Important Details about Saudi Arabia’s Recent Telecommunications and Information Technology Law

Last Updated on November 13, 2023 by Ameer Hamza

Saudi Arabia revised its telecommunications regulatory framework in the middle of 2022 by passing a new Telecommunications and Information Technology Act. The Telecommunications and Information Technology Law was established by Royal Decree No. M/106 dated 02/11/1443H (1st June 2022) and was scheduled to go into effect on 7th December 2022. The Telecommunications Law passed by Royal Decree No. M/12 dated 12/03/1422H (4th June 2001) (the Old Law) will be repealed by the Act, expanding the subject’s scope to include new technologies and digital services.

Objectives of the Telecommunications and Information Technology Law 

Saudi Arabia’s transformation into a regional technological and digital hub, as well as the promotion of substantial foreign and domestic investments in industries like cloud computing, the Internet of Things (IoT), cybersecurity, artificial intelligence, and a wide range of other related activities, are among the law’sLaw’s main stated objectives.

Features of the Telecommunications and Information Technology Law

The Old Law only applied to telecommunications services, while the Act now covers a variety of ICT activities and services. To promote Saudi Arabia’s digital transformation and to promote innovation, entrepreneurship, research, and technological development, the Act currently controls new technologies.

According to the law, agreements must be reached between service providers and digital content platforms to guarantee key infrastructure security. Infringers risk having their license suspended or paying a fine of up to 25 million Riyals.

The user’s personal information and documents must be protected in confidence, and service providers must take all necessary steps and make preparations to achieve this. These details must not be disclosed without the user’s permission. If a user’s data or documents have been compromised in any manner, service providers are also required to take the appropriate steps to secure them and notify them right away.

According to the Telecommunications and Information Technology Law, the service provider must take all necessary steps and make arrangements to guarantee the confidentiality of the user’s personal information and documents and not divulge them unless the user specifically authorizes them. If the user’s information and documents have been compromised in any manner, the service provider is required to take the appropriate steps to safeguard them and notify the user right once.

The law emphasizes that the Saudi National Cybersecurity Authority (NCA) establishes the necessary controls and guidelines for announcing, promoting, or amending price tariffs. Also, the body will work on concluding contracts with international service providers to provide services like international roaming or other services, or to establish, sell, promote, or use calling cards.

Offenses and Sanctions in the Telecommunications and Information Technology Law

The primary offense of rendering telecommunications services or establishing a public telecommunications network without a license is compelled to be expanded to include the performance of any activities that fall under the new regime’s purview and call for licensing registration or authorization. Additionally, the Act now makes it illegal to own, sell, lease, make available, manufacture, produce, or trade-in’ any software, hardware, or other items that do not adhere to the Saudi Communications & Information Technology Commission’s (CITC) established rules, restrictions, and specifications or that do not otherwise meet those criteria.

Defaulters have to pay a fine of SAR 25,000,000 (US$ 6,657,500). In addition, the Telecommunications and Information Technology Law grants the CITC the authority to block access to digital content platforms in whole or in part and to assist with the technical aspects of enforcing judgments made by courts against service providers of digital platforms, just as it grants the CITC the authority to suspend any operator that violates licensing conditions.