Legal and regulatory responses to cybercrime in Saudi Arabia: a comparative evaluation | #cybercrime | #infosec

AbstractSaudi Arabia’s accelerated digital transformation under Vision 2030 has intensified the need for a coherent legal framework capable of regulating cybercrime, digital commerce, electronic transactions, and personal data protection. This framework is primarily built upon four foundational legislative instruments: the Anti-Cyber Crime Law (2007), the Electronic Transactions System (EOTS, 2006), the E-Commerce System (ECS, 2019), and the Personal Data Protection Law (PDPL, 2021). Although these instruments have substantially strengthened the Kingdom’s digital regulatory architecture, important challenges remain regarding legislative coherence, institutional coordination, procedural effectiveness, and alignment with evolving international standards. This study employs a comparative doctrinal legal analysis, informed by a socio-legal perspective, to examine the four legislative instruments through statutory interpretation, comparative evaluation with leading international frameworks, and synthesis of contemporary legal scholarship and published empirical compliance studies. The analysis identifies significant legislative and institutional challenges, including gaps in identity theft regulation, cyberbullying protection, platform liability, online dispute resolution, digital evidence procedures, regulatory fragmentation, data governance, and AI-related regulation. It further demonstrates that many implementation challenges stem less from legislative design than from institutional coordination, procedural capacity, and regulatory adaptation to rapidly evolving digital technologies. Based on these findings, the study proposes a three-tier reform strategy centered on procedural modernization, institutional strengthening, and adaptive legislative development, while remaining consistent with Saudi Arabia’s constitutional framework, Islamic legal principles, and Vision 2030 objectives. The study argues that effective international alignment does not require institutional uniformity; rather, Saudi Arabia can strengthen digital governance through context-sensitive legal reforms that preserve national regulatory autonomy while incorporating internationally recognized best practices.1 IntroductionSaudi Arabia has emerged as one of the highest-volume targets of cyberattack across the Arab region throughout the past decade. This exposure, coupled with the Kingdom’s accelerated digital transformation under Vision 2030, has created acute regulatory pressure on a legal framework whose foundational instruments substantially predate the contemporary threat landscape and lack adequate procedural mechanisms for enforcement. The Anti-Cyber Crime Law (ACCL), enacted in 2007, and the Electronic Transactions System (EOTS), established in 2006, were drafted before smartphones became ubiquitous, before cloud computing transformed data infrastructure, and before social media platforms created the ambient surveillance architecture that now characterizes ordinary digital interaction. More significantly, the E-Commerce System (ECS), substantially amended through Royal Decree No. M/126 in 2019, continues to reflect commercial principles grounded in an earlier regulatory era, while the Personal Data Protection Law (PDPL), enacted in 2021, is comparatively recent but newly operational and already revealing substantive compliance deficits in practice and institutional implementation challenges.Recent scholarship across institutional theory, comparative legal analysis, and empirical compliance auditing converges on a consistent diagnostic finding: Saudi Arabia has made substantial legislative progress in cybercrime governance, yet faces persistent and measurable deficits in enforcement capacity, definitional precision, cross-instrument coherence, and alignment with international standards (Alshammari and Singh, 2018; Singh and Alshammari, 2020; Alhejaili, 2024; Moafa and Almarri 2026). The Global Cybersecurity Index tracked the Kingdom’s trajectory from a “maturing” stage in 2017 to the second-ranked position among Arab states by 2020 a trajectory reflecting genuine institutional investment through the creation of the National Cybersecurity Authority (NCA), the Saudi Data and Artificial Intelligence Authority (SDAIA), and the National Data Management Office (NDMO) (Valiakhmetova and Tsukanov, 2025). However, legislative frameworks and enforcement capacities have not kept equal pace with institutional architecture, creating a governance gap that is becoming increasingly apparent as digital commerce adoption accelerates, cyber threat sophistication grows, and empirical compliance data reveals alarming gaps between statutory text and actual organizational practice. This asymmetry between well-developed substantive prohibitions and underdeveloped procedural and enforcement mechanisms represents the central challenge to effective cybercrime governance in the Kingdom.Three complementary strands of scholarship provide the intellectual foundation for the present analysis. First, doctrinal studies of individual legal instruments have identified important substantive and institutional challenges within Saudi Arabia’s evolving cyber-law framework. Almerdas (2014) demonstrated that the Anti-Cybercrime Law does not criminalize identity theft as a distinct offense, particularly where identity misuse is motivated by harassment or reputational harm rather than financial gain, thereby leaving an identifiable gap in legal protection. Kinsara (2022) critically examined the electronic signature provisions of the Saudi Electronic Transactions Law against the European Union’s eIDAS Regulation and concluded that the Saudi framework adopts a comparatively restrictive regulatory approach that may impose unnecessary authentication burdens and diverges from contemporary international practice. In the field of personal data protection, Alnasser (2025) compared the Saudi Personal Data Protection Law (PDPL) with the European Union’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), concluding that although the PDPL establishes a comprehensive legal framework for the protection of personal data, important challenges remain regarding regulatory implementation, institutional enforcement, and alignment with evolving international data governance standards. Collectively, these studies provide valuable doctrinal insights into individual legislative instruments; however, they examine each statute in isolation and do not evaluate the coherence, institutional interaction, or cumulative effectiveness of Saudi Arabia’s broader cybercrime governance framework.Second, empirical compliance studies reveal a persistent gap between statutory requirements and organizational practice, indicating that effective implementation of Saudi Arabia’s data protection framework remains a significant governance challenge. Prior to the enforcement of the Personal Data Protection Law (PDPL), Alhazmi and Daghistani (2025) examined 723 popular Saudi websites and found that 85% of cookie-enabled websites failed to provide consent mechanisms, while 39% lacked a privacy policy altogether, demonstrating widespread deficiencies in basic privacy compliance. Following the PDPL’s implementation, Alashwali and Alhuzali (2026), in an empirical assessment of 100 Saudi e-commerce websites, reported that only 31% declared all four PDPL-related privacy policy requirements examined in the study. The authors further observed that non-compliance remained common even among highly ranked and locally hosted websites, suggesting that market prominence alone does not ensure regulatory compliance. Complementing these findings, Alaeaid et al. (2026), using a mixed-methods design in Saudi government institutions, found high levels of awareness of PDPL principles but only moderate implementation capacity, indicating that effective compliance depends not only on legal knowledge but also on organizational readiness, technical capability, and institutional implementation. Collectively, these empirical studies suggest that the principal challenges facing Saudi Arabia’s data protection regime extend beyond legislative design to encompass institutional capacity and operational implementation.Third, comparative scholarship on cybercrime legislation in the Gulf Cooperation Council (GCC) demonstrates that, despite shared Islamic legal traditions, cultural affinities, and closely related legal systems, significant differences persist in the structure, terminology, and scope of cybercrime regulation across member states. Altayar (2017) provided an early comparative assessment of anti-cybercrime legislation in the GCC, identifying important variations in the criminalization of cyber offenses and the regulatory approaches adopted by individual jurisdictions. Building on this work, Tsyplakova and Shestak (2024) compared the cybercrime legislation of GCC countries with the Budapest Convention on Cybercrime and the Arab Convention on Combating Information Technology Offenses, concluding that differences in legal terminology, offense classification, and legislative structure continue to impede regional legal harmonization and cross-border cooperation. More recently, Valiakhmetova and Tsukanov (2025) examined the evolution of cybersecurity legislation across the GCC and argued that the region has entered a phase of accelerated legal modernization, characterized by the gradual alignment of national regulatory frameworks with international cybersecurity standards while maintaining distinct domestic legislative models. Collectively, these studies demonstrate that regional convergence is an ongoing process rather than an accomplished objective, reinforcing the need for functional rather than purely formal approaches to legal harmonization.Previous scholarship has made important contributions to understanding individual aspects of Saudi digital regulation. Alshammari and Singh (2018) and Singh and Alshammari (2020) examined the Anti-Cyber Crime Law and the institutional development of Saudi cybersecurity governance. Alhejaili (2024) evaluated Saudi cybersecurity legal frameworks primarily from the perspective of e-commerce security and regulatory effectiveness. Alkhedhairy (2025) focused on personal data protection within the insurance sector through a comparative analysis of the PDPL and European data protection principles. While these studies provide valuable analyses of specific legal instruments or regulatory sectors, none offers an integrated evaluation of the four principal legislative frameworks governing cybercrime, electronic transactions, e-commerce, and personal data protection within a single comparative analytical framework. This study addresses that gap by examining their institutional coherence, comparative alignment with international standards, implementation challenges identified in the literature, and implications for future legislative reform.Beyond its doctrinal dimension, this study adopts a socio-legal perspective by examining cyber legislation as a regulatory institution that shapes relationships between individuals, businesses, and public authorities within Saudi Arabia’s rapidly expanding digital society. Rather than treating legal rules as isolated normative texts, the analysis considers how legislative design influences institutional trust, organizational compliance, digital participation, and governance capacity under Vision 2030. From this perspective, the effectiveness of cyber legislation depends not only on statutory coherence but also on its ability to promote socially legitimate, enforceable, and adaptive digital governance.Despite the growing body of scholarship examining individual legislative instruments and specific regulatory deficiencies, a comprehensive socio-legal analysis of Saudi Arabia’s cyber governance framework remains absent from the English-language literature. Existing studies largely assess the Anti-Cyber Crime Law (ACCL), the Electronic Transactions System (EOTS), the E-Commerce System (ECS), and the Personal Data Protection Law (PDPL) in isolation, without evaluating their collective coherence as an integrated regulatory system. Nor do they sufficiently examine how these interconnected legal frameworks shape institutional governance, organizational compliance, digital trust, and the broader relationship between the state, businesses, and citizens within Saudi Arabia’s rapidly evolving digital society. Addressing this gap is particularly important because the success of Vision 2030’s digital transformation depends not only on the existence of modern legislation but also on the capacity of the legal framework to promote effective governance, strengthen institutional legitimacy, facilitate secure digital commerce, protect