Cybercrime Penalties in Saudi Arabia

The Anti-Cyber Crime Law — Royal Decree M/17

The Anti-Cyber Crime Law (Royal Decree M/17, dated 8/3/1428H, corresponding to March 2007) is the primary statute. Its drafting was deliberately broad: rather than enumerating specific computer-misuse offences, it works in conjunction with the penal code and the Anti-Harassment Law to upgrade penalties whenever a crime uses digital means. The result is that almost any traditional offence — defamation, extortion, threat, fraud, breach of privacy — receives a harder sentence when prosecuted under this statute.

The Five Core Offence Categories

Article 3 criminalises unauthorised access to information systems and data interception. Article 4 covers electronic extortion and threats — penalties up to one year and 500,000 SAR. Article 5 addresses content "infringing public morals" and family-sanctity material — penalties up to five years and three million SAR. Article 6 governs content "prejudicing public order, religious values, public morals, or privacy" — the broadest provision in the statute and the one most often invoked. Article 7 covers terrorist content and unauthorised access to government data, with penalties up to ten years.

Article 6 — The Provision That Catches Most Cases

Article 6 is where most ordinary cybercrime cases land. Its text is intentionally elastic: "production, preparation, transmission, or storage of material prejudicing public order, religious values, public morals, or privacy" through an information network. Penalties reach five years and three million SAR. In practice this captures: sharing a video without consent of the people in it, posting screenshots of private conversations, recording calls without disclosure, distributing photos labelled offensive to public morals, and any social media post that a complainant can frame as a privacy breach. The "privacy" prong of Article 6 is now the most-used provision in Saudi criminal prosecutions.

Electronic Extortion — Article 4 in Detail

Electronic extortion follows a recognisable pattern in Saudi cases: a victim's intimate images or compromising messages are obtained (often from a former relationship, sometimes from a hacked device), and the perpetrator demands money or further contact in exchange for non-publication. Saudi law treats this with particular severity. The penalty escalates if the victim is a female or a minor, if multiple victims are involved, or if the material was actually published. Public prosecution treats these cases as priority files and frequently coordinates with international authorities when the perpetrator is outside the Kingdom. The single most important action for victims is preserving evidence without engaging further with the extortionist — every additional message strengthens the prosecution's case.

Defending a Cybercrime Charge

Cybercrime defences turn on technical evidence rarely understood by generalist criminal lawyers. Device forensics matter: was the alleged content actually generated from the defendant's device, or could it have been planted, spoofed, or generated from a hijacked account? Timeline analysis matters: do server logs match the prosecution's timeline, or are there gaps that suggest evidence tampering? Account ownership matters: in shared-device households, can the prosecution prove the defendant personally operated the account at the moment of the alleged offence? A defendant who concedes account ownership without challenging the technical foundation accepts the prosecution's framing.

The First Critical Step — Preserving Digital Evidence

Whether you are reporting a cybercrime or defending against one, the first 72 hours are governed by digital evidence integrity. For victims: take screenshots with full URL bars and timestamps visible, request hashed copies from platform providers immediately (WhatsApp, X, Snapchat each have different retention windows), preserve any device involved without further use, and avoid posting about the incident publicly. For accused parties: do not delete anything — deletion is forensically recoverable and the deletion itself becomes circumstantial evidence of consciousness of guilt. Do not provide device passwords without counsel present and a clear understanding of what's on the device.

Common Questions About Cybercrime Cases

Can I be prosecuted for content I posted while abroad? Yes — Saudi courts have asserted jurisdiction over content that reaches users within the Kingdom regardless of where the publisher was physically located when posting. This applies particularly to material involving Saudi citizens, Saudi institutions, or Saudi public order.

What if the account that posted the content was hacked? Account compromise is a recognised defence, but the burden of evidence sits with the accused. Platform login logs, IP records, and device forensics are needed to establish that the account was operated by someone other than the registered owner at the moment of the offence.

Is recording a phone call I'm a participant in legal? No — Saudi law requires disclosure to all participants before any audio recording, and the resulting recording is generally inadmissible against the other party. Sharing such a recording can itself be a separate cybercrime offence under Article 6.

How long do cybercrime cases typically take? Public prosecution stage: 30–90 days for non-complex matters. First-instance court: 60–180 days. Appeal: additional 90–120 days. Cases involving cross-border evidence or multiple defendants extend significantly.

When You Need a Cybercrime Specialist

Any case involving extortion, leaked private images, accusations under Article 6, or a charge that combines cybercrime with another offence (harassment, fraud, defamation) is not generalist work. The technical evidence demands a lawyer who can read forensic reports and challenge them, who understands platform retention policies, and who has handled similar cases through to verdict. We connect you with such a Saudi lawyer immediately — and for victims of ongoing extortion, the response is measured in hours not days. See also: Anti-Cyber Crime Law explainer · criminal litigation services.