( Guide · Ecommerce · Saudi Arabia )
Saudi E-Commerce Law: what your online store must display, promise and do
By OGB Labs · Published
The law, who enforces it and who it covers
The E-Commerce Law was issued by Royal Decree M/126 dated 10 July 2019. The Ministry of Investment hosts an English translation of the law, and the Ministry of Commerce publishes the Arabic text, its Executive Regulations, a guide for online stores and a compliance checklist on its e-commerce law hub. The Ministry's October 2019 release set enforcement "starting from Sunday 20.10.2019," 90 days after publication in the Official Gazette.
Article 2 applies the law to service providers in the Kingdom, to "practitioners outside the Kingdom who offer products or services to consumers in the Kingdom," and to consumers. Article 3 adds that using a domain or email tied to a country does not by itself place your business address there. In short, if Saudi consumers can buy from you, the law reaches you wherever the company sits.
The law distinguishes a merchant, a person registered in the Commercial Register who practises e-commerce, from a practitioner, who sells online without being registered. Both are service providers with the same consumer-facing duties, but Article 15 adds a registration duty for merchants.
What the store must display: Article 6
Article 6 requires a service provider to disclose in the e-shop:
- The seller's name or any identifying characteristic, and its address, unless the seller is registered with an e-shop authentication entity licensed by the Ministry.
- Contact information.
- The name and number of its commercial registration, if any, or of any other publicly available register.
- Any other data specified by the Executive Regulations.
What the customer must see before paying: Articles 7 and 9
Article 7 requires the provider to give the consumer a statement of the terms and conditions of the contract that also covers:
- The procedures to conclude the contract, in practice the checkout steps.
- Information about the service provider.
- The basic characteristics of the products or services.
- The total price, "including all charges and taxes, and delivery fees, if any."
- Arrangements for payment, processing and delivery.
- Warranty information, if any.
- For regulated professions, Article 9 adds the licensing agency, the licence or permit details, and the professional title and granting country.
The invoice: Article 8
On conclusion of the contract, Article 8 requires an itemised invoice stating the total price including all charges and taxes, delivery fees if any, and the date and place of delivery. The Ministry's compliance checklist breaks this into separate lines: the base price of the product, the tax value or rate within the total, additional charges such as cash on delivery, installation or packaging, the shipping and delivery charge, the delivery period or date, and the carrier's name and tracking number.
For VAT-registered sellers this invoice must also meet ZATCA's e-invoicing rules, which now reach businesses above SAR 187,500 in annual revenue. Our guide to ZATCA e-invoicing Phase 2 covers the technical side, and Saudi VAT registration for online sellers covers when you must register. Design the order confirmation once so it satisfies both.
Customer data: Article 5
Article 5 sets two rules that predate the Personal Data Protection Law and still apply alongside it. First, a provider may not retain a consumer's personal data or electronic communications beyond "the period required by the nature of the electronic transaction" unless a different period is agreed, must protect that data, and is responsible for it even when it sits with agents and partners such as couriers and payment gateways. Second, a provider may not use the data for unauthorised purposes or disclose it to others, free or for payment, without the consumer's consent or a legal requirement.
The Personal Data Protection Law layers a privacy notice, consent rules, data subject rights and breach notification on top. The practical answer is one privacy policy and one data map that satisfy both, as set out in our guide to Saudi PDPL compliance for websites and apps.
Advertising and marketing: Articles 10 to 12
- Article 10 makes an electronic advertisement "an integral part of the contract" and legally binding, so a price or promise in an Instagram post or a Google ad is a term of the sale.
- Every advertisement must carry the product or service name, the seller's name or identifying characteristic unless it is registered with an authentication entity, and the seller's contact information.
- Article 11 prohibits false offers, statements or claims that deceive or mislead, and the use of logos or trademarks that are counterfeit or that the seller has no right to use.
- Article 12 lets the Ministry order a non-compliant advertisement to be corrected or withdrawn within one day of notification, separately from any fine.
- The Ministry's checklist also expects customers to be able to stop receiving electronic advertisements and to cancel their account, so build an unsubscribe and an account deletion path.