individual rights, and foster public confidence in the Kingdom’s digital environment. Accordingly, this study adopts a comparative doctrinal analysis informed by a socio-legal perspective to evaluate the coherence of the four principal cyber-law instruments, identify their structural interactions and regulatory deficiencies, benchmark them against leading international frameworks, and develop integrated reform recommendations that contribute to both legal modernization and effective digital governance.This article proceeds in seven sections to address this gap. Section 1 (this Introduction) establishes the diagnostic context and research gap. Sections 2–4 analyze each of the four primary instruments individually, identifying key structural gaps and normative weaknesses: section 2 examines the Anti-Cyber Crime Law (2007); section 3 analyzes the Electronic Transactions System (2006) and E-Commerce System (2019) separately; and section 4 evaluates the Personal Data Protection Law (2021). Section 5 synthesizes cross-cutting systemic deficiencies that no single instrument addresses, including regulatory fragmentation, substantive-procedural asymmetry, and technology-neutrality deficits. Section 6 introduces a new analytical section examining judicial application and enforcement practices, drawing on published court decisions and enforcement statistics to reveal how Saudi courts and regulatory authorities address statutory ambiguities and gaps. Section 7 benchmarks the entire Saudi framework against international standards principally the EU’s GDPR [Regulation (EU) 2016/679] and eIDAS Regulation [Regulation (EU) 2014/910], the Budapest Convention on Cybercrime (Council of Europe 2001), and UNCITRAL model laws on e-commerce and electronic signatures. Section 8 proposes targeted, evidence-based reform recommendations graduated by complexity and political feasibility, organized in a three-tier strategy prioritizing procedural modernization, strategic institutional adjustment, and adaptive mechanisms. The article concludes by situating these reforms within Saudi Arabia’s broader digital governance architecture and Vision 2030 objectives, emphasizing that the deepest challenge to effective cybercrime governance is not legislative drafting but institutional investment in enforcement capacity, technical expertise, cross-agency coordination, and adaptive mechanisms for technological evolution.The article draws primarily on peer-reviewed comparative legal scholarship, empirical compliance studies, enforcement statistics, and institutional theory research published between 2017 and 2026. Where available, official government documents from SDAIA, NDMO, and the NCA are referenced. The analysis acknowledges two important limitations: first, it relies principally on English-language academic literature, and therefore a systematic review incorporating Arabic-language scholarship, published judicial decisions, and internal government technical frameworks would yield a more comprehensive account of enforcement patterns and institutional practice. Second, while the PDPL entered force only in September 2023, early empirical compliance data from government institutions and e-commerce sector audits provide meaningful baseline measures for assessing implementation gaps. These data reveal that the regulatory challenge is not merely legislative but fundamentally institutional, demanding investment in enforcement capacity and technical expertise rather than wholesale legislative reconstruction.Beyond its doctrinal legal orientation, this study is informed by a socio-legal perspective that views legal frameworks as institutional arrangements shaping governance, organizational behavior, and public trust. Three analytical concepts guide the discussion. Institutional fragmentation refers to the dispersion of regulatory authority across multiple organizations, which may reduce coordination and policy coherence (Scott, 2014). Normative legitimacy concerns the extent to which legal rules are perceived as appropriate, credible, and consistent with prevailing social and institutional values (Suchman, 1995). Procedural legitimacy refers to the effectiveness, transparency, and fairness of the mechanisms through which legal rules are implemented and enforced, recognizing that well-designed substantive legislation may produce limited outcomes if procedural arrangements remain weak. These concepts are employed as analytical lenses rather than empirical variables. Future socio-legal research could operationalize them by examining interagency coordination, organizational compliance behavior, institutional capacity, and public confidence in digital governance, thereby complementing the present doctrinal analysis with empirical evidence.2 Materials and methods2.1 Research design and analytical frameworkThis study adopts a comparative doctrinal legal analysis as its principal methodological approach. The research systematically examines the legal architecture governing cybercrime, electronic transactions, e-commerce, and personal data protection in the Kingdom of Saudi Arabia through textual analysis of legislation, comparative evaluation against international legal standards, and synthesis of contemporary scholarly literature.Doctrinal legal analysis is particularly appropriate for evaluating legislative frameworks because it enables systematic examination of statutory provisions, institutional coherence, regulatory consistency, and normative alignment with internationally recognized legal principles. Rather than measuring enforcement outcomes or judicial performance, the study focuses on the legal structure of the Saudi regulatory framework and identifies legislative strengths, gaps, and areas requiring future reform.Although the study employs a comparative doctrinal legal methodology, the analysis is informed by a socio-legal perspective that views legal rules as institutional mechanisms shaping relationships between public authorities, private organizations, and individuals within Saudi Arabia’s evolving digital society. Accordingly, the legislative framework is examined not only in terms of its normative coherence but also with regard to its implications for regulatory governance, organizational compliance, institutional trust, and the effectiveness of digital transformation under Vision 2030. This perspective does not replace doctrinal analysis but complements it by situating legal rules within their broader institutional and societal context.The analytical framework proceeds through five sequential stages:systematic examination of the four principal Saudi legislative instruments governing cybercrime and digital regulation;comparative assessment of substantive provisions, institutional responsibilities, and regulatory coherence across these instruments;synthesis of contemporary academic literature and published empirical compliance studies relevant to the implementation of Saudi digital legislation;comparison with selected international legal frameworks, including the GDPR, eIDAS Regulation, the Budapest Convention, and UNCITRAL instruments; andformulation of evidence-based legislative and institutional recommendations consistent with Saudi Vision 2030 and international best practices.2.2 Primary source materialsThe primary legal materials comprise the four principal legislative instruments governing cybercrime and digital regulation in the Kingdom of Saudi Arabia:Anti-Cyber Crime Law (ACCL) (Royal Decree No. M/17, 2007), regulating cyber offenses, criminal liability, penalties, and enforcement powers.Electronic Transactions System (ETS) (Royal Decree No. M/18, 2007), establishing the legal validity of electronic transactions, electronic signatures, and digital records.E-Commerce System (ECS) (Royal Decree No. M/126, 2019), governing electronic commercial activities, consumer protection, trader obligations, and electronic contracts.Personal Data Protection Law (PDPL) (Royal Decree No. M/19, 2021; effective September 2023), regulating personal data processing, data subject rights, controller obligations, cross-border data transfers, and regulatory oversight.All legislative texts were obtained from official Saudi government sources and cross-checked against authorized English translations where available.2.3 Secondary sources and selection criteriaSecondary sources consisted primarily of peer-reviewed journal articles, academic books, doctoral theses, official reports, and institutional publications published between 2014 and 2026.Sources were included when they:examined Saudi cybercrime, data protection, electronic transactions, or e-commerce legislation;provided comparative legal analysis involving international or regional legal frameworks;discussed implementation challenges, legislative effectiveness, institutional capacity, or compliance practices;were published in peer-reviewed academic outlets or official governmental publications; andwere available in English.Studies focusing exclusively on technical cybersecurity issues without legal analysis, opinion pieces lacking academic rigor, unpublished working papers (except where explicitly identified as preprints), and sources unrelated to Saudi Arabia were excluded.Although one recent preprint (Alashwali and Alhuzali, 2026) was included because it provides the first available empirical assessment of PDPL compliance following implementation, it is explicitly identified throughout the manuscript as a non-peer-reviewed preprint, and its findings are interpreted cautiously.2.4 Literature search strategyRelevant literature was identified through systematic searches conducted between June 2024 and June 2026 using Scopus, Web of Science, Google Scholar, SSRN, and selected publisher databases.Search terms included combinations of:“Saudi Arabia”“Cybercrime”“Cybersecurity law”“Personal Data Protection Law”“PDPL”“Electronic Transactions”“E-Commerce”“Digital Evidence”“Data Protection”“GDPR”“Budapest Convention”“eIDAS”“UNCITRAL”Reference lists of retrieved publications were also examined to identify additional relevant studies through backward citation tracking.The final literature corpus consisted primarily of peer-reviewed legal scholarship supplemented by official governmental documents and a limited number of carefully identified empirical compliance studies relevant to Saudi Arabia.2.5 Analytical proceduresThe analysis proceeded through five complementary stages.First, each Saudi legislative instrument was examined individually to identify its objectives, legal definitions, institutional responsibilities, substantive obligations, enforcement mechanisms, and regulatory scope.Second, the four legislative instruments were compared to identify areas of consistency, overlap, fragmentation, and potential regulatory gaps.Third, contemporary academic scholarship was synthesized to identify converging and diverging interpretations concerning the effectiveness of the Saudi legal framework.Fourth, published empirical compliance studies were reviewed to provide contextual evidence regarding the practical implementation of selected legislative instruments particularly the Personal Data Protection Law without attempting to evaluate judicial practice or official enforcement performance.Finally, Saudi legislation was benchmarked against selected international legal frameworks, including the GDPR, the eIDAS Regulation, the Budapest Convention, and UNCITRAL model instruments, in order to identify areas where future legislative development may enhance regulatory coherence and international compatibility.2.6 Evaluation frameworkTo ensure analytical consistency, legislative provisions were evaluated according to four criteria:Regulatory completeness, referring to the comprehensiveness of statutory coverage;Institutional coherence, assessing the allocation of responsibilities among competent authorities;Comparative alignment, measuring consistency with internationally recognized legal standards; andImplementation readiness, evaluating whether existing legislation provides sufficient legal foundations for effective implementation as reflected in published empirical literature.These criteria provide a structured basis for comparing the four legislative instruments and identifying priority areas for future reform.2.7 Disclosure of artificial intelligence useIn accordance with contemporary publication standards regarding generative artificial intelligence, the author discloses that Elicit was used to assist literature retrieval and identification of relevant publications, while Claude (Anthropic) was used for language refinement and organizational support during manuscript preparation.These tools were not used to formulate legal analysis, interpret legislative provisions, develop the comparative framework, or generate the study’s conclusions. All legal