Art. 5.4 of the General Principles for Personal Data Protection in the Telecommunication, IT, and Postal Services requires that service providers of telecommunication, IT and postal services process customers’ personal data within Saudi Arabia and prohibits them from processing customers’ personal data out of Saudi Arabia without the authorisation of Communications, Space and Technology Commission (CST).

Art. 3.4.3 of the Cyber Security Framework of the Saudi Arabian Monetary Authority mandates that financial institutions should use cloud services located in Saudi Arabia. If the cloud services are outside Saudi Arabia, financial services should obtain explicit approval from the Saudi Arabian Monetary Authority. These apply to banks, insurance and/or reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia.

Saudi Arabia has not signed the World Intellectual Property Organization (WIPO) Copyright Treaty.

Saudi Arabia’s National Data Management Office published the National Data Governance Interim Regulations, which requires firms to store and process personal data within Saudi Arabia “in order to ensure the preservation of the digital national sovereignty over such data.” Data Controllers may only process or transfer personal data outside the Kingdom after obtaining written approval from the relevant regulatory authority (Art. 5.4.16).

Saudi Arabia has not signed the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

Art. 13.8 of the Regulations for Licensing of Telecommunications and Information Technology Equipment provides a general requirement to disclose details of encryption systems contained in telecommunications and IT equipment intended to be supplied and used in the kingdom.

Trade secrets are governed by the Regulations for the Protection of Confidential Commercial Information (Trade Secrets Regulations). A commercial secret is defined under the Trade Secrets Regulations as information not known in its final form or where information is not usually easily obtainable by those engaged in this type of business, as well as where the information is of commercial value due to its confidentiality, and where the rightful owner takes reasonable measures to maintain its confidentiality. However, the Trade Secrets Regulations do not protect commercial secrets which are inconsistent with Shariah, public order and/or public morals (Art. 7). Obtaining, using or disclosing any commercial secret in a manner that is inconsistent with "honest commercial practices" and without the consent of the rightful owner is deemed an abuse of the commercial secret under the Trade Secrets Regulations.

It is reported that there is an obligation for passive infrastructure sharing in Saudi Arabia to deliver telecom services to end users. It is practised in both the mobile and fixed sectors based on commercial agreements.

Pursuant to Section 11.03 of the Ministry of Investment Services Manual, foreign ownership in the telecommunications sector is generally permitted, subject to specific restrictions depending on the nature of the activity. For telecommunications services, foreign ownership is limited to a maximum of 60%, whereas for value-added communications services, the cap is set at 70%.

The Saudi telecommunications market is dominated by three operators holding unified licences: Saudi Telecom Company (STC), Etihad Etisalat Company (Mobily) and Mobile Telecommunication Company Saudi Arabia (Zain KSA). It is reported that the State holds 62% of STC’s shares through the Public Investment Fund (PIF), a further 6.9% through the General Organization for Social Insurance (GOSI), and 4.9% of Zain KSA’s shares through GOSI. Although Saudi Arabia has reportedly pursued a limited privatisation programme for state-owned enterprises and assets since 2002, open to both domestic and foreign investors, this has so far resulted only in the partial privatisation of state-owned operators in the telecommunications sector.

According to Saudi Arabia's Accounting Separation Regulatory Framework, accounting separation is applied and required by law for operators with significant market power. However, functional separation for operators with significant market power is not required by law.

According to Art. 6 of the Implementing Regulations of the Telecommunication Act, the Communications, Space and Technology Commission (CST) Board of Directors may decide to cap the number of licences, registrations or permits in a given telecom/ICT market.

Under Art. 6 of the Rules for Foreign Investment in Securities, Saudi Arabia applies specific maximum foreign equity share limits to listed companies. A non-resident foreign investor (other than a foreign strategic investor) may not own 10% or more of the shares or convertible debt instruments of any listed issuer. In addition, the aggregate holdings of all foreign investors (resident and non-resident, excluding foreign strategic investors) in any single listed issuer may not exceed 49% of its shares or convertible debt instruments, subject also to stricter limits that may be set in the company’s articles of association or other applicable regulations.

According to Section 5.1.2 of the Regulations of Localization Obligations for Telecommunications Service Providers, operators holding licences or permits such as the Unified Facility-Based Telecommunications Services Licence, Facilities-Based Fixed Telecommunications Services Licence, Mobile Virtual Network Operator (MVNO) Licence, Internet of Things Virtual Network Operator (IoT-VNO) Services Licence, and the Licence to Provide Wholesale Services for Infrastructure must comply with specified Saudization (localisation) requirements for leadership and general staff positions.
These providers must ensure that the Chief Executive Officer is a Saudi national, that Senior Management (Level I) positions are localised at a rate of at least 75%, that Senior Management (Level II) positions are localised at a rate of at least 80%, and that an overall localisation rate of no less than 80% is achieved across all employees in the company.

According to Art. 7 of the Investment Law of 2024, the Ministry of Investment is required to establish a national register of investors and to receive investors’ applications for the legal approvals necessary to engage in investment activities, including the issuance of any licences or permits. Under Art. 8, the competent authority must issue and update a list of excluded (negative list) activities, which the Ministry must publish, and any foreign investor wishing to engage in an activity included in this list must first obtain prior approval from the Ministry of Investment. It is reported that the negative list covers, inter alia, audiovisual and media services, electronic mail services, the provision of online information and database retrieval services, as well as several telecommunications services.