Returns, delivery times and cancellations: Articles 13 and 14
Article 13 gives the consumer the right to rescind the contract within seven days of receiving the product, or of the date of a service contract, provided they have not used the product or benefited from the service. Unless agreed otherwise, the consumer bears the cost of rescission. The right does not apply to:
- Customised products or products made to the consumer's request, unless defective or not as agreed.
- Video, audio, discs or software that have been used.
- Newspapers, magazines, books and other publications.
- Defects caused by the consumer's mishandling.
- Accommodation, transport and catering services.
- Downloadable software, unless it is faulty or does not match the agreed specification.
- Other cases the Executive Regulations specify for particular products or services.
Late delivery
Article 14 entitles the consumer to rescind the contract and claim a refund of all amounts paid, plus costs caused by the delay, if delivery or performance is more than 15 days late from the contract date or the agreed date, unless the parties agreed an extension or the delay is force majeure. The provider must also notify the consumer of any anticipated delay. The Ministry's checklist adds a disclosure duty upstream: state the maximum delivery time before the order is completed.
For a store this means three things in the build: a visible delivery promise per region on the product and checkout pages, a status notification when a shipment slips, and an order workflow that can cancel and refund in full without a support ticket. Cash on delivery and Saudi gateways both have their own refund mechanics, which our guide to payment gateways in Saudi Arabia explains.
Registering the store and Maroof
Article 15 requires a merchant to register the e-shop in the Commercial Register, and the Ministry's checklist lists recording the store's link in the commercial registration as a separate compliance point. If you trade under a commercial registration, add the store URL to it.
Article 16 gives the Ministry power to regulate e-shop authentication entities and intermediary platforms, and Articles 6 and 10 relax the name-and-address disclosure for sellers registered with an authentication entity. The Ministry's own platform for this is Maroof. In an August 2020 release on penalties against 44 stores, the Ministry urged consumers to buy only from stores "that have a commercial registration, or from those registered with 'Maroof' platform, or from the well-known global sites." A Maroof listing is therefore both a trust signal to Saudi buyers and the route by which an unregistered practitioner meets the identification rule.
The Ministry's 20-point compliance checklist
The Ministry of Commerce publishes a one-page self-assessment checklist for online stores, dated January 2022 and based on the law and its Executive Regulations. Translated, its 20 points are the acceptance criteria for a Saudi store build:
Provide the basic identifying data for the store, each product and each service.
Provide means of contact and of lodging a complaint.
Explain the procedure for receiving and handling complaints.
Disclose the exchange and return policy.
Make sure that policy is lawful, meaning it respects the seven-day right and its exceptions.
Allow the customer to cancel their account.
Allow the customer to stop receiving electronic advertisements.
Disclose the maximum delivery time before the order is completed.
Show the total order price on the invoice.
Show the base price of the product on the invoice.
Show the tax value or rate within the total on the invoice.
Show additional charges on the invoice, for example cash on delivery, installation or packaging.
Show shipping, transport and delivery charges on the invoice.
State the delivery period or date on the invoice.
State the carrier's name and the shipment tracking number.
Display the commercial registration number on the website.
Display the tax number on the website.
Display the licence or permit number, its expiry date and the issuing authority for regulated goods such as cosmetics and food.
Record the online store's link in the Commercial Register.
Disclose the privacy policy and consumer data protection policy.
Penalties and enforcement
Article 18 sets the penalties for violating the law or its regulations: a warning, a fine not exceeding 1,000,000 riyals, temporary or permanent suspension of the e-commerce activity, and partial or complete blocking of the e-shop. Under Article 17 the Minister may block a store in urgent cases before the violations committee rules. Article 19 requires penalties to be proportionate to the gravity and frequency of the violation, the damage caused and the size of the business, and Article 21 allows a decision to be published at the violator's expense.
Enforcement is active. The Ministry's 2020 release reported penalties against 44 stores and the immediate blocking of five, and it invites consumers to report violations through its app and the 1900 call centre. Treat the checklist as a live audit, not a launch task.