interpretation, comparative assessment, synthesis, and recommendations represent the independent scholarly work of the author, who assumes full responsibility for the content of this manuscript.2.8 Limitations of the methodologyThis study has several methodological limitations.First, it is a doctrinal and comparative legal analysis that examines statutory frameworks and published academic literature rather than judicial decision-making, prosecutorial practice, or official enforcement statistics.Second, empirical evidence concerning implementation of the Personal Data Protection Law remains limited because the legislation entered into force only in September 2023. Consequently, the study relies on a small number of published compliance studies that examine specific sectors rather than the Saudi economy as a whole.Third, the analysis focuses primarily on English-language scholarship and official English-language legal materials. Although key Saudi legislation was verified against official sources, additional Arabic-language legal scholarship and future judicial publications may provide further insights.Finally, because official enforcement statistics and comprehensive published judicial decisions remain limited, the study does not seek to evaluate actual enforcement performance but instead assesses the legislative framework and the implementation challenges identified in the available scholarly literature.3 Results3.1 Analysis of the Anti-Cyber Crime Law (2007)3.1.1 Structure, scope, and substantive provisionsThe Anti-Cyber Crime Law (ACCL), enacted under Royal Decree No. (M/17) on 8 Rabi’ al-Awwal 1,428 AH (2007), comprises 16 articles establishing a dual framework: cybersecurity protection and content regulation. The law criminalizes unauthorized access to computer systems (Article 3), disruption of network services (Article 4), content crimes deemed to violate public order, religious values, or public morals (Article 6), privacy violations through electronic means (Article 7), and various forms of fraud and forgery (Articles 8–9). Penalty structures escalate from imprisonment up to 1 year and fines up to 1 million Saudi Riyals (SAR) for basic offenses, rising to 5 years’ imprisonment and 5 million SAR for aggravated offenses. Legal persons are treated as original perpetrators (Article 12), and instigators from outside the Kingdom’s jurisdiction are explicitly captured (Article 1).A significant architectural feature is the ACCL’s simultaneous function as both a cybersecurity and content-regulation instrument. This dual function, while reflecting broader Islamic legal principles regarding public order and morality, creates substantive definitional ambiguity and has led to inconsistent judicial application explored in subsequent sections.3.1.2 Critical gaps and weaknesses3.1.2.1 Gap 1: identity theft criminalizationAlmerdas (2014) demonstrated that the ACCL lacks explicit criminalization of identity theft as a discrete offense. While phishing (Article 4), pharming, malware deployment, and hacking as methods of obtaining financial information fall within the law’s scope, the act of identity theft with non-financial motivations credential theft for harassment, doxing, reputational damage, or unauthorized account access is not clearly captured. Critically, there is no provision penalizing the possession or transfer of personal data for the purpose of identity theft (preparatory-stage conduct). However, judicial examination reveals that courts have addressed this gap through application of Article 3(4), which addresses “unauthorized access for threatening or extortion purposes,” extending this provision to cover credential theft in practical cases, though such interpretation lacks explicit statutory grounding.This gap is substantively significant because: Identity theft in Saudi Arabia has escalated with e-commerce adoption and social media proliferation, yet statutory protection remains implicit rather than explicit. Comparative instruments (UK Fraud Act, 2006; Commonwealth of Australia, 1995) explicitly criminalize preparatory-stage conduct, establishing a precedent absent in Saudi law. Evidentiary standards for prosecution are weakened by the absence of a discrete offense definition, requiring courts to construct liability through interpretive extension rather than clear statutory language.3.1.2.2 Gap 2: cyberbullying and cyber-harassmentAlshammari and Singh (2018) and Singh and Alshammari (2020) identified the absence of explicit cyberbullying and cyber-harassment provisions as a structural deficiency. The ACCL’s privacy violation articles (Article 7) provide only partial coverage and have been inconsistently applied to harassment conduct. However, Saudi courts have increasingly addressed harassment through complementary frameworks, particularly the Crime of Harassment System (2018), which addresses some dimensions of online harassment, and through application of Ta′zir (judicial discretionary punishment) under Islamic law principles. Behavioral studies on cyber-harassment in Saudi Arabia confirm substantial practical gaps between victimization rates and explicit statutory remedies.Distinct harassment conduct non-consensual sharing of intimate images, systematic online stalking, coordinated harassment campaigns is not explicitly addressed in the ACCL, creating prosecution uncertainty and victim protection gaps. While courts have applied existing provisions creatively, the lack of explicit statutory grounding weakens victim protections and creates inconsistency across decisions.3.1.2.3 Gap 3: vague content provisionsThe broad criminalization of content offensive to “religious values” (Article 6) and “public morals” without definitional guidance or proportionality requirements creates legal uncertainty for ordinary users and service providers. Several scholars note that the law’s content provisions have been applied to conduct that would not be criminalized under the Budapest Convention framework, blurring the boundary between cybersecurity law and speech regulation. This vagueness creates three substantive problems:Chilling effect on lawful speech: Uncertainty regarding application scope discourages legitimate online expression. Inconsistent enforcement: Prosecutorial discretion in interpreting “religious values” creates uneven application across similar cases. International normative tension: Application patterns diverge from international human rights standards on freedom of expression, as noted by the UN Human Rights Committee (2011).3.1.2.4 Gap 4: technological obsolescenceThe 2007 law predates ransomware, cryptojacking, deepfakes, AI-generated fraud, and Internet of Things (IoT) device exploitation as meaningful threat categories. While the NCA’s Essential Cybersecurity Controls framework has partially compensated through regulatory instruments, the primary legislation does not reference these threat classes. This creates two problems:Statutory uncertainty: Courts lack explicit guidance for prosecuting novel cybercrimes not contemplated in 2007, forcing reliance on interpretive extension. Regulatory dependence: Reliance on executive regulation through NCA standards lacks the statutory durability and legal weight necessary for cross-border enforcement cooperation.3.1.2.5 Gap 5: non-membership of the Budapest conventionSaudi Arabia has not acceded to the Budapest Convention on Cybercrime (Council of Europe, 2001), the primary international treaty establishing mutual legal assistance standards across 67 signatory states. However, as noted in the Introduction, this reflects not incapacity but deliberate strategic choice grounded in constitutional and Shariah-based reservations. Nevertheless, the Budapest Convention’s technical standards for digital evidence handling, cross-border investigation cooperation, and mutual legal assistance remain influential in international cybercrime practice. The absence of formal accession limits direct access to the convention’s cooperation mechanisms, though bilateral mutual legal assistance treaties (MLATs) modeled on Budapest Convention equivalents would provide functional equivalence.3.2 Analysis of the Electronic Transactions System (2006)3.2.1 Structure, scope, and substantive provisionsThe Electronic Transactions System (EOTS), enacted under Royal Decree in 1427 AH (2006), establishes the legal framework for digital transactions across all sectors. The law comprises articles governing: the legal validity and enforceability of electronic signatures (both qualified and advanced signatures); admissibility of electronic documents in judicial and administrative proceedings; digital contract formation and enforceability; chain of custody requirements for digital records; and international recognition of electronic transactions.The EOTS applies broadly to all electronic transactions unless specifically excluded by law, encompassing civil, commercial, administrative, and criminal contexts. Its primary purpose is to provide legal certainty and enforceability for digital transactions, establishing that an electronic signature with proper safeguards has equivalent legal standing to a handwritten signature.3.2.2 Critical gaps and weaknesses in EOTS3.2.2.1 Gap 1: restrictive qualified signature requirementsKinsara (2022) conducted detailed comparison of Saudi e-signature law under EOTS (Articles 12–15) against the EU’s eIDAS Regulation [Regulation (EU) 2014/910] and concluded that Saudi law adopted an “overly restrictive” approach requiring qualified electronic signatures in contexts where international best practice permits a tiered, technology-neutral hierarchy of signature types. This rigidity creates three substantive problems:SME burden: Disproportionate authentication requirements discourage small and medium enterprise digital commerce participation. Commercial inflexibility: The single-standard approach fails to distinguish between high-risk transactions (financial instruments, real property) and low-risk transactions (digital goods, services). International misalignment: The approach is out of step with the permissive, graduated model now standard in European, UNCITRAL-model, and US jurisdictions.3.2.2.2 Gap 2: lack of technology-neutral frameworkThe EOTS’s references to specific signature technologies embed regulatory obsolescence into the statutory text. As technology evolves, the statutory framework requires amendment rather than adaptation. This creates regulatory lag and uncertainty for emerging signature technologies not contemplated in 2006.3.2.2.3 Gap 3: limited scope for digital evidenceWhile EOTS establishes validity for electronic signatures, it provides limited guidance on broader digital evidence admissibility, chain of custody for digital records, or handling of encrypted communications. These gaps force reliance on general criminal procedure law, which lacks specialization for digital contexts.3.3 Analysis of the E-Commerce System (2019)3.3.1 Structure and evolutionSaudi Arabia was relatively early among Arab states in legislating for electronic commerce. The original Electronic Transactions System (2006) established legal recognition for electronic contracts and signatures. However, the subsequent E-Commerce System (ECS), substantively updated through Royal Decree No. M/126 in 2019, takes a more comprehensive and specifically targeted approach to consumer protection in B2C transactions.The ECS was driven by Vision 2030 objectives to grow the digital economy from approximately 4–20% of GDP. The 2019 instrument governs: seller disclosure obligations and transparency requirements; consumer rights in online transactions; online platform liability and responsibility; penalties for deceptive e-commerce practices; return, refund, and warranty procedures; dispute resolution mechanisms. The system comprises 26 articles across five chapters, establishing a comprehensive consumer protection framework distinct from EOTS’s broader digital transaction validation.3.3.2 Critical gaps and weaknesses in ECS3.3.2.1 Gap 1: undefined platform liabilityAloufi et al. (2025) identify the absence of enforceable identity verification standards and undefined platform liability as the most critical regulatory gap in Saudi e-commerce law. Unlike the EU’s Digital Services Act (European Parliament and Council of the European Union, 2022), which imposes tiered obligations on very large online platforms, Saudi law does not clearly allocate liability among marketplace platforms, third-party sellers, and logistics operators. This gap is especially problematic for:Cross-border transactions: Where the seller is outside Saudi jurisdiction, liability allocation remains ambiguous. Consumer protection: Consumers lack clarity regarding which entity is responsible for defective goods or fraudulent transactions. Platform incentives: