Saudi E-Commerce Law: What Your Website Must Show

We build online stores from Calicut, Kerala, working remotely, with no office or staff in the Kingdom. When we scope a Saudi store for e-commerce development, we start from the list below, because each article becomes something on a page or in an email. Every source below was read on 28 October 2026. This is general information, not legal or tax advice: we build the features, and the compliance decisions stay with you and your Saudi lawyer or tax adviser.

What is the Saudi E-Commerce Law, and who does it cover?#

The E-Commerce Law↗ (opens in a new tab) (Qanoniah's copy of the Arabic text, Royal Decree M/126) regulates selling goods and services by electronic means. Its Article 2 covers three groups: service providers inside the Kingdom, practitioners outside the Kingdom, not registered in it, who offer products or services to consumers inside it, and consumers. The Implementing Regulations↗ (opens in a new tab) (also on Qanoniah) add that an activity counts as commercial when it is carried on regularly for profit.

The law firm CMS, writing when the law came in (9 October 2019↗ (opens in a new tab)), said it reaches any platform consumers in the Kingdom can use, whether or not the seller holds a Saudi commercial registration. So a Dubai or Kerala brand shipping to Riyadh is inside it too.

What must a Saudi online store show on every page?#

Article 6 of the law and of the regulations give the store's disclosure block; Article 9 adds lines for regulated professions.

The same article asks the store to link to this information and state any changes to it, so we date the policies and keep a short change note on each. The details sit once in the footer, so one edit updates every page.

Ads count too. Article 10 of the law makes an electronic advertisement part of the contract, and Article 10 of the regulations asks that it say clearly it is an advertisement and give people a way to opt out, so every marketing email carries a working unsubscribe link.

What goes on the invoice and the order confirmation?#

Before the order, Article 7 of the law asks for a statement of the contract's terms, and Article 7 of the regulations lists what the shopper must see before paying:

• the right to cancel where it applies, its costs and the steps to take, or a statement, with the reason, that it cannot be cancelled;
• a breakdown of the price: the original price, delivery charges, any taxes and any future costs, with how they are worked out;
• after-sales service, if any, and its conditions;
• the contract's term, where there is one;
• payment terms, any recurring payments, and the shipping and delivery terms.

It also asks for a clear button saying that clicking it concludes the contract and creates an obligation to pay, so the last button reads "Place order and pay", not "Continue". CMS's summary adds that the price shown must be the total, including all fees and taxes, and that shoppers may return goods within seven days of receipt if unused, with exceptions, and cancel if delivery is more than fifteen days late. Your returns page and order emails should say both.

After the order, Article 8 of the regulations asks for an invoice the shopper can save, showing:

• the seller's name (or trade name) and a description of the goods or service;
• confirmation that the contract was concluded, and its date;
• the total price and any taxes, with the price breakdown;
• shipping, transport and delivery charges;
• the seller's tax number, if any;
• the delivery date;
• the carrier's name and tracking details, where available;
• a summary of exchange and return terms;
• the payment method, and confirmation of full payment.

We template these into the confirmation email and a downloadable invoice.

Article 4 of the regulations also lets a shopper correct an order error within 24 hours, and lets a seller fix its own mistake only by telling the shopper before shipping, with the shopper free to cancel. So the confirmation email carries a "something wrong?" route.

Does a store need e-store authentication on the Business Platform?#

The Ministry of Commerce asked e-store owners on 29 March 2023↗ (opens in a new tab) to register on the Business Platform at business.sa, run by the Saudi Business Center, instead of the older Maroof platform. The Ministry called the Business Platform the one and only place for verifying and registering electronic stores in the Kingdom, and said a store needs a registration certificate or a valid professional certificate, plus a commercial bank account. Guides that still send sellers to Maroof are out of date.

Registration matters to the build: Article 6 of the law lets a registered store leave its address off the page, and for an individual seller, Article 3 of the regulations takes the place of business from the store or the certificate. We add the badge and number to the footer; the registration itself is yours, in your company's name.

What does the PDPL ask of your forms, cookies and privacy policy?#

The Personal Data Protection Law has been enforceable since 14 September 2024, and SDAIA, the data authority, published a privacy policy guideline alongside it. CMS summarised that guideline on 26 September 2024↗ (opens in a new tab): the policy names the business and its contacts, the data collected (cookies included) and which fields are optional, the purpose, any sharing, where data is stored and for how long, the person's rights, and how to complain.

The e-commerce rules point the same way. Article 5 of the regulations asks a store to protect customer data, not to use it for marketing without prior explicit consent, to tell the Ministry and the customer within three days of learning of a breach, and to make closing an account clear and easy.

