Saudi Arabia. Cybersecurity. Law (Royal Decree)
Anti-Cyber Crime LawAnti-Cyber Crime Law (Royal Decree No. M/17 of 8/3/1428H)
In force
Partly verified
Low confidence.Decree number/date and penalty range from prior knowledge; not freshly verified (official BOE site unreachable). [Link: Bureau of Experts official English translation hosted by MCIT; laws.boe.gov.sa entry not verified]
§1Summary
- Synopsis
Criminalises unauthorised access, interception, defamation and invasion of privacy via IT devices, and unlawful access to bank or credit data.
- Key themes
- Unique features
Invasion of privacy through camera-equipped phones or similar devices is a specific offence.
- SaaS relevance
Brief: criminal backstop for security breaches and misuse of Saudi user data.
§2Obligations
- Extraterritorial
- No
- Breach notification
- None
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Imprisonment up to 10 years and fines up to SAR 5m (most serious offences)
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text mcit.gov.sa
- English text mcit.gov.sa
- Authority
- Public Prosecution; Communications, Space & Technology Commission
§5Where it applies
- Domestic law of
- Saudi Arabia
§6Sources and verification
- Verification
Low confidence.
Partly verified
Low confidence.Decree number/date and penalty range from prior knowledge; not freshly verified (official BOE site unreachable). [Link: Bureau of Experts official English translation hosted by MCIT; laws.boe.gov.sa entry not verified]