Under Art. 15 of the E-Commerce Law, a business must register their e-shop in the Commercial Register in accordance with the Law of the Commercial Register, with the detailed requirements specified in the Implementing Regulations. Art. 12 of the Implementing Regulations provides that a trader must register the main electronic shop in the Commercial Register within 30 days of its establishment by submitting an electronic application via the Ministry’s website. The application must include, at a minimum, the applicant’s name, commercial registration number, the activities to be carried out through the electronic shop, and a description and address of the main electronic shop.
Where a practitioner seeks to register an electronic shop in order to acquire trader status, the application must instead contain the practitioner’s name and identification number, residential address, telephone number and e-mail address, together with the activities to be conducted through the electronic shop and a description and address of the main electronic shop.

It is reported that the de minimis threshold, that is the minimum value of goods below which customs do not charge duties, is SAR 1000 (approx. USD 250), above the 200 USD threshold recommended by the International Chamber of Commerce (ICC).

According to Section 4 of the Saudi Domain Name Registration Regulation, domain name registration services are restricted to the following categories: (i) entities physically located in Saudi Arabia; (ii) natural persons holding a Saudi national ID or Premium Residency; (iii) entities licensed by a competent authority in Saudi Arabia; and (iv) owners of trademarks or trade names registered in Saudi Arabia. In addition, a local administrative contact is required for each registration. Domain name services for Saudi country-code top-level domains (ccTLDs), including the Saudi ASCII ccTLD (.sa) and the Saudi IDN ccTLD, are managed by the Saudi Network Information Center (SaudiNIC).

The E-Commerce Law establishes a comprehensive framework for consumer protection applicable to online transactions. This legislation governs e-commerce activities between consumers in Saudi Arabia and service providers globally, including transactions between individuals. The law encompasses provisions on various issues, such as the protection of consumer data, transparency in contracting and electronic advertisements, as well as consumer rights, including the right to returns and cancellations under specific circumstances. According to regulatory authorities, the implementation of this framework has enhanced trust in online transactions and has made it easier for consumers to file e-commerce-related complaints with the authorities, owing to the strengthened consumer protection measures.

The communications regulator in the Kingdom of Saudi Arabia, the Communications, Space and Technology Commission, has issued updated Cloud Computing Services Provisioning Regulations, which replace version 3 of the Cloud Computing Regulatory Framework (CCRF v3). Under the cloud regulatory framework, any cloud computing service provider that exercises direct or effective control over a data centre or other critical cloud infrastructure hosted and used in Saudi Arabia for the provision of cloud computing services must be registered with CST. In addition, such providers are required to use telecommunications infrastructure (including international connectivity) only through operators licensed by CST.

According to Section 4 of the Regulations of the General Class License (GCL), the GCL permits the provision of several telecommunications services, including Internet of Things Virtual Network Operator (IoT-VNO) services and IoT services using licence-exempt frequency bands.
In addition, pursuant to Section 5-2 of the Internet of Things (IoT) Regulatory Framework, only entities that have obtained the relevant licences from the CST are allowed to provide IoT connectivity services using wired fixed-line networks or licensed-frequency wireless networks.

The Regulations for Providing Digital Content Platform Services issued by the Communications, Space and Technology Commission (CST) establish licensing, registration, and notification requirements for local and international digital content platforms within their scope. Covered services include satellite pay-TV, IPTV, video-on-demand (video OTT), audio-on-demand and internet radio, social media, video-sharing, and e-sports participation platforms (Arts. 4–5).
Under Art. 5 and Annexes 1–2, satellite pay-TV and IPTV platforms must obtain a CST licence, valid for 10 years, and pay application and annual regulatory fees. Video OTT platforms and audio-on-demand/internet radio platforms must obtain Category A registration, valid for five years, and pay a registration fee. Social media, video-sharing, and e-sports participation platforms must obtain Category B registration, which is open-ended and not subject to application or annual fees.
In addition, Art. 9 provides that foreign service providers without a commercial registration and/or a foreign investment licence in the Kingdom may contact CST to clarify the requirements for obtaining a CST licence and to confirm the status of an application once submitted. This clarification may be sought before completing the legal steps to obtain a commercial registration, a foreign investment licence, and/or other authorisations required to provide the licensed service in the Kingdom.
Moreover, these service providers shall appoint a Platform Liaison Officer in order to receive and respond to the CST's communications and requests.

