rajab 1424H, 30 August 2003)official Copyright Law text, WIPO Lex consolidated version

Binds public and private bodies.

What this law does

Article 15 lists twelve enumerated uses of a copyrighted work that are lawful without the copyright owner's permission. The first of them is personal use, excluding computer software and audio-visual works; others include quotation with attribution and educational use. The Copyright Law published in the Official Gazette on 13 February 2026 replaces this Law under its Article 59.

What it requires

Database right

Copyright Law (2026), database compilations

Royal Decree No. M/169 (14/8/1447H), Art. 3(12), Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 3(12) protects collections of works and cultural heritage, such as encyclopedias, anthologies and databases, that are original in the selection or arrangement of their contents. The protection does not extend to the data or materials themselves, and it does not affect the rights of authors in the data and materials that form part of the collection, whether machine-readable or in another form.

What it requires

Copyright Law, database compilations and absence of a sui generis right

Royal Decree No. M/41, Art. 3(5) database compilations, no sui generis right (2 Rajab 1424H, 30 August 2003)official Copyright Law text, WIPO Lex consolidated version

Binds public and private bodies.

What this law does

Article 3(5) protects a database, whether mechanically readable or readable in any other manner, as a derived work only where it is creative as to the selection or arrangement of its contents, the same creativity-based standard the article applies to encyclopedias, anthologies, and folklore compilations. The Copyright Law published in the Official Gazette on 13 February 2026 replaces this Law under its Article 59.

What it requires

Personal data

Personal Data Protection Law, publicly available source ground

Royal Decree No. M/19, Arts. 10, 15 publicly available source ground (9/2/1443H, 16 September 2021)official Personal Data Protection Law text, SDAIA document library

In force since 14 Sep 2023. Binds public and private bodies.

What this law does

The Personal Data Protection Law does not exempt publicly available personal data from its scope. Article 10 lists the Personal Data already being publicly available, or having been collected from a publicly available source, as one of several grounds on which a Controller may collect it from a source other than the Data Subject or repurpose it without the Data Subject's consent. Article 15 lists the same ground for disclosing Personal Data.

Personal data scraped from a publicly available Saudi source therefore does not need the Data Subject's consent on this specific ground, but it remains subject to the Law's other duties, including purpose limitation, accuracy, security, breach notification, and the Data Subject's rights. Article 43 provides that the Law comes into force 720 days after its Official Gazette publication date.

What it requires

Cybersecurity law2 instruments, 2 in force

Research summary (1,245 words)

Saudi Arabia's cybersecurity regulator, the National Cybersecurity Authority (NCA), was established under Royal Order No. 55775 of 23/8/2017, with its Statute issued by Royal Order No. 6801 of 31/10/2017 (amended by Royal Order No. 7053 of 09/09/2021), giving the NCA a public legal personality, financial and administrative independence, and a direct report to the King.

High Order No. 57231 (dated 10/11/1439H, cited as a 'High Order' in some NCA translations and a 'Royal Decree' in others) states that all government agencies must raise the level of their cybersecurity and abide by the NCA's policies, frameworks, standards, controls and guidelines, and Article 10(3) of the NCA's Statute obliges every entity within a control document's own stated scope to take the necessary measures for ongoing, continuous compliance.

On that basis the NCA has issued a family of binding controls documents, each carrying its own 'Scope of Work and Applicability' section stating who it binds.

The Essential Cybersecurity Controls (ECC, now ECC-2:2024, superseding ECC-1:2018, with 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols) states it 'is applicable to government agencies in the Kingdom of Saudi Arabia (including ministries, authorities, establishments and others) and their affiliated companies and entities (inside and outside the kingdom), as well as all private sector entities owning, operating, or hosting Critical National Infrastructures (CNIs)', with every other entity in the Kingdom only 'strongly encouraged' to adopt the same controls as best practice.

The Organizations' Social Media Accounts Cybersecurity Controls (OSMACC-1:2021) and the Telework Cybersecurity Controls (TCC) each bind the same two classes in their own words, government organizations (and their affiliated companies) plus private-sector organizations that own, operate or host critical or sensitive national infrastructure, for an organization that respectively uses social media accounts or permits telework.