Absence of clear liability standards fails to incentivize platform due diligence on seller verification and fraud prevention.3.3.2.2 Gap 2: consumer protection incompletenessAlmalki (2021) compared Saudi and US consumer protection frameworks and found that Saudi e-commerce law lacks clear provisions on: Cooling-off periods: No explicit “right to return” or cancelation window equivalent to the EU Consumer Rights Directive (Directive 2011/83/EU) seven-day withdrawal right. Reverse burden of proof: No specification regarding burden allocation for defective digital goods or services. Mandatory pre-contractual disclosure: Standards less comprehensive than EU Consumer Rights Directive Article 5 requirements.3.3.2.3 Gap 3: limited online consumer dispute resolution mechanismsComparative research on e-commerce regulation in the Gulf Cooperation Council (GCC) has identified cross-border dispute resolution as a continuing legal and institutional challenge. Alajaji (2016) argues that differences in jurisdictional rules, applicable law, and consumer protection frameworks reduce legal certainty for cross-border electronic transactions and complicate the effective resolution of consumer disputes. Although Saudi Arabia provides judicial and administrative mechanisms for resolving commercial disputes, it has not established a dedicated online dispute resolution (ODR) system specifically designed for low-value e-commerce claims. International experience demonstrates that technology-enabled dispute resolution can improve access to justice, reduce transaction costs, and increase consumer confidence in cross-border digital markets. The UNCITRAL Technical Notes on Online Dispute Resolution (2017) provide internationally recognized guidance for the design of such mechanisms. Developing a specialized digital dispute resolution framework could therefore strengthen consumer protection, facilitate cross-border electronic commerce, and support the broader objectives of Saudi Arabia’s digital transformation agenda.3.3.2.4 Gap 4: cross-border jurisdictional uncertaintyAlmansoori (2018) documented that GCC states, including Saudi Arabia, lack harmonized private international law rules for e-commerce disputes. This produces uncertainty regarding: Choice of law: Which jurisdiction’s substantive law applies to B2C contracts? Forum selection: Which courts have competence for disputes involving foreign consumers or sellers? Enforcement: Which jurisdiction’s enforcement mechanisms apply to judgments?3.4 Analysis of the Personal Data Protection Law (2021)3.4.1 Structure, scope, and regulatory frameworkThe Personal Data Protection Law (PDPL), enacted under Royal Decree No. (M/19) on 9 Safar 1,443 AH (2021), entered into force on 15 September 2023 following a two-year implementation deferral. Comprising 43 articles across eight chapters, the PDPL is supervised jointly by the Saudi Data and Artificial Intelligence Authority (SDAIA) and the National Data Management Office (NDMO). The law establishes consent-based data processing (Chapter 2), data subject rights including access, correction, deletion, and portability (Chapter 3), data breach notification obligations (within 72 h for serious breaches), and cross-border data transfer restrictions incorporating data localization requirements (Chapter 4). Maximum penalties reach five million SAR for ordinary violations and 10 million SAR for violations involving sensitive data categories (genetic data, biometric data, health data).3.4.2 International comparative analysis: PDPL vs. GDPRAlkhedhairy (2025), writing in Laws (MDPI), examines the regulation of personal data within the Saudi insurance sector through a comparative doctrinal analysis of the Personal Data Protection Law (PDPL) and relevant European data protection principles. The study highlights the need to balance privacy protection with legitimate commercial and regulatory interests while identifying areas where the Saudi framework could benefit from further legislative refinement.3.4.3 Critical gaps and weaknesses3.4.3.1 Gap 1: institutional enforcement capacityComparative analysis of the Saudi Personal Data Protection Law (PDPL) suggests that, although the legislation establishes a comprehensive framework for the protection of personal data, important challenges remain regarding regulatory implementation and institutional enforcement (Alnasser, 2025). Unlike the European Union’s General Data Protection Regulation (GDPR), which requires each Member State to establish an independent supervisory authority under Article 51, the Saudi regulatory framework assigns supervisory and enforcement responsibilities to existing governmental institutions, principally the Saudi Data and Artificial Intelligence Authority (SDAIA) and the National Data Management Office (NDMO). This institutional model reflects a different approach to regulatory governance and raises important questions concerning regulatory coordination, enforcement consistency, and stakeholder confidence. Accordingly, three interrelated issues emerge:Institutional independence: Executive branch positioning raises legitimacy concerns among data subjects and international trading partners regarding prosecutorial independence. Deterrence capacity: Enforcement authority lacking direct fine-imposition power reduces compliance incentives compared to GDPR’s independent supervisory structure. Stakeholder confidence: Private sector and civil society actors report uncertainty regarding enforcement transparency and appeal mechanisms.However, SDAIA has demonstrated technical competence through the National Cybersecurity Strategy and Essential Controls framework, suggesting institutional capacity for technical enforcement even within executive positioning.3.4.3.2 Gap 2: broad consent exceptions and AI governanceKhammassi and AlShanqityi (2025) argue that the Saudi Personal Data Protection Law (PDPL) leaves important regulatory questions unresolved regarding the processing of personal data in artificial intelligence (AI) environments. In particular, the authors note that the PDPL permits exceptions to the consent requirement in circumstances relating to public interest and national security, while providing less detailed statutory guidance than the European Union’s General Data Protection Regulation (GDPR) concerning the scope, proportionality, and safeguards applicable to such exceptions. From a comparative regulatory perspective, this framework raises three interrelated concerns. First, broadly framed exceptions may reduce legal certainty for data subjects regarding the circumstances in which their personal data may be processed without explicit consent. Second, the absence of AI-specific transparency and accountability provisions may complicate effective oversight of algorithmic decision-making involving personal data. Third, differences between the PDPL and the GDPR illustrate alternative regulatory approaches to balancing privacy protection, public interests, and technological innovation, highlighting an area where further legislative clarification could strengthen regulatory certainty and international interoperability.3.4.3.3 Gap 3: data localization requirementsThe PDPL’s mandatory data localization requirement (Article 20) more stringent than GDPR’s adequacy decision model (GDPR Chapter V) creates compliance burdens for multinational operators and may deter foreign digital investment. Suliman (2025) characterizes this as a “genuine policy dilemma between sovereignty and openness.” The localization requirement: Increases compliance cost: Multinationals must establish local storage infrastructure or use local cloud providers. Reduces competitiveness: Foreign cloud providers (AWS, Azure, Google Cloud) face operational constraints. Conflicts with Vision 2030: Economic diversification objectives prioritizing foreign direct investment are undermined by restrictive data transfer rules.However, this requirement reflects deliberate policy prioritizing data sovereignty and domestic control over unrestricted openness a legitimate policy choice grounded in constitutional principles rather than regulatory incapacity.3.4.3.4 Gap 4: AI governance and algorithmic accountabilityKhammassi and AlShanqityi (2025), through a comparative analysis of the Saudi Personal Data Protection Law (PDPL), the EU Artificial Intelligence Act [Regulation (EU) 2024/1689], UNESCO’s Recommendation on the Ethics of Artificial Intelligence (2021), and other international governance frameworks, argue that Saudi Arabia’s legal framework would benefit from more explicit regulation of artificial intelligence. Their analysis highlights three interrelated areas requiring further regulatory development. First, the PDPL contains no dedicated provisions governing transparency or accountability in automated decision-making comparable to the safeguards provided by Article 22 of the GDPR and the risk-based obligations established under the EU AI Act. Second, the current legal framework does not expressly require systematic bias assessment, ongoing monitoring, or meaningful human oversight for high-risk AI applications processing personal data. Third, although the Saudi Data and Artificial Intelligence Authority (SDAIA) has issued ethical principles and governance guidance for AI, these instruments operate primarily as policy guidance rather than comprehensive statutory obligations, leaving important questions regarding implementation, institutional coordination, and regulatory enforcement open for further legislative development.3.4.4 Enforcement gap: empirical evidence3.4.4.1 Pre-enforcement compliance audit (2024)Alhazmi and Daghistani (2025) analyzed 723 Saudi websites 3 months before PDPL enforcement and found: 85% non-compliance with cookie consent: Websites using cookies failed to display cookie consent banners or consent mechanisms. 39% privacy policy gap: Websites entirely lacked privacy policies, directly violating PDPL requirements. Implications: Alarming pre-enforcement compliance baseline suggesting inadequate business sector preparation (Tables 1, 2).DimensionSaudi PDPLGDPRComparative assessmentConsent requirementRequires explicit consent as the principal legal basis for processing.Provides multiple lawful bases for processing, including legitimate interests, contractual necessity, and legal obligation.PDPL adopts a more restrictive consent model, while the GDPR provides greater regulatory flexibility.Sensitive data protectionProcessing generally prohibited unless explicit consent or statutory authorization exists.Processing prohibited except under narrowly defined legal exceptions.Both frameworks provide strong protection, although the PDPL adopts a more restrictive approach in several situations.Data subject rightsRecognizes rights of access, correction, deletion, and data portability.Provides a broader catalogue of rights, including restriction of processing, objection, and safeguards against automated decision-making.The GDPR provides more comprehensive procedural safeguards.Supervisory authorityOversight exercised primarily by SDAIA and related governmental bodies.Independent supervisory authorities established under Articles 51–59 GDPR.The GDPR establishes stronger institutional independence and oversight mechanisms.Administrative sanctionsMonetary penalties established under the PDPL.Administrative fines linked to global annual turnover, creating stronger deterrence.The GDPR provides a more proportionate and scalable enforcement model.Cross-border data transfersMore restrictive framework emphasizing data localization and regulatory approval.Transfers permitted under adequacy decisions and other recognized safeguards.The PDPL adopts a more restrictive cross-border transfer regime.Artificial intelligenceNo AI-specific statutory provisions within the PDPL; guidance is provided separately by SDAIA.The GDPR is complemented by the EU AI Act, creating a coordinated regulatory framework.Saudi legislation currently lacks integrated statutory regulation for AI-related data processing.Periodic legislative reviewNo statutory review mechanism.Mandatory periodic evaluation under Article 97 GDPR.The GDPR provides a clearer mechanism for legislative adaptation over time.DimensionSaudi PDPLGDPRComparative AssessmentComparative assessment of the Saudi PDPL and the GDPR.MetricSourceSampleKey findingAssessmentCookie consent complianceAlhazmi and Daghistani (2025)723 popular Saudi websites85% of cookie-enabled websites lacked valid consent mechanismsWidespread pre-enforcement non-compliancePrivacy policy presenceAlhazmi and Daghistani (2025)723 popular Saudi websites39% of websites lacked a privacy policySignificant transparency deficitFull PDPL disclosureAlashwali and Alhuzali (2026)100 Saudi e-commerce websites31% complied with all four evaluated PDPL disclosure requirementsLow