According to Section 4 of the Regulations of the General Class License (GCL), the GCL permits the provision of various telecommunications services, including Virtual Voice Services (VVSP). The Regulations on the Provision of Virtual Voice Services further clarify that permit holders may provide virtual voice services via Internet protocol to end users in Saudi Arabia and may purchase and operate the associated equipment.
As set out in Section 6, an applicant for a VVSP permit must apply via the e-licensing system, hold a valid GCL with at least six months’ remaining validity, and submit a valid Saudi commercial registration (with at least three months’ remaining validity) indicating the relevant activity, together with a company profile, technical specifications of the systems and devices, numbering requirements and the required regulatory compliance information. Under Section 5, permit holders must establish in the Kingdom both a network operations centre to provide customer and support services and the technical and interconnection equipment necessary to meet the requirements imposed by the competent authorities. All international telecommunications traffic must pass through networks of CST-licensed international carriers, and CST allocates numbering resources and signalling point codes in accordance with the national numbering plan and related regulations, which the permit holder must use in compliance with CST decisions (Sections 5-1 to 5-5).

It is reported that Saudi Arabia prohibits all imports of goods and services from Israel. Additionally, it is reported that Saudi Arabia has extended this ban to all products and services from Lebanon since 2021.

According to Art. 5.4 of the Internet of Things (IoT) Regulatory Framework, all SIM cards used in IoT devices must be issued by telecommunications service providers licensed by the the Communications, Space & Technology Commission (CST)

According to Art. 9.1 of the Regulations for Licensing of Telecommunications and Information Technology Equipment, any party wishing to import telecommunications and IT equipment, that is in the list of restricted goods, shall apply for Customs Clearance Permission from the Communications, Space, and Technology Commission (CST). The list of restricted goods and their tariff codes can be found at Zakat, Tax and Customs Authority website, however, this is not accessible. It is reported that restricted products include wireless products, satellite internet services, equipment transmitting pictures wirelessly, and pre-paid telephone recharging cards.

Saudi Arabia restricted the import of certain products by requiring permission from the General Commission for Audiovisual Media (GCAM). These include any audio/video content on transportable media, tapes, disks, storage equipment, and audio/video broadcasting and receiving equipment through any communication utility (cable, land or other communication networks).

It is reported that individuals are required to use their legal names when signing mobile-service contracts and must provide a national identification card or residence permit. Moreover, Since 2016 the Communications, Space & Technology Commission (CST), mobile service providers to register the fingerprints of new SIM-card subscribers within 90 days. The collected information is subsequently shared with a centralised database managed by the Ministry of the Interior.

Saudi authorities are reported to regularly block access to news outlets and other websites based on geopolitical and domestic political considerations. While widely used social media and communication applications are not consistently blocked, some users have reported that Clubhouse is inaccessible, despite the absence of an official government statement confirming its restriction. Furthermore, regulators and telecommunications operators have historically taken a restrictive stance toward free or low-cost Voice over Internet Protocol (VoIP) services. These services are perceived as undermining traditional mobile call revenues, circumventing existing regulatory frameworks, and potentially evading surveillance mechanisms. In this context, the Communications, Space, and Technology Commission (CST) and domestic ISPs have previously blocked applications such as Viber, WhatsApp, and FaceTime, as well as integrated messaging features on platforms like Facebook Messenger. As of June 2024, most VoIP applications were accessible in Saudi Arabia, with the exception of WhatsApp, which reportedly remains restricted.
Moreover, between 2017 and 2024, websites affiliated with Qatari, Iranian, and Turkish media were intermittently blocked in the context of ongoing regional tensions. Platforms critical of the Saudi government—such as al-Manar, the Beirut-based broadcaster—have also been subject to restrictions. According to available reports, internet service providers (ISPs) in the Kingdom have deployed WireFilter censorship technology to target specific web pages.

The indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in Saudi Arabia for the year 2024. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."
Although Saudi Arabia was identified as a 'repeat offender' for implementing internet shutdowns in 2023, a practice it has consistently maintained since 2016, and was among the MENA countries enforcing such measures during that year, reports indicate that the country carried out one internet shutdown in 2024.