The Cloud Cybersecurity Controls (CCC, now CCC-2:2024, superseding CCC-1:2020) narrows this further on the provider side: a Cloud Service Provider (CSP) is inside scope only when it serves a Cloud Service Tenant (CST) that is itself a government entity or a CNI operator, and the document lists as an example outside its own scope a CSP that serves 'individuals, and private sector entities not owning, operating, or hosting Critical National Infrastructures (CNIs), and do not provide services to CSTs within scope of work'.

The Critical Systems Cybersecurity Controls (CSCC-1:2019, whose own compliance mandate cites Royal Decree No. 57231 and Royal Decree No. 7732 of 12/2/1440H) narrows scope a different way, reaching only the subset of systems that an owning or operating organization, government or private, in the Kingdom or abroad, itself identifies as critical against the document's own identification criteria, layered on top of whatever ECC duties already apply to that organization.

None of 'government agency', 'CNI operator or host', or 'CSP serving a government or CNI tenant' is an activity this corpus's declared vocabulary can express (crawling the web, training models, deploying a chatbot, automated outreach, high-risk decisions, processing voice, processing biometrics, serving minors, operating a social platform, shipping a mobile app, or distributing a software product); the Essential Cybersecurity Controls ECC-2:2024 are filed as rows of their own under the essential-service flag.

The NCA's regulatory-documents library also lists an Operational Technology Cybersecurity Controls document, which absorbed the industrial-control-systems domain ECC-2:2024 deleted, and a Data Cybersecurity Controls document, issued under the same statutory authority; neither document's own scope clause is confirmed here, so neither is described further.

Enforcement of the whole controls family runs through the NCA's own Legal Powers (Royal Decree No. M/117 of 22 December 2024), which makes 'failing to comply with cybersecurity related policies, governance mechanisms, frameworks, standards, controls, and guidelines set by the National Cybersecurity Authority' a violation: NCA inspectors detect and investigate it, a committee of at least three members (one a legal specialist) formed by the NCA's Board of Directors adjudicates it, and the committee may impose a warning, a temporary suspension or revocation of a license, suspension of the service or activity, and a fine of up to 25,000,000 Saudi riyals, appealable to the Administrative Court within 60 days.

No provision of the Legal Powers document creates a private right of action, and the document treats a suspected 'cybersecurity related crime' as a separate matter referred to competent agencies rather than as an offense under this administrative scheme itself, so no criminal exposure was found for noncompliance with the controls family as such.

The NCA's Cybersecurity Guidelines for Internet of Things (IoT) sits in the NCA's own website 'Guidelines' category, the same category holding its e-commerce cybersecurity guidance and its cybersecurity toolkits, distinct from the 'Policies and controls' category the controls family above sits in; the guideline's own text is not confirmed here, but that categorization alone reads as non-statutory guidance, the same posture as Singapore's Cybersecurity Labelling Scheme and Japan's JC-STAR, both named rather than instrumented in their own security documents.

No enacted Saudi statute or NCA control document was found setting security requirements a connected device or software product must meet before or after it is placed on the market for a buyer who is not a government agency or a CNI operator.

The Saudi Central Bank (SAMA) maintains its own Cyber Security Framework for the banks, insurance and reinsurance companies, and financing companies it supervises, referenced from SAMA's own site navigation and a dedicated cyber-security e-service, but the framework's own text is published only at rulebook.sama.gov.sa, whose robots.txt disallows every user agent on the entire site, so its primary text is not confirmed here; what is confirmed is that it exists and binds a SAMA-supervised financial-entity status, the same role-inexpressible shape as DORA's financial entities and New York's Department of Financial Services Part 500 covered entities.

The Communications, Space and Technology Commission (CST, the renamed Communications and Information Technology Commission, CITC) regulates the telecommunications and information-technology sector, including licensee cybersecurity requirements, but its Regulations and Licenses portal is a client-rendered search interface with no static listing of its own regulations, so no specific CST cybersecurity regulation's text is confirmed here; any such regime would in any event bind a CST-licensed telecommunications or ICT-operator status, again outside this corpus's declared activity vocabulary.

Saudi Arabia's Anti-Cyber Crime Law (Royal Decree No. M/17 of 8 Rabi I 1428H, 26 March 2007) creates offenses for unauthorized access to a computer system, an offense committed against a system by an intruder, so it belongs to this jurisdiction's scraping-topic finding rather than to this one; no primary text of the Law was located.