Building a compliant Saudi store: where each rule lives
| Requirement | Where it goes in the store |
|---|---|
| Seller name, address, contact, CR and tax number | Footer on every page, the About page and the order confirmation email |
| Terms, total price with VAT and delivery, payment and delivery arrangements, warranty | Product page, cart and checkout, plus a Terms page linked before the Pay button |
| Itemised invoice with delivery date, place, carrier and tracking | Order confirmation and the ZATCA-compliant invoice generated by the order system |
| Seven-day return right and exceptions | Returns policy page, the order page's return button, and the refund workflow in the admin |
| 15-day delivery rule and delay notices | Delivery promise per region, shipment status notifications, cancel-and-refund flow |
| Data retention and no onward disclosure | Privacy policy, retention schedule, contracts with couriers and gateways |
| Unsubscribe and account deletion | Email footer, account settings, and the deletion routine that also notifies integrations |
| Store link in the Commercial Register, Maroof listing | Company admin tasks, with the Maroof badge displayed on the site |
How OGB Labs helps
OGB Labs builds ecommerce stores for Saudi companies from Muscat, with a team in Riyadh, on Shopify, headless and custom platforms. We build the disclosure pages, invoice and refund flows, delivery promises and data controls into the store rather than bolting them on, and we test the store against the Ministry's checklist before launch. Start with our guides to Shopify in Saudi Arabia and payment gateways in Saudi Arabia, or see our Saudi Arabia page and contact us with your catalogue and target launch date.
( FAQ )
Questions people ask.
Does the Saudi E-Commerce Law apply to a foreign online store?
Yes. Article 2 applies the law to practitioners outside the Kingdom who offer products or services to consumers in Saudi Arabia, and Article 3 says a foreign domain or email address does not move your business address abroad.
What must an online store display under the Saudi E-Commerce Law?
The seller's name and address (unless registered with an authentication entity such as Maroof), contact information, and the name and number of its commercial registration or other public register, plus data required by the Executive Regulations. The Ministry's checklist also expects the tax number and any licence number for regulated goods.
What is the return period under the Saudi E-Commerce Law?
Seven days from receipt of the product, or from the date of a service contract, if the product is unused. Customised items, used media and software, publications, downloadable software, accommodation, transport and catering are excluded.
What happens if delivery is late?
If delivery or performance is more than 15 days late from the contract date or agreed date, the consumer may rescind the contract and claim a refund of all amounts paid plus costs caused by the delay, unless an extension was agreed or the delay is force majeure.
What are the penalties under the Saudi E-Commerce Law?
A warning, a fine of up to SAR 1,000,000, temporary or permanent suspension of the e-commerce activity, and partial or complete blocking of the store. The Minister may block a store in urgent cases.
Is Maroof mandatory in Saudi Arabia?
The law does not name Maroof. It allows a seller registered with an e-shop authentication entity licensed by the Ministry to omit its name and address from the store, and the Ministry urges consumers to buy from stores with a commercial registration or a Maroof registration. A merchant must still register the store in the Commercial Register.
Do I need a commercial registration to sell online in Saudi Arabia?
A merchant must register the e-shop in the Commercial Register under Article 15. The law also recognises practitioners who sell without a commercial registration, but they carry the same consumer duties and need another way to identify themselves, such as Maroof.
Does the E-Commerce Law replace the PDPL for my store?
No. Article 5 of the E-Commerce Law limits data retention and onward disclosure, and the Personal Data Protection Law adds privacy notices, consent, rights requests and breach notification. A store must meet both.
Are social media ads covered by the law?
Yes. Article 10 makes any electronic advertisement part of the contract and requires it to name the product, the seller and the seller's contact details, and Article 11 bans misleading claims and unauthorised trademarks.
( Related )
Service · 04
Ecommerce
Stores built to sell: storefronts that feel like your brand, a checkout people finish and inventory that stays in sync.
Service · 01
Websites
Company websites and web platforms designed around your brand, built to rank and to turn visitors into customers.
Guide · AI search · Marketing
Get recommended by ChatGPT, Perplexity and Google AI
Guide · Analytics · AI search
Measure AI search traffic in GA4 and Search Console
Guide · Ecommerce · Saudi Arabia
Saudi VAT registration for online sellers
( Next step )
Want this done for you?
Tell us what you are building. We reply within one business day.