A website is a shop window, and in Saudi Arabia shop windows come with rules. If your site sells or advertises products or services, collects enquiries through a form, or shows prices, several regulations already apply to it, including the E-Commerce Law, the Personal Data Protection Law (PDPL) and VAT rules. This guide turns Saudi website legal requirements into a practical list of what your business site should show and which pages it needs, so you can launch with confidence and know when to ask a lawyer.
Key takeaways:
- If you sell or advertise online, the E-Commerce Law expects your site to show who you are: your name, address, contact details and commercial registration.
- The Implementing Regulations add a privacy policy, a complaints procedure and your VAT number if you are registered.
- Consumers generally have a 7-day right to cancel and can cancel if delivery is more than 15 days late, with exceptions.
- E-store authentication moved from Maroof to the Saudi Business Center's Business platform in 2023.
- Any form that collects personal data brings the PDPL into play.
This is a practical guide, not legal advice. Rules change, and sectors such as healthcare and finance have extra requirements, so confirm the details for your business with the relevant authority or a licensed Saudi lawyer.
In this guide
Which Saudi rules apply to a business website?
Most business websites in the Kingdom touch four sets of rules. Which ones apply depends on what your site does:
| Rule | Applies when your site… | What it means for the website |
|---|---|---|
| E-Commerce Law (Royal Decree M/126, 2019) and its Implementing Regulations | sells, displays or advertises products or services online | Identity disclosures, clear terms, cancellation rights, complaints handling |
| Personal Data Protection Law (PDPL) | collects names, phone numbers, emails or other personal data, including through a contact form | A privacy notice, a lawful purpose, security, and respect for data rights |
| VAT rules (ZATCA) | belongs to a VAT-registered business | VAT-inclusive consumer prices and compliant e-invoices |
| Domain rules (SaudiNIC) | uses a .sa domain | Eligibility and registration documents |
The E-Commerce Law defines e-commerce broadly: it covers advertising products and services electronically, not only selling them. So even a brochure site that promotes your services is wise to follow the disclosure rules below.
Show who you are
The E-Commerce Law requires a service provider to disclose basic identifying information on its website. In practice, place these details in your footer and on your contact page:
- Your business or trade name, matching your commercial registration.
- Your address and working contact details: phone, email, and WhatsApp if you use it.
- Your commercial registration number, or the details of another public register you are listed in, such as a freelance certificate.
- Your VAT registration number, if you are registered for VAT.
Hidden contact details are a sales problem as well as a legal one. We cover the trust side in trust signals that convert.
If you sell or take orders online
Sites that sell directly carry more obligations. Before a customer confirms an order, they should be able to see:
- A clear description of the product or service and its main characteristics.
- The full price, including VAT, delivery fees and any other charges.
- Payment, delivery and performance terms, including expected delivery times.
- Your cancellation and returns policy.
Cancellation. The E-Commerce Law gives consumers a right to cancel within seven days of receiving goods or of contracting for a service, provided they have not used the product or benefited from the service. There are exceptions, including products made to the customer's own specification. Customers can also cancel if delivery is more than fifteen days late, unless the delay is due to force majeure.
Complaints. Publish how customers can raise a complaint and how you handle it. For most small businesses, a dedicated email or form and a stated response time are enough.
Payments. If you take online payments, use a gateway licensed by the Saudi Central Bank. Our Arabic guide to Saudi payment gateways compares the options.
Store authentication: from Maroof to the Business platform
For years, Saudi online stores displayed a Maroof badge. In 2023 the Ministry of Commerce moved e-store authentication to the Business platform run by the Saudi Business Center (business.sa). Authentication links your store to a verified commercial registration or freelance certificate, so customers can check that you are real.
Published guidance lists the main conditions as:
- A valid commercial registration or freelance certificate.
- A business bank account linked to that registration or certificate.
- A working, original website link. Social media accounts do not count as the store link.
Once approved, show the authentication where customers will see it, usually in the footer. Conditions are updated from time to time, so check the current requirements on the Business platform before you apply.
Privacy and personal data (PDPL)
The Personal Data Protection Law came into force in September 2023, with full enforcement from September 2024, under the supervision of the Saudi Data and AI Authority (SDAIA). It applies as soon as your website collects personal data, and a simple contact form asking for a name and phone number already does.
- Publish a privacy notice that explains what you collect, why, how long you keep it, and how people can exercise their rights.
- Collect only what you need. A contact form rarely needs a date of birth or an ID number.
- Ask for separate consent before adding people to marketing messages.
- Secure the site and the form entries, and have a plan for data incidents; serious breaches must be reported to SDAIA.
- Check where your form, analytics and email providers store data, because the PDPL regulates transfers of personal data outside the Kingdom.
We go through each step for WordPress sites in our PDPL website compliance checklist.