The Personal Data Protection Law's breach-notification duty (Royal Decree No. M/19 of 9/2/1443H, 16 September 2021, Art. 20) is likewise already this jurisdiction's privacy-topic finding, and any general security-of-processing obligation the same Law carries is a controller duty inside that comprehensive regime rather than a standalone security statute, so neither is restated here.

Because the whole NCA controls family, the SAMA framework, and any CST telecommunications-sector cybersecurity regime bind a government, CNI-operator, government-or-CNI-tenant, financial-entity, or telecommunications-licensee status rather than an activity a developer profile can declare, no enforcement record against them was located.

The Essential Cybersecurity Controls of the National Cybersecurity Authority apply to government agencies in the Kingdom of Saudi Arabia and their affiliated companies and entities, as well as all private sector entities owning, operating, or hosting Critical National Infrastructures. Failing to comply with cybersecurity controls set by the National Cybersecurity Authority is a violation under the Authority's Legal Powers.

Control 2-13-3 of the Essential Cybersecurity Controls requires an entity's cybersecurity incident and threat management requirements to include reporting cybersecurity incidents to the NCA.

Sector security regimes

Essential Cybersecurity Controls (ECC-2:2024), minimum cybersecurity controls

Essential Cybersecurity Controls (ECC-2:2024), Scope of Work and Applicability and Controls 2-10 and 2-11Text of the Essential Cybersecurity Controls (ECC-2:2024), English version published by the National Cybersecurity Authority

In force. Binds public and private bodies.

What this law does

The Essential Cybersecurity Controls apply to government agencies in the Kingdom of Saudi Arabia and their affiliated companies and entities, as well as all private sector entities owning, operating, or hosting Critical National Infrastructures. The National Cybersecurity Authority strongly encourages all other entities in the Kingdom to leverage the Controls to implement best practices.

The Essential Cybersecurity Controls state that all entities within their scope shall take all necessary measures to ensure ongoing and continuous compliance with the Controls, as per Article 10(3) of the NCA's Statute and High Order No. 57231. Control 2-10-3 requires the cybersecurity requirements for technical vulnerabilities management to include, at a minimum, periodic vulnerabilities assessment and detection and patch management.

The Legal Powers of the National Cybersecurity Authority make failing to comply with cybersecurity controls set by the Authority a violation. A person other than a public entity who commits such a violation is subject to one or more of a warning, temporary suspension of the license, revocation of the license, suspension of the service or activity, and a fine not exceeding 25,000,000 riyals.

What it requires

Vulnerability and incident reporting

Essential Cybersecurity Controls (ECC-2:2024), cybersecurity incident and threat management

Essential Cybersecurity Controls (ECC-2:2024), Control 2-13Text of the Essential Cybersecurity Controls (ECC-2:2024), English version published by the National Cybersecurity Authority

In force. Binds public and private bodies.

What this law does

The Essential Cybersecurity Controls apply to government agencies in the Kingdom of Saudi Arabia and their affiliated companies and entities, as well as all private sector entities owning, operating, or hosting Critical National Infrastructures. Control 2-13 states its objective as timely identification, detection, and effective management of cybersecurity incidents and proactive response to cybersecurity threats.

Control 2-13-3 requires an entity's cybersecurity incident and threat management requirements to include, at a minimum, reporting cybersecurity incidents to the NCA. Control 2-13-3 also requires those requirements to include sharing cybersecurity incident notifications, threat intelligence, penetration indicators, and incident reports with the NCA. The Legal Powers of the National Cybersecurity Authority make failing to comply with cybersecurity controls set by the Authority a violation.

A person other than a public entity who commits such a violation is subject to one or more of a warning, temporary suspension of the license, revocation of the license, suspension of the service or activity, and a fine not exceeding 25,000,000 riyals.

What it requires

Reuse law5 instruments, 4 in force, 1 no longer in force

Research summary (254 words)

Saudi Arabia's Copyright Law (Royal Decree No. M/169 of 14/8/1447H, published in the Official Gazette Umm Al-Qura on 13 February 2026) has applied since 12 August 2026 and permits quoting or copying short passages from a protected, lawfully published work into another work, including a journalistic summary taken from newspapers and periodicals, without the author's permission or compensation, for a legitimate purpose, to the extent that purpose needs, consistently with custom and with the source and author named (Art. 27(1)).

