While Saudi Arabia maintains strong patent enforcement laws, including clear sanctions and various remedial actions, it is reported that enforcement efforts are hindered by the absence of clear legal definitions, particularly in relation to online protections.

Art. 5.4 of the General Principles for Personal Data Protection in the Telecommunication, IT, and Postal Services requires that service providers of telecommunication, IT and postal services process customers’ personal data within Saudi Arabia and prohibits them from processing customers’ personal data out of Saudi Arabia without the authorisation of Communication and Information Technology Commission (CITC).

Saudi Arabia is a party to the Patent Cooperation Treaty (PCT).

Art. 3.4.3 of the Cyber Security Framework of the Saudi Arabian Monetary Authority mandates that financial institutions should use cloud services located in Saudi Arabia. If the cloud services are outside Saudi Arabia, financial services should obtain explicit approval from the Saudi Arabian Monetary Authority. These apply to banks, insurance and/or reinsurance companies, financing companies and credit bureaus operating in Saudi Arabia.

Saudi Arabia has a copyright regime under the Royal Decree No. M/11 on Copyright Law. However, the exceptions do not follow the fair use or fair dealing model, therefore limiting the lawful use of copyrighted work by others. Art. 15 lists the exceptions, which include copying the work for personal use, quoting passages from the work in another work, and using the work by way of clarification for educational purposes, among others.

Saudi Arabia’s National Data Management Office published the National Data Governance Interim Regulations, which requires firms to store and process personal data within Saudi Arabia “in order to ensure the preservation of the digital national sovereignty over such data.” Data Controllers may only process or transfer personal data outside the Kingdom after obtaining written approval from the relevant regulatory authority (Art. 5.4.16).

Saudi Arabia has not signed the World Intellectual Property Organization (WIPO) Copyright Treaty.

Art. 7 of the Internet of Things (IoT) Regulatory Framework requires all servers, devices, and network components providing an IoT service and all data relating to the service must be located within Saudi Arabia.

Art. 3 of the Government Tenders and Procurement Law stipulates that foreign suppliers can only participate in the public procurement only if the following conditions apply:
- the relevant scope of work shall be posted on the procurement portal to ensure that there is no more than one local person qualified to carry out the work; and
- the Ministry of Investment (the key regulator of foreign investment) approves the arrangement.

Art. 11.9 of the Regulations for Importation and Licensing of Telecommunications and Information Technology Equipment provides a general requirement to disclose details of encryption systems contained in ICT equipment being imported, including equipment imported for government public procurement.

Art. 35 of the Government Tenders and Procurement Law sets out a range of measures regarding knowledge transfer. The regulation stipulates that contracts in government tenders impose knowledge transfer requirements, which include practical and theoretical skill transfer. The regulation does not define further what type of knowledge transfer is required.

The Regulation on Preference for Local Content, Local SMEs, and Publicly Listed Companies establishes price preferences for Saudi SMEs and publicly listed companies in government tenders. Local SMEs in which Saudi nationals own greater than a 50% stake receive a 10% price advantage on bidding, while publicly listed companies receive a 5% price advantage.
In addition, the Government Tenders and Procurement Law states priority should be given to local SMEs if the value of the government purchases is not more than 500,000 riyals (approx. 130.000 USD) (Art. 30). The regulation further states that the bidding process is not required for government contracts with SMEs.

According to Art. 9 of the Government Tender and Procurement Law, priority shall be given to local small- and medium-sized enterprises, local content, and companies listed in the Capital Market.
Art. 4 of the Regulations on Preference for Local Content and Local SMEs and Companies Listed on the Capital Market in Business and Procurement Transactions stipulates that upon tendering its projects and procurements, a government agency shall grant local SMEs in which Saudi nationals own greater than a 50% stake a price preference, by assuming that the bid prices of other establishments are 10% higher than the price stated in the bid documents. Furthermore, according to Art. 10, government agencies shall, in all contracts, apply the National Product Price Preference Mechanism to national products not included in the mandatory list. A national product shall be granted a price preference by assuming that the price of a foreign product is 10% higher than the price stated in the bid documents.

Under the Cloud Computing Services Provisioning Regulations, government entities are permitted to host their data only with cloud service providers (CSPs) that hold the appropriate licences or registrations issued by the Communications, Space & Technology Commission of Saudi Arabia (CST). Section 3.3.7 mandates that subscribers whose data is classified as data of Saudi government agencies must utilise CSPs registered with the CST.
These Regulations represent the fourth iteration of this legislative framework. Since the introduction of the initial version, the legislation has included progressively stringent provisions. Notably, Section 3.3.9 prohibited the transferring, storing, or processing only of Level 3 data unless the provider was registered with local authorities. Level 3 data encompasses, among other categories, sensitive information managed by public authorities.

The Regulatory Arrangements for the Local Content and Government Procurement Law mandates the Local Content and Government Procurement Authority (LCGPA) to set local content requirements for individual contracts, track the amount of local content used by contractors, and obtain and audit commitments by contractors to increase their reliance on local content in the public procurement. The Law defines local content as “total spending in Saudi Arabia from the participation of Saudi elements in the workforce, goods, services, assets, technology, etc.” The Law requires the bidder in public procurement to include a list of items provided locally in their proposal, and this list of items will vary for each bidding. The bidder should meet a minimum baseline of local content provided by LCGPA in order to participate. LCGPA also manages an online portal through which contractors register their commitments to increase local content. Contractors who fall short of their commitments will be fined and could be blacklisted from procurement for repeated failures to honour commitments over the long term.