Saudi Arabia's Cybercrime Law — What's Prohibited and What to Do
Saudi Arabia's Anti-Cybercrime Law combined with the PDPL creates one of the Gulf's most comprehensive digital crime frameworks. Understanding what is criminalized and how to respond as a victim or as an organization with compliance obligations is essential knowledge.
Related Services:
The Legal Framework
The Anti-Cybercrime Law targets acts harming the confidentiality, integrity, and availability of data and systems. Key offenses: unauthorized system access (up to one year and SAR 500,000 even without visible damage); electronic blackmail using private content (up to one year and SAR 500,000 doubling on repetition); online defamation including re-sharing defamatory content as an independent offense (up to one year and SAR 1,000,000); identity impersonation (up to three years and SAR 2,000,000). The PDPL adds organizational obligations including breach notification to SDAIA within 72 hours, data subject rights fulfillment within 30 days, and SDAIA approval for cross-border data transfers.
How It Works in Practice
If you are being blackmailed: do not pay — payment proves effectiveness and guarantees escalating demands. Document everything immediately with full-screen screenshots showing sender identity, platform, date, and time. Report through the Kollona Amn app or 911. Contact a specialist lawyer before any further engagement. For PDPL compliance: conduct a data inventory, update privacy notices, build a breach response plan with 72-hour notification capability before a breach occurs.
Need specialized legal help?
Our licensed lawyers are ready to respond instantly via WhatsApp — at no charge and with no obligation.
Common Mistakes to Avoid
Never delete digital evidence — even communications that seem minor build the pattern that strengthens a prosecution. Never respond to blackmailers directly without lawyer guidance. Never assume PDPL doesn't apply to your organization because you are based outside Saudi Arabia — the extraterritorial reach is real and actively enforced.
When You Need a Specialist Lawyer
A specialist lawyer ensures digital evidence is presented in the format Saudi courts require for admissibility. PDPL compliance counsel should be engaged before a breach occurs — organizations that build their response plan after a breach consistently fail the 72-hour notification window.
Legal Disclaimer
This article is for informational purposes only. Consult a licensed Saudi lawyer for advice specific to your situation.
Preserving Evidence in a Cybercrime Case
Cybercrime cases are won or lost on what you captured before you reacted. Screenshots should show the sender’s identity, the timestamp, and enough of the surrounding interface to prove which platform it came from — a cropped image of the text alone is far weaker. Keep the original messages and any account handles or URLs; do not delete the thread, and do not edit anything you intend to rely on.
Resist the instinct to confront or negotiate with the other party first. In extortion cases especially, paying or replying almost always escalates the demands and can complicate your own position. Report through the official channels — the Public Prosecution, the Kollona Amn app, or the police — and let the investigation compel the platform data you cannot obtain yourself.
The Anti-Cyber Crime Law carries real penalties, including imprisonment and substantial fines, and the specific offence you are reporting shapes the evidence you need. A defamation complaint, an unauthorised-access complaint, and a blackmail complaint each rest on different facts, which is why an early conversation with a lawyer usually changes what you preserve.