It replaced the Copyright Law of Royal Decree No. M/41 (2 Rajab 1424H, 30 August 2003, as amended by Council of Ministers Decision No. 536 of 19 Shawwal 1439H, 3 July 2018), whose Art. 15(2) carried the earlier quotation and journalistic-summary exception.

The superseded Law created related rights for performers, producers of audio recordings, and broadcasting organizations, but none of its provisions create a press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 establishes, and no compelled platform-to-publisher bargaining regime has been located.

No reported Saudi decision addressing hyperlinking, framing, hot-news misappropriation, or a text-and-data-mining opt-out has been located, and the superseded Law's exceptions article carried no machine-readable reservation mechanism.

Article 26(4) of the 2026 Law permits copying a lawfully published work, whose original copy was lawfully obtained, without the author's permission or compensation, to develop artificial intelligence products and algorithms, within what the purpose needs, and the Law's Implementing Regulation (Article 30) adds controls, including a duty on the developer to keep records of the works used.

Copyright: the exclusive rights

Royal Decree No. M/169 (14/8/1447H), Arts. 3(11) and 9 computer programs and exclusive rights, Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 3 protects works of every kind, whatever the way they are expressed or the purpose of authorship, and lists its examples without limiting them. Article 3(11) lists computer programs and their applications among those works. Article 9(1) gives the author the exclusive right to do or authorize the acts it lists, according to the nature of the work. Those acts include copying the work in any way or form.

They also include translating the work into other languages and modifying, converting or adapting it into another form. The author also holds the right to distribute the work, and that right is exhausted at the first distribution. The author holds the right to rent a computer program for commercial purposes, and that right does not apply where the program itself is not the essential object of the rental.

The author holds the right to authorize communicating the work to the public by any means of wired or wireless transmission, including making it available so that the public can access it at any time and place. Article 47 punishes the offences it lists, which include exploiting a right under the Law for commercial purposes without the rights holders' permission, with imprisonment of up to one year, a fine of up to one million riyals, or both.

Article 51 lets a rights holder who suffers direct harm from an infringement sue in the competent court for seizure of the infringing works, an order to stop, and compensation including the infringer's profits. Article 61 applies the Law 180 days after its publication in the Official Gazette.

What it requires

Copyright Law (2026), copies of a computer program made by the owner of a lawful copy

Royal Decree No. M/169 (14/8/1447H) Art. 33 copies of a computer program by the owner of a lawful copy, Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 33 allows the owner of a lawful copy of a computer program to make a new copy without the author's permission and without compensation for the purposes it lists, to the extent the purpose needs, and requires the new copy to be destroyed once the purpose ends or the ownership of the lawful copy ends. The first purpose is a backup copy, limited to making one copy.

The second purpose is maintaining the authorized copy, or providing maintenance to a person who owns a lawful copy, where the maintenance is necessary to use the software. The third purpose is correcting technical errors, or studying, analyzing and monitoring the performance or function of the software to identify the ideas and theories on which the program rests.

The fourth purpose is copying and obtaining the information needed for interoperability with a different computer system or program, where it is done by the licensed person. The fifth purpose is testing data security and fixing security vulnerabilities. Article 37(1) requires every use under Articles 26 to 36 not to conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders. Article 61 applies the Law 180 days after its publication in the Official Gazette.

What it requires

Snippet reproduction

Royal Decree No. M/169 (14/8/1447H), Art. 4(1) and (3) exclusion of bare facts and daily news, Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 4(1) excludes ideas, procedures, working methods, mathematical concepts, principles and bare facts from the protection the Law gives. Article 4(3) excludes the daily news, or incidents of a news character, that newspapers, magazines, international bulletins and broadcasting organizations publish.

The Law's protection applies to all of those categories where their compilation is distinguished by originality in arrangement, presentation or classification, without protecting the content presented. Article 37(1) requires every use under Articles 26 to 36 not to conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders. Article 61 applies the Law 180 days after its publication in the Official Gazette.

What it requires

Royal Decree No. M/169 (14/8/1447H), Art. 27(1) quotation and journalistic-summary exception, Copyright Law (published 13 February 2026)Umm Al-Qura Official Gazette, Copyright Law

In force since 12 Aug 2026. Binds public and private bodies.

What this law does

Article 27(1) permits quoting or copying short passages from a protected, lawfully published work into another work, without the author's permission and without compensation, where the purpose is legitimate, the quotation goes no further than that purpose needs, it is consistent with custom, and the source and the author's name are stated. Article 27(1) applies this also to a journalistic summary taken from newspapers and periodicals.