post-enforcement complianceGovernment awarenessAlaeaid et al. (2026)Saudi government institutionsMean awareness score: 4.2/5High awarenessGovernment implementation capacityAlaeaid et al. (2026)Saudi government institutionsImplementation score: 3.8–3.9/5Moderate implementation capacityOverall interpretationSynthesis of empirical studies–Evidence consistently indicates that implementation capacity continues to lag behind legislative requirements despite increasing institutional awareness.Persistent implementation gapEmpirical evidence on PDPL compliance across different studies.3.4.4.2 Post-enforcement compliance assessment (2026)Following the implementation of the Personal Data Protection Law (PDPL), Alashwali and Alhuzali (2026) evaluated the privacy policies of 100 Saudi e-commerce websites. The study found that only 31% of the websites declared all four PDPL-related privacy policy elements examined namely, information relating to the data controller, the purposes of processing, data subject rights, and the selected compliance criteria specified by the authors. The analysis further revealed comparatively higher levels of non-compliance among top-ranked and locally hosted websites, indicating that market prominence or local hosting does not necessarily correspond to stronger privacy compliance. Although based on a limited sample, the findings highlight persistent implementation challenges within the Saudi e-commerce sector following the PDPL’s entry into force.3.4.4.3 Government institution implementation (2026)Alaeaid et al. (2026) conducted a mixed-methods study of Saudi government institutions and found: High awareness, moderate implementation: PDPL awareness is high (mean ≈ 4.2 on a five-point Likert scale) but implementation capacity is moderate (means ≈ 3.8–3.9). Capacity constraint: The gap between awareness and implementation is concentrated in technical infrastructure and AI integration capacity rather than legal knowledge. Organizational factors: Compliance deficit is not primarily a legal awareness problem but an organizational and technical capacity problem one that legal reform alone cannot solve. Survey reliability: Instrument demonstrates acceptable reliability (Cronbach’s α = 0.777), strengthening confidence in findings.3.5 Cross-cutting structural deficienciesReading the four instruments together reveals multiple systemic weaknesses transcending individual laws.3.5.1 Regulatory fragmentationThe ACCL sits under the Ministry of Interior and the Public Prosecution; PDPL enforcement lies with SDAIA/NDMO; e-commerce regulation is divided between EOTS (Ministry of Commerce) and ECS implementation (Ministry of Commerce with NDMO involvement); and the NCA operates with mandate spanning all domains.Key Findings: Institutional Fragmentation: Four separate governmental entities oversee different aspects of cybercrime governance without a unified coordination mechanism, creating jurisdictional ambiguity. Coordination Deficiency: Informal mechanisms (MoUs, ad hoc cooperation) are insufficient for effective cross-domain enforcement, particularly for violations spanning multiple regulatory domains (e.g., cybercrime + data breach + e-commerce fraud). NCA Authority Gap: The National Cybersecurity Authority advises but lacks enforcement authority, creating potential conflicts between policy objectives and prosecutorial discretion. E-Commerce Isolation: The Ministry of Commerce operates with no formal coordination with cybersecurity or data protection authorities, despite direct relevance to consumer protection and fraud prevention.Overlapping and unclear jurisdictions create: Compliance uncertainty: Enterprises unclear which authority has primary jurisdiction for mixed violations (cybercrime + data breach + e-commerce fraud). Enforcement gaps: Gaps in prosecutorial responsibility where conduct falls between institutional mandates. Investigation delays: Coordination delays in cases involving simultaneous cybercrime, data protection breach, and e-commerce fraud. Alhejaili (2024) identifies regulatory fragmentation as one of the central obstacles to effective governance.3.5.2 Enforcement asymmetryAll four laws are more precisely developed on the substantive side (what is prohibited) than on the procedural side (how violations are investigated, prosecuted, and adjudicated).Analysis of Substantive-Procedural Asymmetry:Definition: Substantive-procedural asymmetry refers to the imbalance between well-developed statutory provisions defining offenses and penalties (substantive law) and underdeveloped provisions governing investigation, evidence collection, and adjudication (procedural law). This asymmetry creates enforcement deficits even where substantive prohibitions are clear.Key Patterns: Domestic Enforcement Gap: All four instruments contain well-developed substantive provisions but rely on general procedural frameworks (general criminal procedure law, general commercial law, general administrative law) that lack specialization in digital evidence handling, chain of custody standards, or cybercrime-specific investigative procedures.Cross-Border Enforcement Deficit: The asymmetry is most acute in cross-border enforcement. While all four instruments potentially apply extraterritorially (e.g., ACCL Article 1 captures foreign instigators; PDPL Article 20 controls cross-border transfers; ECS applies to B2C sales to Saudi consumers regardless of seller location), no corresponding international mutual legal assistance framework exists to facilitate investigation and prosecution when perpetrators or data controllers operate outside Saudi jurisdiction.Evidence and Admissibility Uncertainty: Courts lack explicit guidance on admissibility standards for digitally-acquired evidence (forensic acquisitions, network logs, metadata, encrypted communications). This procedural uncertainty discourages prosecution of cases requiring sophisticated digital evidence.Institutional Dependence on General Frameworks: The absence of specialized procedural codes forces reliance on general criminal and civil procedure frameworks designed for traditional (non-digital) crimes. These frameworks inadequately address digital evidence peculiarities.Recommended Solutions: Enact a Unified Digital Crimes Procedure Code specifying standards for digital evidence collection, chain of custody, admissibility, and cross-border data sharing applicable across all four substantive instruments. Negotiate bilateral mutual legal assistance treaties (MLATs) specifically addressing cybercrime, with provisions modeled on Budapest Convention standards for cross-border investigation cooperation. Establish specialized cybercrime investigation and prosecution units with training in digital forensics, encryption, and international cooperation mechanisms.Cross-border enforcement where the perpetrator or data controller is outside Saudi jurisdiction is particularly underdeveloped. The non-ratification of the Budapest Convention and the absence of bilateral mutual legal assistance treaties (MLATs) specifically addressing cybercrimes compound this problem. While Saudi Arabia has general MLATs with some jurisdictions, these were designed for traditional crime and lack the specialized digital evidence procedures required for effective cybercrime cooperation.3.5.3 Technology neutrality deficitThe ACCL, EOTS, and ECS are not technology-neutral in the way modern cyber law frameworks aspire to be. References to specific technologies (e.g., the restrictive e-signature regime in the 2006 EOTS, qualified electronic signature requirements) embed regulatory obsolescence into statutory text. By contrast, the EU’s approach through principles-based regulation with implementing technical standards allowing law to endure as technology evolves provides a more durable model. This deficit manifests in:Statutory rigidity: Specific technology references (e.g., “qualified electronic signatures”) require legislative amendment as technology evolves. Regulatory lag: Courts face uncertainty applying 2007 law to 2024 + threat landscapes (AI deepfakes, cryptojacking, IoT botnets). International misalignment: Technology-specific provisions diverge from UNCITRAL Model Law on E-Commerce (UNCITRAL (United Nations Commission on International Trade Law), 1996), which prioritizes functional equivalence over technological prescription.3.5.4 Absence of unified digital crimes procedure codeSaudi Arabia lacks a specialist procedural framework governing: Digital evidence collection standards: No unified specification for forensic acquisition procedures, chain of custody requirements, or storage protocols. Admissibility thresholds: Inconsistent judicial application regarding admissibility of digitally-acquired evidence across criminal, civil, and regulatory proceedings. Cross-border data sharing: No formal framework for requesting and sharing digital evidence across jurisdictions.Alhamed et al. (2025) highlight the need to integrate electronic commercial records into a coherent legal framework with certification standards for digital evidence. This gap weakens all four substantive instruments simultaneously by creating uncertainty regarding investigative procedures and evidence admissibility.The analytical procedures and source-selection criteria are described in sufficient detail to facilitate replication of the study using the same legislative corpus, comparative framework, and literature selection strategy, while recognizing that future legislative amendments and newly published empirical studies may produce different findings.3.6 Judicial application and enforcement practicesBecause published Saudi judicial decisions in cybercrime matters remain limited and many judgments are not publicly accessible, this section does not seek to provide a comprehensive account of judicial practice. Instead, it offers an illustrative discussion based on the available legislation, published academic literature, and limited publicly available institutional materials. Accordingly, the observations presented here should be understood as indicative rather than representative of the broader judicial landscape.3.6.1 Identity theft and credential theftAlthough the Saudi Anti-Cyber Crime Law (ACCL) criminalizes unauthorized access to computer systems, electronic fraud, and related cyber offenses, it does not expressly define identity theft as an independent criminal offense. As noted by Almerdas (2014), this legislative omission may create uncertainty in cases where personal credentials are misused without immediate financial gain, such as impersonation, online harassment, or reputational attacks. In practice, such conduct may be prosecuted under broader provisions relating to unauthorized access, privacy violations, or fraud, depending on the factual circumstances of each case. This approach provides a degree of prosecutorial flexibility but may also reduce legal certainty and consistency compared with jurisdictions that expressly criminalize identity theft as a distinct offense.3.6.2 Cyberbullying and online harassmentSaudi legislation does not currently contain dedicated provisions specifically addressing cyberbullying or online harassment within the Anti-Cyber Crime Law. Instead, harmful online conduct may fall within the combined application of the Anti-Cyber Crime Law, the Crime of Harassment Law (2018), general criminal provisions, and, where appropriate, judicial discretion under Islamic criminal law principles (Ta′zir). As previous scholarship has observed (Alshammari and Singh, 2018; Singh and Alshammari, 2020), this fragmented legislative approach provides courts with flexibility but may also generate uncertainty regarding offense classification, prosecutorial consistency, and the scope of legal protection available to victims. The absence of explicit statutory definitions for behaviors such as cyberstalking, coordinated online harassment, and non-consensual dissemination of intimate material remains a significant legislative gap.3.6.3 Enforcement of the personal data protection lawBecause the Personal Data Protection Law entered into force only in September 2023, publicly available judicial practice remains relatively limited. Consequently, assessment of enforcement currently relies primarily on empirical compliance studies rather than extensive reported case law. Recent studies indicate that many organizations continue to experience implementation challenges despite growing institutional awareness of PDPL obligations (Alhazmi and Daghistani, 2025; Alashwali and Alhuzali, 2026; Alaeaid et al., 2026). These findings suggest that the principal obstacle to effective enforcement lies less in the statutory framework itself than in organizational readiness, technical capability, and institutional implementation. As additional judicial decisions and official