Search for:

In brief

On 13 September 2023, the Communication Space & Technology Commission of Saudi Arabia (CST) proposed a draft law on Global Digital Content Safe Harbor (please find the draft law here). The proposed law is aimed at providing a legal framework for intermediary service providers hosting and transiting global digital content in Saudi Arabia in a way that ensures no objection, deletion or modification of content hosted in and accessible within the Kingdom.

If adopted, the effect of the draft law may be significant as it seeks to create a more favourable environment for investment in the Kingdom’s digital economy, and it would align the local legal framework with the international best practices. By providing intermediary service providers with greater legal certainty, the draft law will aim to attract new businesses and encourage existing businesses to expand their operations in the Kingdom.


In the context of the draft law, “Digital Content” is defined under the draft law as “any digital content located, stored or distributed in the telecommunications network or IT infrastructure, in any form or manner, and which can be created, handled or accessed through the same”. Furthermore, “Intermediate Services” are themselves defined as “Hosting, processing, storing, transferring, or transiting global digital content outside the Kingdom, or enabling access thereto through the telecommunications network or IT infrastructure”.

Key takeaways

The provisions of the draft law essentially introduce the following principles:

  • Exemption from any civil or penal liability as a result of providing an intermediary service that includes global digital content that violates the Kingdom’s laws
  • This exemption is subject to conditions: it is only granted to intermediary service providers who have a valid CST certificate proving that they have passed a prequalification process (the conditions of which are still to be detailed by the CST)
  • Exemption will expire upon the expiration of the pre-qualification certificate, its nonrenewal, suspension or cancellation
  • Intermediary service providers are not obligated to monitor the global digital content hosted in the Kingdom, and it is clarified that the privacy of hosted data will not be prejudiced

Under Article 6 of the draft law, CST will have the power to forward take-down requests (e.g. removal, restriction of access and transit of the content) to the intermediary service providers if it has reasonable grounds to suspect the existence of a violation of laws applicable in the Kingdom or of any of the pre-qualification condition. Failure to comply with CST notices or requests of information would be considered a violation of the draft law’s provisions, as well as violating the qualification requirements set by the Board and any other action that violates the provisions of the draft laws and the relevant regulatory decisions issued by the Board.

Potential sanctions

The intermediary service provider who commits any of the violations described above shall be subject to the following penalties (potentially cumulative) in proportion to the violation’s nature, effect and reiteration:

  • A fine not exceeding SAR 25,000,000 (i.e., approximately USD 6,600,000)
  • To be deprived – for a certain period – of obtaining a pre-qualification certificate
  • Cancellation of the pre-qualification certificate

The extent of the obligations and effects under the draft law remain to be detailed either in further iterations of the same or within implementing regulations (that are foreseen in the current drafting of the law), including criteria for eligibility to be certified by the CST, platforms that will be able to apply, etc.

* * * * *

If you would like any assistance in any data and technology-related matters or issues generally, please feel free to contact our lawyers.

LOGO_Saudi Arabia Legal_Advisors_Jeddah

* Content prepared by Legal Advisors in association with Baker & McKenzie Limited.

Author

Abdulrahman AlAjlan is a Senior Legal Consultant in Baker McKenzie, Riyadh office.

Author

Zahi Younes is a Senior Legal Consultant in Baker McKenzie, Riyadh office.

Author

Maher Ghalloussi is an associate in the Firm's Dubai office. He is qualified in France and has worked in Paris and Dubai.

Author

Lucrezia Lorenzini is an associate based in the Dubai office of Baker McKenzie. Lucrezia advises on technology and data protection matters for clients, including national and multinational businesses, based in the UAE and Saudi Arabia.

Write A Comment