It is reported that procurement procedures are characterised by a significant lack of transparency. Contracts are occasionally awarded outside the formal procurement framework or facilitated through political channels. Although a public procurement website exists, it is reported that is inconsistently updated and not all tenders are published. Reports further indicate that, when tenders are posted, they are often available for only a brief period, and the selection of winning bidders may be predetermined.

Timor-Leste is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA) but it does have observer status since September 2024.

Saudi Arabia has signed but not ratified the United Nations (UN) Convention on the Use of Electronic Communications in International Contracts.

Saudi Arabia has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce.

Saudi Arabia has adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

According to Art. 8 of the Regulations for Licensing of Telecommunications and Information Technology Equipment, imported ICT products to Saudi Arabia cannot clear customs without the Communications, Space & Technology Commission (CST) Certificate of Conformity (CoC). The ICT equipment must comply with the technical specifications issued by the CST. The CST does not accept similar conformity certificates from other countries.

The National Cybersecurity Authority (NCA) has launched the National Cryptographic Standards (NCS) to meet the national need by specifying the minimum requirements necessary to provide the degree of protection required for national data, systems and networks using cryptographic mechanisms for civilian and commercial purposes, based on global best practices and global standards.
However, Art. 13.8 of the Regulations for Licensing of Telecommunications and Information Technology Equipment provides a general requirement to disclose details of encryption systems contained in telecommunications and IT equipment intended to be supplied and used in the kingdom.

Under Art. 15 of the E-Commerce Law, a business must register their e-shop in the Commercial Register in accordance with the Law of the Commercial Register, with the detailed requirements specified in the Implementing Regulations. Art. 12 of the Implementing Regulations provides that a trader must register the main electronic shop in the Commercial Register within 30 days of its establishment by submitting an electronic application via the Ministry’s website. The application must include, at a minimum, the applicant’s name, commercial registration number, the activities to be carried out through the electronic shop, and a description and address of the main electronic shop.
Where a practitioner seeks to register an electronic shop in order to acquire trader status, the application must instead contain the practitioner’s name and identification number, residential address, telephone number and e-mail address, together with the activities to be conducted through the electronic shop and a description and address of the main electronic shop.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is SAR 1000 (approx. USD 250), above the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

According to Section 4 of the Saudi Domain Name Registration Regulation, domain name registration services are restricted to the following categories: (i) entities physically located in Saudi Arabia; (ii) natural persons holding a Saudi national ID or Premium Residency; (iii) entities licensed by a competent authority in Saudi Arabia; and (iv) owners of trademarks or trade names registered in Saudi Arabia. In addition, a local administrative contact is required for each registration. Domain name services for Saudi country-code top-level domains (ccTLDs), including the Saudi ASCII ccTLD (.sa) and the Saudi IDN ccTLD, are managed by the Saudi Network Information Center (SaudiNIC).

The E-Commerce Law establishes a comprehensive framework for consumer protection applicable to online transactions. This legislation governs e-commerce activities between consumers in Saudi Arabia and service providers globally, including transactions between individuals. The law encompasses provisions on various issues, such as the protection of consumer data, transparency in contracting and electronic advertisements, as well as consumer rights, including the right to returns and cancellations under specific circumstances. According to regulatory authorities, the implementation of this framework has enhanced trust in online transactions and has made it easier for consumers to file e-commerce-related complaints with the authorities, owing to the strengthened consumer protection measures.

According to the GSO Technical Regulation for Low Voltage Electrical Equipment and Appliances – BD-142004-01, which includes an amendment and an update of the first edition, number (BD07070503) was implemented in 2007. Electrical appliances designed to be used in a certain rated voltage range must be sold bearing the G mark after being certified by the GCC Notified Body.
Products that fall under List 1 under the Regulation are low-risk; thus, a self-declaration form prepared by the manufacturer can be made by affixing the “G” before placing the product on the market. Products that fall under List 2 are higher-risk electrical products, which will undergo mandatory Type testing and review of the product's Technical File to verify conformity before authorisation is granted to affix the “G” mark before placing the product onto the market.
However, for List 2 products, manufacturers must choose a single Notified Body (NB) entity to examine the technical design of a product and verify that the technical design of the product meets the requirements of the applicable Gulf Technical Regulations and for the issuance of an evaluation report with a Gulf Type Examination certificate and shall be issued a certificate from the NB.
It is reported that not all agencies offering Saudi Standards, Metrology and Quality Organization (SASO) Certificate of Conformity (CoC) services are recognised in Saudi Arabia, which can complicate companies wishing to export their goods to Saudi Arabian markets. These certificates should be obtained only from authorised agencies recognised in Saudi Arabia.

It is reported that individuals are required to use their legal names when signing mobile-service contracts and must provide a national identification card or residence permit. Moreover, Since 2016 the Communications, Space & Technology Commission (CST), mobile service providers to register the fingerprints of new SIM-card subscribers within 90 days. The collected information is subsequently shared with a centralised database managed by the Ministry of the Interior.

Saudi authorities are reported to regularly block access to news outlets and other websites based on geopolitical and domestic political considerations. While widely used social media and communication applications are not consistently blocked, some users have reported that Clubhouse is inaccessible, despite the absence of an official government statement confirming its restriction. Furthermore, regulators and telecommunications operators have historically taken a restrictive stance toward free or low-cost Voice over Internet Protocol (VoIP) services. These services are perceived as undermining traditional mobile call revenues, circumventing existing regulatory frameworks, and potentially evading surveillance mechanisms. In this context, the Communications, Space, and Technology Commission (CST) and domestic ISPs have previously blocked applications such as Viber, WhatsApp, and FaceTime, as well as integrated messaging features on platforms like Facebook Messenger. As of June 2024, most VoIP applications were accessible in Saudi Arabia, with the exception of WhatsApp, which reportedly remains restricted.
Moreover, between 2017 and 2024, websites affiliated with Qatari, Iranian, and Turkish media were intermittently blocked in the context of ongoing regional tensions. Platforms critical of the Saudi government—such as al-Manar, the Beirut-based broadcaster—have also been subject to restrictions. According to available reports, internet service providers (ISPs) in the Kingdom have deployed WireFilter censorship technology to target specific web pages.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in Saudi Arabia for the year 2024. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."
Although Saudi Arabia was identified as a 'repeat offender' for implementing internet shutdowns in 2023, a practice it has consistently maintained since 2016, and was among the MENA countries enforcing such measures during that year, reports indicate that the country carried out one internet shutdown in 2024.