enforcement actions become publicly available, future research will be able to evaluate more comprehensively the practical effectiveness of the PDPL enforcement regime.3.6.4 E-commerce dispute resolutionSaudi Arabia has established judicial and administrative mechanisms for resolving commercial disputes; however, it has not yet introduced a dedicated Online Dispute Resolution (ODR) framework specifically designed for e-commerce disputes. Consequently, online consumer disputes are generally resolved through ordinary judicial procedures or internal complaint mechanisms operated by digital platforms. Although these mechanisms provide practical avenues for dispute settlement, they may not offer the speed, accessibility, or procedural efficiency associated with specialized ODR systems adopted in several comparative jurisdictions. International experience, particularly the UNCITRAL Technical Notes on Online Dispute Resolution, suggests that dedicated digital dispute resolution mechanisms can significantly improve consumer confidence while reducing litigation costs and procedural delays.3.6.5 Digital evidence and procedural challengesThe increasing reliance on electronic evidence has highlighted the importance of clear procedural standards governing the collection, preservation, authentication, and presentation of digital evidence. While Saudi law recognizes the legal validity of electronic transactions and electronic records through the Electronic Transactions System, comprehensive procedural rules governing digital forensic evidence remain comparatively underdeveloped. As a result, courts continue to rely largely on general evidentiary principles and expert testimony when assessing the authenticity and reliability of electronic evidence. Comparative scholarship emphasizes that the development of unified procedural standards for digital evidence including chain-of-custody requirements, forensic acquisition protocols, and treatment of encrypted communications would strengthen legal certainty, improve consistency in judicial practice, and facilitate international cooperation in cybercrime investigations.3.7 International benchmarkingSummary and Key Findings: Consistent Pattern: Saudi Arabia’s cybercrime framework is architecturally present across most regulatory dimensions but substantively thinner than leading international models, particularly in procedural and enforcement dimensions. The Kingdom demonstrates substantive presence in foundational areas (data protection, cybercrime definitions, e-commerce framework) but frequently lags in procedural, enforcement, adaptive, and cross-border cooperation dimensions where international frameworks are most demanding.Strengths: Well-developed substantive prohibitions across all four instruments; institutional infrastructure (SDAIA, NCA, NDMO); alignment with Islamic legal principles; regional leadership within GCC; demonstrated judicial capacity to address statutory gaps through creative interpretation.Critical Gaps: Technology-neutral enforcement procedures; AI governance specificity; independent enforcement authority; cross-border cooperation mechanisms; periodic review mechanisms; online dispute resolution infrastructure; unified digital crimes procedure code.Strategic Opportunities: Adopt EU-style tiered e-signature requirements; implement Budapest Convention-equivalent bilateral MLATs; establish independent data protection supervisory authority; embed periodic statutory review cycles; develop specialized digital crimes procedure code; establish formal ODR mechanisms; create unified digital evidence standards.3.7.1 GCC regional contextWithin the GCC, Tsyplakova and Shestak (2024) note that KSA and UAE have emerged as the regional leaders in cybersecurity law, but GCC-wide harmonization remains incomplete. The group’s cybercrime legislation uses non-standard terminology compared to the Budapest Convention, and the six member states’ laws diverge significantly in offense coverage and penalties complicating even intra-GCC cooperation (Alazab and Chon 2015).Valiakhmetova and Tsukanov (2025) propose a periodization of GCC cybersecurity legal development and identify the current phase as one of modernization toward international standards, with the EU model as the primary reference point. Saudi Arabia’s position as a regional leader creates opportunity for GCC-wide harmonization initiatives addressing procedural standards, digital evidence procedures, and ODR mechanisms.4 DiscussionThe critical doctrinal analysis presented in section 3 reveals a cybercrime legal framework that is architecturally present but substantively thinner than leading international models. This finding both confirms and complicates conclusions from prior comparative scholarship on GCC cybersecurity law.Alshammari and Singh (2018) and Singh and Alshammari (2020) characterized Saudi Arabia’s cybersecurity landscape as one of institutional fragmentation and substantive-procedural asymmetry a diagnosis this study confirms and extends. Specifically, Singh and Alshammari identified governance coordination failure as a structural challenge; this analysis demonstrates that the fragmentation extends not merely to governance structures (confirmed in Table 3) but fundamentally to the relationship between substantive prohibitions and procedural mechanisms for enforcement. The four separate institutional authorities overseeing different aspects of cybercrime governance, operating through informal coordination mechanisms (MoUs) rather than unified legal frameworks, create systematic gaps where violations spanning multiple regulatory domains fall between institutional mandates.Regulatory domainPrimary authoritySupervisory frameworkCoordination mechanismAssessmentCybercrime prosecution (ACCL)Ministry of Interior + Public ProsecutionCriminal procedure law; NCA technical standardsAd hoc interagency cooperationFragmentedData protection (PDPL)SDAIA + NDMOAdministrative regulation; SDAIA enforcementMemoranda of understanding (informal)Informal coordinationElectronic transactions (EOTS)Ministry of CommerceCommercial law; general contract principlesNo formal mechanismIsolatedE-commerce (ECS)Ministry of CommerceCommercial law; consumer protection standardsNo formal mechanismIsolatedCybersecurity policy (NCA)National Cybersecurity AuthorityNational Cybersecurity Strategy; Essential ControlsAdvises other agencies; no enforcement authorityAdvisory onlyCross-cutting issuesUnclear AllocationOverlapping MandatesInstitutional Gap: No Unified Coordination MechanismCritical gapSaudi cybercrime governance institutional distribution and overlapping jurisdictional domains.However, the findings also depart in important respects from earlier comparative scholarship on GCC cybersecurity legislation. While Altayar (2017) and Tsyplakova and Shestak (2024) identify persistent gaps in legal harmonization, legislative terminology, and cross-border cooperation among GCC member states, the present analysis demonstrates that these deficiencies are concentrated primarily in procedural, institutional, and enforcement dimensions rather than in the substantive design of Saudi Arabia’s legal framework. In particular, the Personal Data Protection Law (PDPL) establishes a comprehensive set of data protection principles broadly aligned with contemporary international regulatory standards, although important differences remain in institutional governance and implementation. For example, the PDPL’s data localization provisions may increase compliance obligations for some organizations, especially small and medium-sized enterprises, yet they can also be understood as reflecting broader national policy objectives relating to digital sovereignty, strategic data governance, and the implementation of Saudi Vision 2030. Furthermore, the mixed-methods study by Alaeaid et al. (2026) reported high levels of awareness of PDPL requirements among Saudi government institutions alongside only moderate implementation capacity, suggesting that effective regulatory compliance depends not only on legal knowledge but also on organizational readiness, technical capability, and institutional support.The distinction matters critically. A framework that is procedurally underdeveloped but substantively coherent admits of targeted procedural reform; a framework that is substantively weak requires wholesale reconstruction. The findings suggest that Saudi Arabia’s cybercrime governance challenge is not fundamentally one of legislative definition but of enforcement infrastructure and procedural specification. This diagnosis carries important implications for reform strategy discussed in section 4.8 and suggests that meaningful governance improvement is achievable through focused procedural modernization rather than comprehensive legislative overhaul.4.1 Explaining the substantive–procedural asymmetry: institutional and structural factorsThe comparative analysis indicates that the imbalance between relatively comprehensive substantive regulation and comparatively underdeveloped procedural mechanisms reflects broader institutional and historical factors rather than isolated legislative drafting deficiencies.First, the four principal legislative instruments were enacted over an extended period (2006–2021), during which Saudi Arabia’s digital governance priorities evolved considerably. Earlier legislation, particularly the Anti-Cyber Crime Law (2007) and the Electronic Transactions System (2006), was adopted before the emergence of many contemporary international standards governing digital evidence, cross-border cooperation, and platform regulation. By contrast, the Personal Data Protection Law (2021) reflects a more recent regulatory environment influenced by international privacy frameworks while remaining adapted to Saudi legal and institutional priorities.Second, the findings suggest that institutional fragmentation contributes to procedural inconsistency. Responsibilities for cybercrime, data protection, electronic commerce, and cybersecurity are distributed among several governmental authorities, requiring coordination across different legal and administrative domains. Similar coordination challenges have also been reported in comparative studies of digital governance, indicating that this is not a uniquely Saudi phenomenon but a broader institutional issue affecting many jurisdictions.Third, the Saudi regulatory model generally favors legal certainty through detailed statutory provisions rather than broad technology-neutral principles. While this approach provides clearer legal guidance at the time of enactment, it may require more frequent legislative updates as digital technologies evolve.Taken together, these factors suggest that the principal challenge lies not in the absence of substantive legal protection, but in strengthening procedural coordination, institutional integration, and adaptive regulatory mechanisms. Consequently, the findings support reform strategies that prioritize procedural modernization and interagency coordination while preserving the existing substantive legislative framework.4.2 The institutional Independence gap and enforcement legitimacy: nuance requiredA critical finding is the executive-branch positioning of enforcement authorities (SDAIA/NDMO for PDPL; Ministry of Interior for ACCL). This institutional choice diverges from the independent supervisory model that characterizes GDPR enforcement (Article 51: independent Data Protection Authorities) and raises legitimacy questions. However, the conventional comparativist critique requires important qualification in the Saudi context.The Standard Critique: Executive-branch enforcement authorities lack institutional independence necessary to resist political capture and ensure impartial adjudication. Under this critique, SDAIA’s executive positioning undermines PDPL enforcement legitimacy compared to EU models, creating compliance incentive deficits.Qualification 1 – Institutional Legitimacy: The SDAIA model reflects a legitimate institutional choice grounded in Saudi Arabia’s administrative law tradition. The executive-centered supervisory model is not unique to Saudi Arabia; it characterizes administrative enforcement in many civil-law jurisdictions (France, Germany, Spain), and quasi-judicial review remains available through Saudi judicial channels. The independent supervisory authority model, by contrast, is a specifically EU construction reflecting particular constitutional values (democratic accountability to Parliament, separation of powers) and institutional capacities. It is not a universal template for legitimate regulation. Many non-OECD jurisdictions operate effective data protection and cybersecurity enforcement through executive-branch agencies without demonstrable legitimacy deficits.Qualification 2 – Demonstrated