IT and Telecommunications Law in Saudi Arabia: Understanding the New Regulatory Landscape

Saudi Arabia’s new Telecommunications and Information Technology Act, effective since 8 December 2022, aims to boost the nation’s telecoms and IT sectors, promoting digital transformation. Replacing the 2001 legislation, the Act extends the range of services under telecoms regulation.

Key points include:

1. Extended Scope: Besides traditional telecom services, the Act includes services like Saudi domain name registration. The Communications, Space & Technology Commission (CST) can also mandate licensing for digital content platforms, IT-related device users, or those establishing private telecom networks. This broad power could bring diverse businesses under telecoms regulations.
2. Licensing: Licenses procured before the Act’s enforcement are still valid, but adherence to new regulations is a must by 8 December 2023.
3. Ownership Changes: Fixed and mobile service providers no longer need to operate as public joint-stock companies. Moreover, significant ownership changes or senior management modifications need CST’s approval.
4. Internet Filtering: The Act formally authorizes CST to manage internet filtering, restricting access to specific online content. Circumventing this filtering system is prohibited.
5. Data Confidentiality and Protection: The Act includes provisions related to user data confidentiality, aligning with the upcoming Saudi Personal Data Protection Law.
6. Cybersecurity: Emphasis on the National Cybersecurity Authority (NCA) highlights compliance with its cybersecurity standards, especially for service providers deemed crucial to national infrastructure. The NCA can mandate mutual agreements for cybersecurity, verify compliance levels, impose penalties for violations, and potentially retract such powers after coordinating compliance programs with CST.

The interplay between new data protection, cybersecurity obligations, and immediate data breach reporting requirements remains to be seen in practice.