Saudi Arabia is the market most UAE businesses look at next, and the one where a website built for Dubai most often falls short. The audience is online almost without exception: the Communications, Space and Technology Commission puts internet penetration at 99 percent, and its Saudi Internet Report 2024 found that 93.1 percent of online shopping happens on local websites. That last figure is the one to sit with. Saudi shoppers buy from sites that feel Saudi.
This is what that means in practice for a website or online store aimed at Saudi customers, from the official texts rather than from summaries of summaries.
1. Saudi data law applies to you, even from Dubai
The Personal Data Protection Law, enforced by the Saudi Data and AI Authority (SDAIA), came into force on 14 September 2023, with a one-year grace period that has now ended. Article 2 is the line that matters to a UAE company: the law covers the processing of personal data of individuals residing in the Kingdom by any means from any party outside the Kingdom. SDAIA's own guidance uses an online store taking names, emails and delivery addresses as its example of processing.
For a website, the obligations that show up in the build are:
- A privacy policy before collection. Article 12 requires it to be available before you collect anything, stating the purpose, the data collected, how it is collected, stored and destroyed, and how people exercise their rights.
- Notice at the point of collection. Article 13 lists what people must be told when you collect from them directly, including the legal basis and purpose. In practice: short, clear text next to every form, not just a link in the footer.
- Breach notification within 72 hours. Under Article 24 of the Implementing Regulation, you must notify the authority within 72 hours of becoming aware of a breach that could cause harm. That requires knowing what data your site holds and where.
- Transfers outside the Kingdom. Hosting customer data abroad, including in the UAE, falls under a separate Regulation on Personal Data Transfer outside the Kingdom, which sets out permitted purposes and safeguards. Your hosting, CRM and email tools are part of this question.
The penalties are not symbolic. Article 36 allows a warning or a fine of up to SAR 5 million for violations, doubled for repeat offences, and Article 35 reserves up to two years' imprisonment or SAR 3 million for disclosing sensitive data with intent to harm.
2. The e-commerce law sets what your store must show
If you sell online, Saudi Arabia's E-Commerce Law, issued by Royal Decree M/126, adds disclosure rules that belong in the design, not in a PDF nobody opens. Per the Ministry of Commerce, a store must give customers its details and its terms, including:
- who you are and how to reach you, with your commercial registration details;
- the main features of what you sell;
- the total price, including any charges or taxes, so VAT (15 percent, per ZATCA) is in the price shown, not added at the last step;
- payment, delivery, performance and warranty terms.
Customers also get a seven-day right to return an unused item and recover what they paid, with exclusions such as accommodation, transport and catering. And if delivery runs more than 15 days late, the customer can cancel. Your returns page, order emails and checkout copy should say all of this plainly, because the law assumes the customer was told.
3. Payments: mada first, then everything else
mada is Saudi Arabia's national payment network, owned by the Saudi Central Bank (SAMA). It works online, secured with 3D Secure, and mada cards can be added to Apple Pay. For a Saudi checkout this means:
- Choose a payment gateway that supports mada as its own option, not just Visa and Mastercard. A store that only takes international cards is turning away the card most Saudi shoppers carry.
- Offer Apple Pay with mada. On mobile it is the shortest route through checkout.
- Add instalments through providers such as Tabby or Tamara where your basket size justifies it.
Gateway approval for Saudi payments often depends on your business registration, so start that conversation before the build, not after it.
4. A .sa domain needs a Saudi presence
A .sa domain signals "local", which matters given where Saudis shop. But it is not open to everyone. Under the SaudiNIC regulation, the registrant must be an entity located in Saudi Arabia, a Saudi national or Premium Resident, an entity holding a Saudi registration or licence, or the owner of a trademark or trade name registered in the Kingdom. A .com.sa address goes further and requires a valid Saudi commercial registration or a locally registered trade name or trademark.
For a UAE company without a Saudi entity, registering your trademark in Saudi Arabia is one route to eligibility, and protecting the brand there is worth doing anyway. Until then, a /sa/ section on your main domain, with Saudi pricing and content, is a sound start.
5. Arabic, written for Saudi readers
We have not found a general rule that an entire website must be in Arabic. Specific documents, such as product information, warranties and tax invoices, can carry Arabic requirements, and your adviser should confirm which apply to you. Commercially, though, the question answers itself. A store competing with local websites cannot lead with English and a machine-translated Arabic version.
Saudi Arabic is also not UAE Arabic. Product names, search terms and tone differ. Your Arabic copy and Arabic SEO keywords should be researched for Saudi searchers, not reused from a Dubai site. We cover the method in Arabic SEO, and how we build bilingual sites as two first-class versions in Arabic website design.
A launch checklist
- Privacy policy and collection notices written to the PDPL, in Arabic and English.
- A map of where customer data is stored, including hosting and third-party tools, and a breach plan with a 72-hour clock.
- Prices shown including VAT, with commercial registration and contact details on the site.
- Returns, cancellation and delivery terms visible before checkout.
- A gateway with mada and Apple Pay, approved for your entity.
- A domain strategy:
.saif eligible, a Saudi section if not. - Arabic copy and keywords researched for Saudi customers.
If you are choosing a platform for this, our Shopify vs WooCommerce comparison covers how each handles Gulf payments and Arabic. We build Saudi-ready sites and stores from Dubai as part of our web development work across the GCC and our ecommerce builds. Tell us what you are launching and we will tell you what the Saudi version needs.
This article is general information, not legal advice. Laws and regulations are as published by SDAIA, the Ministry of Commerce, SAMA, ZATCA, SaudiNIC and CST, read on 5 November 2026. Confirm your obligations with a qualified adviser in Saudi Arabia.