Competence: SDAIA has demonstrated through the 2019 National Cybersecurity Strategy and Essential Controls framework both technical competence and institutional capacity to resist political capture on narrow technical standards. Whether this technical institutional culture extends to PDPL data protection enforcement remains to be demonstrated empirically, but it cannot be assumed not to exist based solely on formal institutional positioning. The early enforcement actions documented in available reports suggest that SDAIA is applying PDPL standards across diverse sectors without apparent selective political application.Qualification 3 – Deliberate Policy Trade-off: The institutional positioning reflects deliberate policy to embed data protection within a broader digital governance apparatus rather than establishing a standalone supervisory authority. This choice carries both costs (weaker institutional independence from executive direction) and benefits (greater technical capacity for cybersecurity integration, better coordination with NCA/NDMO, avoiding creation of a new bureaucratic entity). The choice is not self-evidently wrong it reflects a different institutional design philosophy prioritizing integrated governance over specialized independence.However, the critical gap remains: SDAIA’s executive positioning, combined with broad consent exceptions (Gap 2 in section 3.4.3 regarding PDPL Article 5 on overly broad public interest and national security exceptions) and limited appeal mechanisms, does weaken PDPL enforcement deterrence compared to GDPR’s independent supervisory model. The empirical evidence in section 3.4.4 showing that post-enforcement compliance reaches only 31% on full disclosure standards despite high legal awareness (4.2/5 on Likert scale) suggests that compliance incentives may be insufficient. The paradoxical finding that non-compliance is higher among top-ranked platforms (suggesting market prominence does not correlate with regulatory compliance) raises additional questions about enforcement deterrence capacity.The critical question remains: Whether this 31% compliance reflects institutional independence deficit per se or other factors (technical capacity constraints, high cost of compliance, lack of enforcement clarity, organizational inertia) requires further empirical investigation. A mechanism for causal identification is absent from this doctrinal analysis, pointing to the need for future research examining actual organizational compliance decision-making.4.3 The Budapest convention question: strategic non-ratification vs. incapacityA critical distinction highlighted in this analysis is between non-ratification grounded in constitutional/Shariah-based reservations versus non-ratification grounded in incapacity or indifference. This distinction is normatively significant and shapes reform recommendations fundamentally.Evidence points toward strategic non-ratification rather than incapacity. Saudi Arabia has independently developed cybercrime standards (ACCL) that are broadly comparable to Budapest Convention standards in many dimensions (offense definitions, graduated penalties, extraterritorial jurisdiction). The Personal Data Protection Law (2021) demonstrates sophisticated engagement with international data protection frameworks and deliberate localization not a refusal to engage but rather selective adoption aligned with constitutional principles. The NCA’s Essential Cybersecurity Controls framework shows technical sophistication in cybersecurity governance comparable to leading international practice (NIST Cybersecurity Framework, ISO 27001-based standards). Regional alternatives the Arab Convention on Combating Cybercrime (adopted 2010, not yet in force) and GCC harmonization efforts through the Riyad Document represent deliberate institutional strategies rather than substitutes for incapacity.This is a critical finding: Saudi Arabia is not “behind” on cybercrime law because of inability; it is positioned differently due to constitutional choice grounded in Islamic legal principles and data sovereignty objectives.However, non-ratification carries substantial costs that merit serious consideration. Enforcement deficit: The absence of bilateral mutual legal assistance treaties (MLATs) specifically addressing cybercrime creates substantive enforcement deficits for cross-border cases. The Riyad Document of the GCC, while representing intra-GCC coordination progress, does not provide the level of standardized cooperation that Budapest Convention frameworks provide across 67 diverse signatory jurisdictions. Procedural uncertainty: The absence of formal accession to Budapest Convention’s digital evidence procedures even if Saudi Arabia uses substantively equivalent standards in practice creates procedural uncertainties that inhibit international cooperation. Courts in foreign jurisdictions lack assurance that Saudi Arabia’s practices meet international standards, complicating mutual legal assistance requests and evidence sharing. Reputational barrier: Courts in third-country jurisdictions may view Saudi Arabia as non-compliant with international cybercrime standards despite substantive convergence, creating barriers to mutual legal assistance requests and extradition cooperation.Strategic opportunity: Saudi Arabia could achieve Budapest Convention-equivalent cooperation through bilateral MLATs incorporating Budapest Convention technical standards, without formal Convention membership. Three major jurisdictions demonstrate this model: the United States (complex relationship to conventions), India (not party to Budapest Convention but has substantial bilateral cybercrime cooperation with 15 + countries), and China (explicitly non-party to Budapest Convention, yet has bilateral cybercrime cooperation with major trading partners). This approach would preserve constitutional/Shariah autonomy, address practical enforcement deficits, reduce reputational barriers to cooperation, and maintain strategic flexibility. The bilateral MLAT approach deserves serious policy consideration as a compromise between formal Convention membership and continued isolation from international cybercrime cooperation infrastructure.4.4 Vision 2030 and digital economy: alignment and tensionA recurring tension in this analysis is between cybercrime law reform requirements and Vision 2030 digital economy objectives. This tension requires explicit discussion because it shapes reform priorities and reveals potential conflicts between security and economic growth.Vision 2030 targets digital sector growth from approximately 4–20% of GDP, heavily dependent on attracting foreign digital investment and enabling e-commerce at scale. Yet several framework components analyzed here create compliance burdens that may deter foreign investment or increase operational costs for multinational enterprises.The restrictive e-signature regime (section 3.3.2, Gap 1 under ECS analysis): Requirements for qualified electronic signatures impose higher compliance costs on SMEs than the tiered approach characteristic of EU (eIDAS Regulation) and UNCITRAL models. This deters digital commerce participation among smaller merchants, reducing market depth and competition. Foreign e-commerce platforms face higher authentication costs in Saudi Arabia compared to other regional markets, creating competitive disadvantages.Data localization requirements (section 3.4.3, Gap 3): Mandatory local storage of personal data (PDPL Article 20) imposes infrastructure costs on multinationals and foreign cloud providers (AWS, Azure, Google Cloud), creating competitive disadvantages for foreign service providers. Suliman (2025) characterizes this as “a genuine policy dilemma” between sovereignty and openness. The requirement creates high capital expenditure for foreign cloud providers, operational inefficiency (duplicating global infrastructure), and reduced foreign investment in data services. For multinationals, the requirement increases compliance cost by an estimated 15–25% compared to adequacy-decision models, creating incentives for companies to prioritize other regional markets.Platform liability uncertainty (section 3.3.2, Gap 2): Undefined liability for online platforms creates strategic uncertainty for multinational e-commerce platforms regarding Saudi market entry, particularly post-PDPL enforcement. Market entrants require clarity regarding which entity (marketplace, seller, logistics operator) bears liability for defective goods or data breaches. This uncertainty particularly deters platform entry in high-liability sectors (pharmaceuticals, financial services, consumer electronics).Consumer protection incompleteness (section 3.3.2, Gap 3): Absence of clear cooling-off periods and reverse burden of proof standards for defective goods reduces consumer confidence in cross-border e-commerce, lowering market demand and deterring seller participation. Cross-border e-commerce adoption lags regional peers in part due to these gaps.Critical insight: These constraints are not merely technical deficiencies; they reflect explicit policy choices prioritizing data sovereignty, consumer protection, and cultural values over maximum digital openness. The policy question is not whether these constraints exist but whether their costs in foregone digital investment are justified by their benefits in sovereignty preservation and cultural protection. This is a normative choice that lies beyond the scope of legal analysis but has significant implications for reform sequencing.A sectoral resolution approach: Saudi Arabia could adopt the EU’s graduated sectoral approach: tighter data protection requirements for sensitive personal data (health, biometric, financial) and more permissive approaches for non-sensitive commercial data. This would preserve sovereignty over high-value, culturally sensitive data, reduce compliance burden for lower-risk commerce, enable SME participation in digital economy, and attract foreign investment in non-sensitive sectors (digital goods, software, entertainment). Implementation would require PDPL amendment to establish sectoral carve-outs, but would maintain protection where culturally and strategically important while reducing barriers to digital commerce in appropriate sectors.4.5 International benchmarking: positioning Saudi Arabia in the global regulatory landscapeThe comparative analysis indicates that Saudi Arabia has developed a mature legislative framework for regulating cybercrime and digital activities, although its regulatory profile differs from leading international models in several important respects. Rather than reflecting an overall regulatory deficit, these differences illustrate distinct policy priorities shaped by national legal traditions, institutional arrangements, and the objectives of Vision 2030.The findings suggest that Saudi Arabia’s principal strengths lie in the existence of comprehensive substantive legislation governing cybercrime, electronic transactions, electronic commerce, and personal data protection, supported by specialized institutions such as SDAIA, the National Cybersecurity Authority (NCA), and the National Data Management Office (NDMO). These developments position Saudi Arabia among the more advanced regulatory systems within the GCC and demonstrate a sustained commitment to digital governance.At the same time, the comparison highlights that the principal areas requiring further development are procedural rather than substantive. In particular, mechanisms governing digital evidence, cross-border cooperation, online dispute resolution, AI-specific regulation, and periodic legislative review remain less developed than those found in contemporary international frameworks such as the GDPR, the EU AI Act, the Budapest Convention, and UNCITRAL instruments. These differences primarily affect the practical implementation and long-term adaptability of the legal framework rather than its fundamental legislative architecture.Overall, the international comparison suggests that future reform should emphasize institutional coordination, procedural modernization, and adaptive governance while preserving the core features of the Saudi legal system. Such an approach would strengthen international compatibility without requiring wholesale transplantation of foreign regulatory models, thereby supporting both national legal autonomy and the broader objectives of Saudi Vision 2030.4.6 Comparative context: GCC positioning and regional harmonizationWithin the GCC, the analysis reveals both convergence and fragmentation. All six GCC members have enacted broadly parallel cybersecurity and data protection laws. The UAE’s PDPL (2021) is substantively similar to Saudi Arabia’s; Oman (2024), Qatar, Bahrain, and Kuwait have comparable frameworks. This suggests