Privacy Policy and Terms of Use for E-Commerce Stores in Saudi Arabia under the Personal Data Protection Law and E-Commerce Law: What They Must Include, What Has Changed with SDAIA Beginning to Impose Penalties, and the Risks of Copying Templates.
Most e-commerce stores in Saudi Arabia have a page titled “Privacy Policy,” but many copy it from another store or translate a foreign template that does not even mention Saudi regulations. The problem is that an e-commerce privacy policy is no longer a formality. In 2026, the Saudi Data and Artificial Intelligence Authority (SDAIA) began issuing penalty decisions and warnings against entities that violated the Personal Data Protection Law, including cases involving marketing messages sent without explicit consent.
In this guide, we explain the regulations governing your store, the mandatory clauses in a privacy policy, what your terms of use and return policy should include, potential penalties, common mistakes in ready-made templates, and when you need a lawyer to prepare these documents.
Regulations Governing E-Commerce Privacy Policies in Saudi Arabia
E-commerce stores in the Kingdom are subject to two primary laws that complement each other:
- Personal Data Protection Law (PDPL): Issued under Royal Decree No. M/19 in 1443 AH, it became fully enforceable on September 14, 2024, following the end of the transition period. The Saudi Data and Artificial Intelligence Authority (SDAIA) oversees the law, issues regulations, receives complaints, and imposes penalties.
- E-Commerce Law and its Implementing Regulations: These require stores to disclose their identity, prices, and contractual terms, protect consumer data, and regulate electronic advertising and returns. The Ministry of Commerce is the competent authority for this law.
Both laws apply to e-commerce stores operating on ready-made platforms such as Salla and Zid, standalone websites, or mobile applications, provided they collect personal data relating to individuals in the Kingdom.
Mandatory Clauses in an E-Commerce Privacy Policy
The Personal Data Protection Law grants individuals the right to be informed about the legal basis and purpose of collecting their personal data before or at the time of collection. Accordingly, your privacy policy should clearly answer the following questions:
- Who are you? Your business name, commercial registration number, and contact details for privacy-related inquiries.
- What data do you collect? Names, mobile numbers, addresses, email addresses, order details, payment data, browsing information, and cookies.
- Why do you collect it? To process orders and shipping, provide customer support, issue invoices, and conduct marketing where the customer has consented.
- What is the legal basis? Consent, contract performance, or compliance with legal obligations, depending on the purpose.
- Who do you share it with? Shipping companies, payment gateways, platform providers, and analytics and advertising providers.
- Is data transferred outside the Kingdom? If so, on what legal basis, since international data transfers are subject to specific requirements.
- How long do you retain it? Explain the retention period and when and how data is destroyed after the purpose has been fulfilled.
- How do you protect it? Describe the technical and administrative safeguards you implement.
- What are customers' rights, and how can they exercise them? Provide a clear channel for submitting requests.
The Implementing Regulations of the E-Commerce Law also require stores to publish a privacy policy explaining their data protection procedures and the scope of any analysis of user behavior. The policy link must be available on the store, and any amendments must be disclosed.
Customer Rights Your Privacy Policy Must Protect
| Right | What It Means in Practice for Your Store |
|---|---|
| Right to Be Informed | Provide clear notice of the purpose and legal basis for processing when customers register or place an order. |
| Right of Access | Enable customers to obtain a copy of their personal data. |
| Right to Rectification | Allow customers to correct inaccurate or incomplete information. |
| Right to Erasure | Delete data when the purpose for processing has ended, and make account closure straightforward. |
| Right to Withdraw Consent | Allow customers to unsubscribe from marketing messages at any time. |
| Right to Lodge a Complaint | Inform customers of their right to submit a complaint to the competent authority. |
Listing these rights on a page is not enough. Your store must have an effective mechanism for responding promptly to customer requests. Failure to provide such a mechanism was among the violations penalized by SDAIA in 2026.
Marketing Messages and Data Breach Reporting: Common Compliance Violations
Marketing Messages Require Explicit Consent
The Implementing Regulations of the E-Commerce Law require prior explicit consent before using customer data for advertising or marketing. Stores must also provide a way for customers to request that advertising messages stop and comply with those requests. Among the penalty decisions announced by SDAIA in 2026 were sanctions for processing personal data for direct marketing without explicit consent. Therefore, do not enable the marketing consent checkbox by default.
Reporting Data Breaches Within 72 Hours
If your store experiences a data breach, SDAIA must be notified within 72 hours of becoming aware of it, in accordance with the Personal Data Protection Law. The E-Commerce Law's Implementing Regulations also require notification to the Ministry of Commerce and the consumer within three days, including details of the breach's scope, its consequences, and the measures taken. Your privacy policy and internal procedures should therefore include a clear response plan.
Transferring Data Outside the Kingdom
Many stores use hosting services, analytics tools, or marketing platforms located outside Saudi Arabia without realizing that this may involve a cross-border data transfer. Such transfers are permitted subject to specific safeguards, including adequate protection in the destination country as assessed by SDAIA, or appropriate safeguards such as standard contractual clauses. Disclose relevant practices in your privacy policy and review your providers' contracts.
E-Commerce Terms of Use: What Should They Include?
Your terms of use constitute the contract between your store and the customer. The Implementing Regulations of the E-Commerce Law require specific information to be disclosed before the contract is concluded:
- Store identity: Business name, commercial registration number, tax identification number where applicable, and contact details.
- Total price: Base price, delivery charges, taxes, and any additional fees.
- Right to cancel: When customers may cancel, any associated costs, the cancellation procedure, or a clear statement that the product is not eligible for cancellation.
