According to the GSO Technical Regulation for Low Voltage Electrical Equipment and Appliances – BD-142004-01, which includes an amendment and an update of the first edition, number (BD07070503) was implemented in 2007. Electrical appliances designed to be used in a certain rated voltage range must be sold bearing the G mark after being certified by the GCC Notified Body.
Products that fall under List 1 under the Regulation are low-risk; thus, a self-declaration form prepared by the manufacturer can be made by affixing the “G” before placing the product on the market. Products that fall under List 2 are higher-risk electrical products, which will undergo mandatory Type testing and review of the product's Technical File to verify conformity before authorisation is granted to affix the “G” mark before placing the product onto the market.
However, for List 2 products, manufacturers must choose a single Notified Body (NB) entity to examine the technical design of a product and verify that the technical design of the product meets the requirements of the applicable Gulf Technical Regulations and for the issuance of an evaluation report with a Gulf Type Examination certificate and shall be issued a certificate from the NB.
It is reported that not all agencies offering Saudi Standards, Metrology and Quality Organization (SASO) Certificate of Conformity (CoC) services are recognised in Saudi Arabia, which can complicate companies wishing to export their goods to Saudi Arabian markets. These certificates should be obtained only from authorised agencies recognised in Saudi Arabia.

According to Art. 8 of the Regulations for Licensing of Telecommunications and Information Technology Equipment, imported ICT products to Saudi Arabia cannot clear customs without the Communications, Space & Technology Commission (CST) Certificate of Conformity (CoC). The ICT equipment must comply with the technical specifications issued by the CST. The CST does not accept similar conformity certificates from other countries.

The National Cybersecurity Authority (NCA) has launched the National Cryptographic Standards (NCS) to meet the national need by specifying the minimum requirements necessary to provide the degree of protection required for national data, systems and networks using cryptographic mechanisms for civilian and commercial purposes, based on global best practices and global standards.
However, Art. 13.8 of the Regulations for Licensing of Telecommunications and Information Technology Equipment provides a general requirement to disclose details of encryption systems contained in telecommunications and IT equipment intended to be supplied and used in the kingdom.

Under Art. 15 of the E-Commerce Law, a business must register their e-shop in the Commercial Register in accordance with the Law of the Commercial Register, with the detailed requirements specified in the Implementing Regulations. Art. 12 of the Implementing Regulations provides that a trader must register the main electronic shop in the Commercial Register within 30 days of its establishment by submitting an electronic application via the Ministry’s website. The application must include, at a minimum, the applicant’s name, commercial registration number, the activities to be carried out through the electronic shop, and a description and address of the main electronic shop.
Where a practitioner seeks to register an electronic shop in order to acquire trader status, the application must instead contain the practitioner’s name and identification number, residential address, telephone number and e-mail address, together with the activities to be conducted through the electronic shop and a description and address of the main electronic shop.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is SAR 1000 (approx. USD 250), above the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

According to Section 4 of the Saudi Domain Name Registration Regulation, domain name registration services are restricted to the following categories: (i) entities physically located in Saudi Arabia; (ii) natural persons holding a Saudi national ID or Premium Residency; (iii) entities licensed by a competent authority in Saudi Arabia; and (iv) owners of trademarks or trade names registered in Saudi Arabia. In addition, a local administrative contact is required for each registration. Domain name services for Saudi country-code top-level domains (ccTLDs), including the Saudi ASCII ccTLD (.sa) and the Saudi IDN ccTLD, are managed by the Saudi Network Information Center (SaudiNIC).

The E-Commerce Law establishes a comprehensive framework for consumer protection applicable to online transactions. This legislation governs e-commerce activities between consumers in Saudi Arabia and service providers globally, including transactions between individuals. The law encompasses provisions on various issues, such as the protection of consumer data, transparency in contracting and electronic advertisements, as well as consumer rights, including the right to returns and cancellations under specific circumstances. According to regulatory authorities, the implementation of this framework has enhanced trust in online transactions and has made it easier for consumers to file e-commerce-related complaints with the authorities, owing to the strengthened consumer protection measures.

It is reported that individuals are required to use their legal names when signing mobile-service contracts and must provide a national identification card or residence permit. Moreover, Since 2016 the Communications, Space & Technology Commission (CST), mobile service providers to register the fingerprints of new SIM-card subscribers within 90 days. The collected information is subsequently shared with a centralised database managed by the Ministry of the Interior.