VAT and e-invoicing
Saudi VAT is 15%. If your business is VAT-registered, the prices you advertise to consumers should include VAT, and your invoices must follow ZATCA's e-invoicing (FATOORA) rules, which are being applied to businesses in waves. If your website issues invoices or receipts, make sure the system behind it is compliant; ZATCA's e-invoicing portal explains the requirements and the timeline for each wave.
Domain and hosting
You can run a business website on any domain extension. A .sa domain is registered through SaudiNIC, which asks for supporting documents such as a commercial registration or trademark for many name types; our Arabic guide to registering a .sa domain covers the steps. Whatever the extension, register the domain in your business's name, not your designer's.
There is no general rule that a private business website must be hosted inside Saudi Arabia, but sector rules can require it, and the PDPL governs sending personal data abroad. If you handle health, financial or government-related data, check the specific requirements for your sector.
The legal pages your website needs
| Page | Who needs it | What it should cover |
|---|---|---|
| Privacy policy | Every site that collects personal data, including contact forms | What you collect, why, retention, sharing, people's rights, and a contact for privacy questions |
| Terms and conditions | Sites that sell or take bookings | Ordering, pricing, payment, delivery, liability and governing law |
| Cancellation and returns | Sites that sell goods or services | The 7-day cancellation right, exceptions, and how and when refunds are paid |
| Shipping and delivery | Sites that ship physical goods | Delivery areas, times and fees, and what happens if delivery is late |
| Contact and complaints | Every business site | Address, phone, email, the complaint process and response time |
| Cookie notice | Sites using analytics or advertising tags | Which cookies you use and how visitors can control them |
Publish them in Arabic as well as English if your customers speak Arabic. A policy the customer cannot read does not build trust.
Saudi website legal checklist
- Business name, address, phone and email are visible in the footer and on the contact page.
- The commercial registration or freelance certificate number is displayed.
- The VAT number is displayed if you are VAT-registered, and advertised prices include VAT.
- A privacy policy is published and linked next to every form.
- Forms collect only necessary data, with a separate opt-in for marketing.
- Terms, cancellation and delivery policies are published if you sell online.
- The complaint process and response time are stated.
- Your store is authenticated on the Business platform if you sell online, and the authentication is displayed.
- Online payments run through a licensed payment gateway.
- The domain is registered in your business's name.
- Policies are reviewed at least once a year and whenever the rules or your processes change.
Build the essentials in at launch and they cost little; add them after a complaint and they cost much more.
Launching a compliant website with Webnaa
Every Webnaa website launches with a privacy policy and terms ready, clear contact details, a WhatsApp button and a direct call number, and, on every website with your own domain, a domain registered in your name. We place your registration and VAT details where customers expect to find them, and keep forms to the data you actually need. We are web designers, not lawyers: for regulated sectors or complex terms, have the final policies reviewed by a licensed Saudi lawyer.
Websites start from SAR 39 a month with no setup fee and hosting included; WordPress websites, with updates and support, are priced by pages and languages in the price calculator.
Launch with the essentials in place
A privacy policy and terms ready from day one, from SAR 39 a month.
Read next: Ecommerce Website Development in Saudi Arabia: Requirements, Steps and Costs; Salla vs Zid vs WooCommerce: Which Store Platform Fits Your Business in Saudi Arabia?.
FAQ
Do I need a commercial registration to run a business website in Saudi Arabia?
To trade online you need a valid commercial registration or, for eligible individual activities, a freelance certificate. Either one also lets you authenticate your store on the Business platform. A purely personal site with no commercial activity is a different case.
Is Maroof still used to verify online stores?
No. Since 2023, e-store authentication has been handled through the Saudi Business Center's Business platform (business.sa), which replaced Maroof.
Do prices on my website have to include VAT?
If you are VAT-registered, prices shown to consumers should include the 15% VAT. Showing one price and adding VAT at checkout is a common cause of complaints.
Does a simple contact form fall under the PDPL?
Yes. A name, phone number or email address is personal data, so you need a privacy notice, a clear purpose and reasonable security for the entries.
Can my website be hosted outside Saudi Arabia?
For most private business websites, yes. Sector rules and the PDPL's rules on transferring personal data abroad can add conditions, so check them if you handle sensitive data.
Summary
A compliant Saudi business website comes down to transparency: show who you are, explain prices and policies before customers commit, protect the data your forms collect, and authenticate your store if you sell online. Build those essentials in from launch, review them once a year, and check any specific obligation with the official source or a licensed Saudi lawyer.
Sources: Al Tamimi & Company: the Saudi E-Commerce Law, Al Tamimi & Company: the Implementing Regulations, Okaz: e-store authentication moves to the Business platform (Arabic), Saudi Business Center, SDAIA: Personal Data Protection, ZATCA: e-invoicing.