- Delivery and payment: Delivery timelines, available payment methods, and after-sales services.
- Complaint procedures and how complaints are handled.
- Order button: The button must clearly indicate that clicking it concludes the contract and creates a payment obligation.
- Intellectual property rights relating to the store's content, images, and trademark.
- Applicable law and the competent authority or forum for resolving disputes.
Return and Exchange Policy
The E-Commerce Law grants consumers the right to cancel a contract within 7 days of receiving a product, provided it has not been used. The consumer bears the return shipping cost unless otherwise agreed. Consumers may also cancel the contract if the store delays delivery by more than 15 days beyond the agreed delivery date.
The Implementing Regulations exclude certain cases from the right to cancel unless the parties agree otherwise. The main exceptions include:
- Products that are perishable within the cancellation period.
- Products that cannot be resold for health or hygiene reasons.
- Products manufactured to the customer's specifications or made to order.
- Hotel reservations, airline tickets, vehicle rentals, and event organization services.
- Goods whose prices fluctuate in the market, such as gold and silver.
A common mistake is to state that “no returns are accepted” under any circumstances. Such a blanket policy may violate the law for products that are not exempt. The invoice must also include a summary of the applicable exchange and return terms.
Penalties for Violating the Personal Data Protection Law
| Violation | Applicable Penalty |
|---|---|
| Violation of the law or its implementing regulations | A warning or a fine of up to SAR 5 million. |
| Repeated violations | The fine may be doubled. |
| Disclosing or publishing sensitive data with the intent to cause harm | Imprisonment for up to two years and/or a fine. |
Data subjects may also be entitled to claim compensation for damages, and a published violation can harm the store's reputation. The cost of preparing a compliant policy is therefore far lower than the potential cost of a single violation.
Common Mistakes in Ready-Made Templates and When You Need a Lawyer
- Copying another store's policy that identifies businesses or service providers unrelated to your store.
- Using a foreign template that refers to European or US laws but omits Saudi regulations.
- Pre-checked marketing consent boxes or consent combined with acceptance of the terms and conditions.
- Failing to disclose international data transfers despite using overseas hosting or third-party tools.
- An absolute no-returns policy that prohibits returns in every circumstance.
- Failing to update the policy when adding new tools or services.
Because these documents involve multiple legal frameworks, preparing them correctly requires legal expertise and an understanding of how your store operates:
- To prepare your store's privacy policy, terms of use, and return policy, request our service for Privacy Policies and Terms of Use for E-Commerce Stores.
- For applications, platforms, and technology contracts, explore our Internet and Information Technology Law service.
- To protect your store's name and logo, read our guides on Trademark Registration in Saudi Arabia and Intellectual Property Protection.
- For a quick assessment of your store's situation, book an In-Office Legal Consultation.
Frequently Asked Questions
Is a privacy policy mandatory for e-commerce stores in Saudi Arabia?
Yes. The Implementing Regulations of the E-Commerce Law require stores to publish a privacy policy and make its link available. The Personal Data Protection Law also requires customers to be informed of the purpose and legal basis for collecting their data and the parties with whom it is shared.
Can stores send marketing messages to customers without their consent?
No. Using customer data for marketing requires prior explicit consent. Stores must provide a way to stop marketing messages and honor such requests. In 2026, SDAIA imposed penalties on entities for direct marketing without explicit consent.
What is the deadline for reporting a customer data breach?
SDAIA must be notified within 72 hours of becoming aware of a breach under the Personal Data Protection Law. The E-Commerce Law's Implementing Regulations also require the Ministry of Commerce and consumers to be notified within three days, including details of the breach and the measures taken.
How long is the return period for products purchased online?
Consumers generally have seven days from receiving a product to cancel the contract if the product has not been used. Exceptions include perishable goods, made-to-order products, and products that cannot be resold for health or hygiene reasons.
What are the penalties for violating the Personal Data Protection Law?
Penalties may include a warning or a fine of up to SAR 5 million, with the fine potentially doubled for repeated violations. Disclosing sensitive data with the intent to cause harm may result in imprisonment for up to two years, in addition to the affected individual's right to seek compensation.
A Copied Privacy Policy Could Cost Your Store Millions in Fines
We prepare privacy policies, terms of use, and return policies tailored to your store's operations and service providers in accordance with the Personal Data Protection Law and the E-Commerce Law.
info@novalegal.sa | Al Sahabah Road, Ishbiliyah District, Riyadh
Conclusion: An E-Commerce Privacy Policy Protects Your Business and Your Customers
A properly prepared e-commerce privacy policy helps protect your store from penalties imposed by SDAIA and the Ministry of Commerce, builds customer trust, and governs your relationships with shipping, payment, and marketing providers. The guiding principle is simple: your policy must reflect what your store actually does, not what a copied template claims.
The Nova Legal team in Riyadh prepares privacy policies, terms of use, and return policies for e-commerce stores, platforms, and applications through our Privacy Policies and Terms of Use for E-Commerce Stores service and our Internet and Information Technology Law service. Address: Al Sahabah Road, Ishbiliyah District, Riyadh – Building 2/2, Al Hamra City, Second Floor, Office 202.
Official Sources and References
- Bureau of Experts at the Council of Ministers – Personal Data Protection Law and E-Commerce Law
- Saudi Data and Artificial Intelligence Authority (SDAIA)
- Ministry of Commerce
- Al Eqtisadiah – Implementing Regulations of the E-Commerce Law
- Sabq – SDAIA Issues Penalty Decisions Against Entities That Violated the Personal Data Protection Law
