Saudi Arabia E-Commerce Compliance Guide
Legal compliance is the foundation of any successful e-commerce store in Saudi Arabia. With the E-Commerce Law issued in 2019 and continuous amendments, there are clear rules to follow. Violating these rules exposes you to fines up to SAR 1 million and store closure. This guide covers all requirements.
Required Licenses and Registrations
1. Commercial Registration (CR)
| Item | Details |
|---|---|
| Authority | Ministry of Commerce |
| Requirement | Mandatory for every online store |
| Cost | SAR 200/year (main) |
| Duration | 15 minutes via Saudi Business Center |
| Requirements | National ID + national address + mobile number |
Steps to obtain CR:
- Visit Saudi Business Center (mc.gov.sa)
- Select "Issue Commercial Registration"
- Choose activity "Online Commerce"
- Enter required information
- Pay fees (SAR 200)
- Issued immediately
2. Maroof Registration
| Item | Details |
|---|---|
| Authority | Ministry of Commerce (maroof.sa) |
| Requirement | Mandatory |
| Cost | Free |
| Benefit | Trust badge + legal protection |
3. VAT Registration
| Situation | Requirement |
|---|---|
| Revenue > SAR 375,000 | Mandatory |
| Revenue SAR 187,500–375,000 | Optional |
| Revenue < SAR 187,500 | Not required |
4. Additional Licenses by Product
| Product | Authority | License |
|---|---|---|
| Food | SFDA | Food establishment license |
| Cosmetics | SFDA | Cosmetics license |
| Medicine | SFDA + MOH | Pharmacy license |
| Electronics | SASO | Conformity certificate |
| Children's toys | SASO | Safety certificate |
| Perfumes | SFDA | Product notification |
E-Commerce Law — Key Rules
Consumer Rights
| Right | Detail | Violation Penalty |
|---|---|---|
| Return | 7 days from receipt (no reason needed) | SAR 100,000–1,000,000 |
| Cancellation | Free before shipping | SAR 100,000–500,000 |
| Information | Complete product information | SAR 50,000–500,000 |
| Privacy | Personal data protection | Up to SAR 5,000,000 |
| Warranty | Product warranty by type | SAR 200,000–1,000,000 |
| Invoice | Electronic invoice for every transaction | SAR 5,000–50,000 |
What Must Be Displayed on the Store
| Element | Requirement | Purpose |
|---|---|---|
| Merchant name | Full commercial name | Identification |
| Commercial registration | Number visible | Transparency |
| Contact methods | Email + phone + address | Easy communication |
| Return policy | Clear and detailed | Consumer right |
| Privacy policy | How you collect and use data | Data protection |
| Terms of use | Rights and obligations | Legal protection |
| Prices | VAT inclusive | Transparency |
| Product description | Accurate and complete | No misleading |
Personal Data Protection — PDPL
Saudi Arabia's Personal Data Protection Law (PDPL) came into effect in September 2023.
Basic Requirements
| Requirement | Detail |
|---|---|
| Consent | Obtain explicit consent before data collection |
| Purpose | Collect data for specified purpose only |
| Minimization | Collect minimum required data |
| Security | Implement appropriate security measures |
| Notification | Notify in case of data breach |
| Deletion | User's right to request data deletion |
| No transfer | No transferring data outside Saudi without permission |
PDPL Penalties
| Violation | Fine |
|---|---|
| Collecting data without consent | Up to SAR 3,000,000 |
| Transferring data outside Kingdom | Up to SAR 5,000,000 |
| Not notifying about breach | Up to SAR 1,000,000 |
| Not appointing data officer | Up to SAR 500,000 |
| Repeat violation | Double fine + imprisonment |
Electronic Invoicing (FATOORAH)
| Phase | Date | Requirement |
|---|---|---|
| Phase 1 | December 4, 2021 | Issue electronic invoices |
| Phase 2 | Gradually from 2023 | Integration with ZATCA |
Invoice requirements:
- QR code
- Tax registration number
- Product and price details
- Tax amount separately
- Issue date and time
- Unique serial number
Shipping and Delivery — Rules
| Rule | Detail |
|---|---|
| Delivery time | Must be stated clearly before purchase |
| Delays | Compensation or free cancellation if significantly delayed |
| Damage | Merchant's responsibility until receipt |
| Tracking | Preferred to provide tracking number |
| COD | Customer has right to inspect before paying |
Intellectual Property Protection
| Type | Authority | Duration | Cost |
|---|---|---|---|
| Trademark | Saudi IP Authority | 10 years (renewable) | SAR 1,000 |
| Patent | Saudi IP Authority | 20 years | SAR 2,000+ |
| Copyright | Automatic | Author's life + 50 years | Free |
| Industrial design | Saudi IP Authority | 15 years | SAR 1,000 |
Complete Compliance Checklist
Before launch:
- [ ] Commercial registration
- [ ] Maroof registration
- [ ] Tax registration (if applicable)
- [ ] Special product licenses
- [ ] Privacy policy
- [ ] Return and refund policy
- [ ] Terms of use
- [ ] Electronic invoicing system
- [ ] SSL certificate
- [ ] Licensed payment gateway
During operation:
- [ ] Tax returns on time
- [ ] Updated Maroof information
- [ ] Ad disclosure compliance
- [ ] Customer data protection
- [ ] Process returns within 7 days
- [ ] Electronic invoice for every transaction
- [ ] Keep records for 6 years
Important: Read Saudi E-Commerce Advertising Rules to understand advertising regulations.
Frequently Asked Questions
Do I need a commercial registration for a small store?
Yes. Every online store in Saudi Arabia needs a commercial registration regardless of size. The cost is only SAR 200/year and it's issued in minutes.
What's the penalty for non-compliance with e-commerce law?
Fines from SAR 100,000 to SAR 1,000,000, store closure, and ban from practicing e-commerce. Repeated violations double the penalty.
Can a customer return a product without a reason?
Yes, within 7 days of receipt. Exceptions: customized products, undergarments, opened digital products, and perishable goods.
How do I protect my customers' data?
Implement PDPL: explicit consent, data encryption, minimum collection, no sharing with third parties without permission, and appoint a data protection officer if handling sensitive data.