Article 37(1) requires every use under Articles 26 to 36 not to conflict with the normal exploitation of the work or unjustifiably prejudice the legitimate interests of rights holders. Article 59 replaces the Copyright Protection Law issued by Royal Decree No. M/41. Article 61 applies the Law 180 days after its publication in the Official Gazette.

What it requires

Copyright Law, quotation and journalistic-summary exception

Royal Decree No. M/41 Art. 15(2) quotation and journalistic-summary exception (2 Rajab 1424H, 30 August 2003), amended by Council of Ministers Decision No. 536 (19 Shawwal 1439H, 3 July 2018)official Copyright Law text, WIPO Lex consolidated version

Binds public and private bodies.

What this law does

Article 15(2) permits quoting passages from a copyrighted work, in its original language or in translation, in another work without the copyright owner's permission, and states this also applies to journalistic summaries abstracted from newspapers and periodicals, provided the quotation is consistent with established conventions and within the limits justified by its purpose, and that the source and the author's name are mentioned.

Related rights for performers, producers of audio recordings, and broadcasting organizations exist elsewhere in the Law (Arts. 9, 18-19), but none of the provisions located create a press-publisher neighbouring right or a compelled platform-to-publisher bargaining regime reaching a news aggregator. No text-and-data-mining opt-out mechanism and no reported case on hyperlinking, framing, or hot-news misappropriation was located.

The Law provides that it takes effect six months after its publication in the Official Gazette (Art. 28), and no source located states the resulting day. The Copyright Law published in the Official Gazette on 13 February 2026 replaces this Law under its Article 59.

What it requires

Where nothing was found1 area of law

These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.

Age gating law

Saudi Arabia has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code. The Audiovisual Media Law and the E-Commerce Law, both read in full from misa.gov.sa's mirror of the Bureau of Experts' official English translations, carry no minor-facing provision of any kind.

The Child Protection Law (Royal Decree No. M/14, 3/2/1436H, 25 November 2014) and its Executive Regulations, both read in full in the Bureau of Experts' official English translation, impose content and reporting duties that fall outside the four registered families: Article 12 of the Law prohibits producing, publishing, displaying, trading, or possessing printed, visual, or audio works targeting children that incite behavior contrary to Sharia, public order, or public decency, a general prohibition binding any person rather than a duty addressed to a publisher, platform, broadcaster, or distributor as such, and Article 11(2) of the Executive Regulations bars "print, audio, visual, electronic, and social media platforms" from using children in tobacco advertising or showing scenes that encourage children to smoke, a content restriction rather than an age-verification or age-gating requirement.

Neither instrument requires a service to verify a user's age, gate access to content by age, or restrict a minor's use of a platform.

As of 7 September 2026.

Case law

No current case law for Saudi Arabia AI law
No current case law for Saudi Arabia privacy law
No current case law for Saudi Arabia scraping law
No current case law for Saudi Arabia cybersecurity law
No current case law for Saudi Arabia communications law
No current case law for Saudi Arabia content moderation law
No current case law for Saudi Arabia product and AI liability law
No current case law for Saudi Arabia digital accessibility law
No current case law for Saudi Arabia age gating law
No current case law for Saudi Arabia reuse law

Reporting clocks that run here1 instrument

The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Saudi Arabia comes first, then the law of the bodies above it that applies here.

Timeline List

Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.

72 hours

Breach notificationprivacy law

Personal Data Protection Law, breach notificationSaudi Arabia, from becoming aware

The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.

The law of Saudi Arabia

72 hours

Personal Data Protection Law, breach notification

Royal Decree No. M/19, Art. 20; Implementing Regulations Art. 24(1)privacy law, in force since 14 September 2023

The sentence the clocks are read from

An app that suffers a breach, damage, or illegal access affecting the personal data of an individual in Saudi Arabia must notify the Competent Authority within 72 hours of becoming aware of the incident where it potentially causes harm to the personal data, the Data Subject, or their rights or interests, and must notify the Data Subject without undue delay where the breach may cause damage to their data or conflict with their rights or interests, following the Implementing Regulations' procedure.

Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

This page covers the instruments LexLint has researched to a stage. Instruments named in the law library but not yet researched are counted in the head and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.