Online safety & content laws in Saudi Arabia (2026)

The National Cybersecurity Authority published comprehensive enforcement regulations closing gaps in its regulatory powers. Non-compliance now carries fines up to SAR 25 million (~USD 6.7 million), plus licence suspension; NCA-appointed inspectors can enter sites, seize equipment, and copy evidence.

After a three-year phased transition, Saudi Arabia's Personal Data Protection Law became fully enforceable on 14 September 2024. SDAIA's enforcement committees issued 48 decisions within the first enforcement year against organisations for unlawful data collection, marketing without consent, and inadequate security controls — with fines up to SAR 5 million per violation.

The General Authority of Media Regulation circulated a draft Media Law mandating that all digital platforms and individual content creators obtain a government licence before publishing any media content. Critics warned it would extend the Kingdom's press censorship regime to ordinary social media users; as of mid-2025 the law remained under review.

Saudi Arabia's Specialized Criminal Court upgraded a doctoral student's sentence to 34 years (later reduced to 27 years on appeal in January 2023) solely for retweeting dissidents and activists. The case became a global flashpoint illustrating how the Anti-Cybercrime Law and Anti-Terrorism Law are routinely used to criminalise online expression.

Royal Decree M/106 replaced the 2001 Telecom Law, broadening the regulatory mandate from voice/data communications to the full ICT sector — internet services, digital platforms, and data transmission. The regulator was renamed the Communications, Space and Technology Commission (CST); the Act and its Bylaws entered into force on 7 December 2022.

The NCA was created as the Kingdom's supreme cybersecurity authority, reporting directly to the Royal Court. It is responsible for issuing mandatory controls (Essential Cybersecurity Controls, Critical Systems Controls, Cloud Controls), developing the national cybersecurity strategy, and coordinating national incident response across all government and critical sectors.

Saudi Arabia rescinded its multi-year ban on VoIP applications (WhatsApp, Skype, FaceTime, Viber), allowing platforms that met CITC regulatory requirements — including cooperation with lawful interception — to operate. The decision was driven by Vision 2030 digital-economy objectives and ended a regime that had forced users to rely on standard mobile calls.

Saudi Arabia's foundational cybercrime statute criminalised unauthorised system access, interception of data, online fraud, and content deemed contrary to public order, religious values, or general morals — with penalties up to one year imprisonment and SAR 5 million in fines. The law became the primary legal instrument subsequently used to prosecute online expression and dissent.

The Communications and Information Technology Commission took over DNS administration and content filtering from KACST's Internet Services Unit, centralising all Saudi internet traffic through a government-managed filtering system. Content is blocked across 90+ categories including pornography, gambling, LGBTQ+ content, and material deemed politically or religiously subversive.

Saudi Arabia became one of the last Gulf states to open public internet access — arriving years late because the government spent 1997–1999 building a centralised infrastructure that routes all traffic through government-managed servers before delivery to ISPs. The King Abdulaziz City for Science and Technology (KACST) Internet Services Unit administered all filtering; this hub-and-spoke architecture underpins today's regulatory model.