For the build, that becomes four tasks:

1. The privacy policy goes live before the first form, since a contact form or checkout collects personal data from its first submission.
2. Marketing consent is its own tick box, unticked, separate from accepting the terms. CMS's Saudi data protection guide↗ (opens in a new tab) (last updated 8 October 2025) notes that promotional messages need consent and that the E-Commerce Law asks for express consent for direct marketing.
3. Cookies are named in the policy. The same guide says there is no specific cookie legislation in the Kingdom, so we add a plain cookie notice and list each analytics and ad tag in the policy rather than hiding them.
4. Data leaving the Kingdom is mapped. Clyde & Co reported on 19 February 2025↗ (opens in a new tab) that SDAIA amended its transfer rules in September 2024 and had not yet published a list of adequate countries, so transfers rely on safeguards such as its standard contractual clauses. Forms emailing a team abroad, analytics and overseas servers are all transfers; we list each one, and your adviser picks the safeguard.

How does ZATCA e-invoicing touch an online store?#

ZATCA's Wave 25 notice↗ (opens in a new tab) of 24 July 2026 (read 28 October 2026) says taxpayers whose revenue subject to VAT passed SAR 187,500 in any year from 2022 to 2025 must integrate their e-invoicing solutions with the Fatoora platform by 1 February 2027, and that ZATCA notifies them directly.

The website does not talk to Fatoora by itself. The tax invoice comes from your e-invoicing solution, such as your accounting system or a provider your store platform supports. Our job is the hand-off: each paid order passes its customer, line items, VAT and totals to that system, so the confirmation matches the tax invoice. Whether you are in a wave is for your tax adviser.

Does the store have to be in Arabic and on a .sa domain?#

The articles quoted above do not name a language. We still build Saudi consumer stores in Arabic and English, and Arabic done properly is a layout, not only a translation: right to left, with mirrored menus and prices that read correctly. Our guide to Arabic-English website design covers how we build both.

Two of our concept builds show it on a phone. Rawahil is a car rental homepage for a fictional Riyadh firm, with every fleet price in SAR with VAT included, and Matanah is a website for a fictional Jeddah contractor; each has an English page and a right-to-left Arabic one. They are concept builds, real websites for invented brands, not client work. Their Arabic shows the layout; on a client site the words come from a native Arabic writer.

On the domain, SaudiNIC's domain name regulation↗ (opens in a new tab) (version 5.0, February 2024) limits .sa names to entities in Saudi Arabia, Saudi nationals and Premium Residency holders, entities licensed by a Saudi authority, and owners of a Saudi-registered trademark or trade name. A .com.sa needs a Saudi commercial registration or a locally registered mark. A foreign seller without a Saudi tie can still sell into the Kingdom on a .com.

What are the penalties for getting it wrong?#

Under the E-Commerce Law, CMS's summary says the Ministry's committees can impose anything from a warning to a fine of up to SAR 1 million, and can suspend the activity, close it permanently or have the website blocked, weighing the violation's seriousness, frequency and harm.

The PDPL sits on top. CMS's data protection guide gives a general maximum fine of SAR 5 million, which can be doubled for repeat offenders, and a separate fine of up to SAR 3 million for disclosing sensitive personal data with intent to harm or for personal benefit, which is also a criminal offence. The same guide says SDAIA must be told of a qualifying breach within 72 hours.

How do we turn the law into a build list and a quote?#

A Saudi store quote from us names the items above as lines: the Article 6 footer block, the Article 7 checkout statement and button, the Article 8 invoice and confirmation templates, the complaints page, the privacy policy and consent boxes, the Business Platform badge, the Fatoora hand-off, and the Arabic pages with their native writer.

Our Gulf prices are fixed figures, the same number in riyals and dirhams. A Shopify store, up to 50 products set up, starts from SAR 12,000; a custom store on WooCommerce or a headless build starts from SAR 15,000. A custom business website of up to 8 pages starts from SAR 8,000, a Next.js website with a CMS from SAR 15,000, and the website care plan from SAR 500 a month, billed yearly. All of these are starting prices before VAT where it applies in the Gulf; hosting, domains, store and app fees are billed at cost, in your name. The full list is on our pricing page, and our website quotation guide shows how each line is laid out.

Where should a Saudi store start?#

Start with the documents, not the design: your commercial registration or professional certificate, your tax number, the business bank account the Business Platform asks for, and a returns and complaints process you can run.

If you are planning a store for Saudi customers, our Saudi website development page shows how we work in Riyadh hours from Calicut, and our web development page covers the wider build. Send us your product count, platform and languages, and we will send a written quote that names every line above, built to what your lawyer and tax adviser sign off.