Saudi authorities are reported to regularly block access to news outlets and other websites based on geopolitical and domestic political considerations. While widely used social media and communication applications are not consistently blocked, some users have reported that Clubhouse is inaccessible, despite the absence of an official government statement confirming its restriction. Furthermore, regulators and telecommunications operators have historically taken a restrictive stance toward free or low-cost Voice over Internet Protocol (VoIP) services. These services are perceived as undermining traditional mobile call revenues, circumventing existing regulatory frameworks, and potentially evading surveillance mechanisms. In this context, the Communications, Space, and Technology Commission (CST) and domestic ISPs have previously blocked applications such as Viber, WhatsApp, and FaceTime, as well as integrated messaging features on platforms like Facebook Messenger. As of June 2024, most VoIP applications were accessible in Saudi Arabia, with the exception of WhatsApp, which reportedly remains restricted.
Moreover, between 2017 and 2024, websites affiliated with Qatari, Iranian, and Turkish media were intermittently blocked in the context of ongoing regional tensions. Platforms critical of the Saudi government—such as al-Manar, the Beirut-based broadcaster—have also been subject to restrictions. According to available reports, internet service providers (ISPs) in the Kingdom have deployed WireFilter censorship technology to target specific web pages.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in Saudi Arabia for the year 2024. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."
Although Saudi Arabia was identified as a 'repeat offender' for implementing internet shutdowns in 2023, a practice it has consistently maintained since 2016, and was among the MENA countries enforcing such measures during that year, reports indicate that the country carried out one internet shutdown in 2024.

It is reported that, in September 2022, the General Commission for Audiovisual Media (GCAM) introduced the “Mawthooq” protocol requiring individuals who generate income from online marketing, including social media influencers, to obtain an official licence to advertise on social media. Under this framework, non-Saudi residents and visitors are prohibited from posting advertisements on social media unless they hold a valid licence and operate through an established commercial entity. The regulatory text could not be located in publicly available online sources.

Online publishers (including publishers of blogs, forums and short messaging) cannot operate without explicit approval from the highest levels of government. The Executive Regulation for Electronic Publishing Activity stipulates licensing by the Media Ministry as a requirement for those seeking to publish online (Article 7). The regulation requires applicants to be Saudi nationals, at least 25 years old, a university graduate, of “good conduct,” and not be employed by the government. Article 15 of the Law prohibits publishing anything that contravenes Islamic law, violates public order, or serves “foreign interests,” as well as material inciting a “spirit of discord” within society.

The communications regulator in the Kingdom of Saudi Arabia, the Communications, Space and Technology Commission, has issued updated Cloud Computing Services Provisioning Regulations, which replace version 3 of the Cloud Computing Regulatory Framework (CCRF v3). Under the cloud regulatory framework, any cloud computing service provider that exercises direct or effective control over a data centre or other critical cloud infrastructure hosted and used in Saudi Arabia for the provision of cloud computing services must be registered with CST. In addition, such providers are required to use telecommunications infrastructure (including international connectivity) only through operators licensed by CST.

According to Section 4 of the Regulations of the General Class License (GCL), the GCL permits the provision of several telecommunications services, including Internet of Things Virtual Network Operator (IoT-VNO) services and IoT services using licence-exempt frequency bands.
In addition, pursuant to Section 5-2 of the Internet of Things (IoT) Regulatory Framework, only entities that have obtained the relevant licences from the CST are allowed to provide IoT connectivity services using wired fixed-line networks or licensed-frequency wireless networks.

The Regulations for Providing Digital Content Platform Services issued by the Communications, Space and Technology Commission (CST) establish licensing, registration, and notification requirements for local and international digital content platforms within their scope. Covered services include satellite pay-TV, IPTV, video-on-demand (video OTT), audio-on-demand and internet radio, social media, video-sharing, and e-sports participation platforms (Arts. 4–5).
Under Art. 5 and Annexes 1–2, satellite pay-TV and IPTV platforms must obtain a CST licence, valid for 10 years, and pay application and annual regulatory fees. Video OTT platforms and audio-on-demand/internet radio platforms must obtain Category A registration, valid for five years, and pay a registration fee. Social media, video-sharing, and e-sports participation platforms must obtain Category B registration, which is open-ended and not subject to application or annual fees.
In addition, Art. 9 provides that foreign service providers without a commercial registration and/or a foreign investment licence in the Kingdom may contact CST to clarify the requirements for obtaining a CST licence and to confirm the status of an application once submitted. This clarification may be sought before completing the legal steps to obtain a commercial registration, a foreign investment licence, and/or other authorisations required to provide the licensed service in the Kingdom.
Moreover, these service providers shall appoint a Platform Liaison Officer in order to receive and respond to the CST's communications and requests.