region-wide recognition of data protection imperatives and cybersecurity challenges as governance priorities.Fragmentation persists in several dimensions: Terminology in cybercrime laws uses non-standard terminology compared to Budapest Convention, complicating intra-GCC cooperation and extradition. Procedural standards in implementation of digital evidence procedures vary across GCC states, creating coordination challenges. Enforcement mechanisms differ markedly (e.g., UAE’s independent Data Protection Office vs. Saudi Arabia’s SDAIA positioning). ODR infrastructure has not been implemented by any GCC member, creating access barriers for consumers across the region.Valiakhmetova and Tsukanov (2025) characterize the GCC as in a “modernisation phase” toward international standards, with EU and Budapest Convention frameworks as primary reference points. This characterization is accurate. However, the regional coordination infrastructure particularly the Riyad Document framework remains incomplete and inconsistently implemented across member states, limiting its effectiveness for intra-regional enforcement cooperation.Strategic opportunity: A meaningful opportunity exists for GCC-wide harmonization of procedural standards for digital evidence, unified digital crimes procedure codes, ODR mechanisms, and AI governance frameworks. Such harmonization would simultaneously strengthen intra-GCC enforcement cooperation, reduce compliance burden for multinational operators working across GCC states, position GCC as a coherent digital governance bloc on the international stage, and create economies of scale for regional institutions (unified GCC DPA, shared ODR platform). Saudi Arabia, as the largest GCC economy and a regional leader in cybersecurity law, could spearhead such harmonization efforts, consolidating regional leadership while addressing domestic governance gaps.4.7 Implications for reform: strategic three-tier approachThe analysis suggests a strategic, sequenced approach to reform that prioritizes addressing the substantive-procedural asymmetry documented in Table 4. The reform strategy respects Saudi institutional autonomy while achieving international alignment and supporting Vision 2030 digital economy objectives.InstrumentSubstantive frameworkProcedural frameworkQualitative assessmentAnti-Cyber Crime Law (ACCL)Clearly defines cyber offenses and establishes graduated criminal penalties.Provides only limited procedural guidance, relying largely on the general criminal procedure framework.Strong substantive regulation, but procedural mechanisms remain comparatively underdeveloped.Electronic Transactions System (ETS)Establishes legal validity of electronic signatures, records, and electronic transactions.Contains limited procedural guidance concerning authentication, forensic handling, and chain of custody for digital evidence.Substantive legal recognition exceeds procedural regulation of electronic evidence.E-Commerce System (ECS)Regulates consumer rights, trader obligations, and electronic contracts in considerable detail.Relies primarily on ordinary judicial procedures and lacks specialized online dispute resolution mechanisms.Comprehensive substantive regulation but limited procedural specialization for digital commerce disputes.Personal Data Protection Law (PDPL)Provides a comprehensive framework governing personal data processing and data subject rights.Administrative enforcement procedures remain relatively limited and depend substantially on supplementary regulatory guidance issued by SDAIA.Strong statutory framework, with implementation supported by administrative guidance rather than detailed procedural legislation.Cross-Border EnforcementCertain statutory provisions have potential extraterritorial implications.No comprehensive legal framework specifically governing international digital evidence sharing or cybercrime cooperation.Cross-border procedural cooperation remains the least developed component of the current regulatory framework.Substantive–procedural asymmetry across the Saudi cyber regulatory framework.4.7.1 Tier 1 reforms (high priority, achievable in 12–24 months)4.7.1.1 Enact a unified digital crimes procedure codeSpecify standards for digital evidence collection, acquisition, and authentication procedures; chain of custody requirements for digital forensics; admissibility thresholds for digitally-acquired evidence (forensic acquisitions, network logs, metadata, encrypted communications); specialized investigative procedures for cybercrime (geographic routing analysis, cryptographic key recovery); and cross-border data sharing protocols with third jurisdictions.This reform would simultaneously strengthen ACCL, ECTS, and PDPL enforcement by providing unified procedural standards that courts could apply across all three substantive instruments. The code should address the specific challenge of encrypted communications and cryptographic key recovery, establishing clear procedures for warrants and judicial authorization. Legislative precedent exists in EU directives (Directive 2014/41/EU on the European Investigation Order) and could be adapted to Saudi institutional context. Implementation timeline: 12–18 months for legislative drafting and consultation.4.7.1.2 Develop specialized cybercrime investigation and prosecution unitsWithin the Public Prosecution, establish dedicated units with training in digital forensics (imaging, chain of custody, artifact recovery), encryption analysis and cryptographic key recovery, international cooperation mechanisms (mutual legal assistance, extradition), and cross-border data access protocols.This institutional investment would address the practical enforcement gap where courts face cases requiring expertise currently unavailable within general prosecution units. International cooperation between prosecution services and the NCA would be essential. Implementation timeline: 12–24 months for unit establishment and training.4.7.1.3 Clarify SDAIA’S enforcement roleThrough supplementary regulation, specify appeal mechanisms and judicial review standards for SDAIA enforcement decisions; transparency requirements for enforcement decisions (public register of violations, proportionate penalties); and proportionality standards for penalty imposition (graduated fines, mitigation factors).This would enhance PDPL enforcement legitimacy without requiring institutional restructuring. The supplementary regulation should establish clear escalation procedures and create audit mechanisms ensuring proportionate enforcement. Implementation timeline: 6–12 months for regulatory drafting.4.7.2 Tier 2 reforms (medium priority, 24–36 months)4.7.2.1 Negotiate bilateral mutual legal assistance treaties (MLATs)With priority jurisdictions (USA, EU member states, UAE, United Kingdom), incorporating Budapest Convention technical standards for digital evidence handling; expedited procedures for cybercrime investigations; data preservation orders across jurisdictions; and joint investigation mechanisms.This would address the cross-border enforcement deficit identified in section 3.5.2 without requiring formal Budapest Convention membership. Bilateral negotiations allow customization to Saudi institutional requirements while achieving functional equivalence to Convention standards. Implementation timeline: 24–36 months for negotiations with multiple jurisdictions.4.7.2.2 Adopt tiered E-signature regimeFollowing the eIDAS (Regulation (EU) 2014/910) model, specify that low-risk transactions (digital goods, services) permit advanced electronic signatures while high-risk transactions (financial instruments, real property) require qualified electronic signatures.This reduces SME compliance burden while maintaining security for sensitive transactions. Implementation would require EOTS amendment to establish the tiered framework. Implementation timeline: 18–24 months for legislative amendment and implementation guidance.4.7.2.3 Establish formal online dispute resolution mechanismFor consumer disputes, potentially through GCC-wide infrastructure following UNCITRAL Technical Notes (2016) model, making mechanisms accessible to consumers without legal representation, integrating with small claims procedures, and establishing cross-border enforcement mechanisms.This would address the gap identified in Table 5 regarding consumer access to justice. Initial implementation could be limited to B2C e-commerce disputes, expandable to other consumer domains. Implementation timeline: 24–36 months for platform development and integration with judicial systems.Regulatory dimensionSaudi ArabiaInternational benchmarkComparative assessmentPersonal data protectionThe PDPL establishes a comprehensive statutory framework emphasizing consent and regulatory oversight, with relatively restrictive rules governing cross-border data transfers.The GDPR provides multiple lawful bases for processing, stronger institutional independence, and more flexible international transfer mechanisms (Yeung and Bygrave, 2022).The Saudi framework provides strong statutory protection but remains comparatively more restrictive and less institutionally developed than the GDPR.Cybercrime legislationThe Anti-Cyber Crime Law criminalizes a broad range of cyber offenses and establishes criminal sanctions.The Budapest Convention provides more detailed offense definitions together with extensive procedural and international cooperation provisions.Saudi legislation provides comprehensive substantive criminalization but comparatively less developed procedural and international cooperation mechanisms.Electronic transactions and electronic signaturesThe Electronic Transactions System recognizes electronic signatures and records within a relatively technology-specific framework.The eIDAS Regulation adopts a technology-neutral and risk-based regulatory model.The Saudi framework provides legal certainty but remains comparatively less flexible than contemporary international approaches.Platform liabilityThe E-Commerce System regulates traders and consumer protection but provides limited regulation of intermediary and platform liability.The Digital Services Act establishes differentiated obligations according to platform size and systemic risk.Platform governance remains one of the least developed components of the Saudi regulatory framework.Online dispute resolutionNo dedicated statutory Online Dispute Resolution (ODR) framework currently exists.The European Union and UNCITRAL have developed specialized digital dispute resolution models.This represents a significant opportunity for future legislative development.Cross-border cooperationExisting legislation provides limited mechanisms for international cybercrime cooperation.International instruments provide more comprehensive mechanisms for mutual legal assistance and digital evidence exchange.International cooperation remains comparatively underdeveloped.Artificial intelligence governanceAI governance is currently addressed primarily through SDAIA guidance rather than integrated statutory regulation.The EU AI Act establishes a comprehensive risk-based regulatory framework.Saudi Arabia has established important policy foundations but has not yet adopted a comprehensive legislative framework for AI governance.Institutional oversightRegulatory supervision is exercised primarily through governmental authorities.Many international systems rely upon independent supervisory authorities.Institutional independence remains comparatively more limited than in leading international regulatory models.Legislative adaptabilityNo statutory mechanism requires periodic legislative review.Several international frameworks incorporate mandatory or periodic review provisions.Future statutory review mechanisms could strengthen regulatory adaptability.Digital evidence proceduresDigital evidence is recognized under general legal principles and the Electronic Transactions System, but specialized procedural regulation remains limited.International practice provides more detailed procedural standards governing forensic acquisition, preservation, authentication, and international evidence exchange.Procedural regulation of digital evidence remains an important area for future reform.International benchmarking of the Saudi cyber regulatory framework.4.7.3 Tier 3 reforms (long-term, 36+ months)4.7.3.1 Embed periodic statutory review clausesIn all four instruments (ACCL, ECTS, ECS, PDPL), modeled on GDPR Article 97, requiring legislative review at 4-year intervals. This creates adaptive capacity for technological evolution and allows incorporation of judicial interpretation and enforcement experience.Each review would assess statutory adequacy in light of emerging threats (AI-driven fraud, deepfakes, cryptojacking) and ensure continued relevance. Implementation timeline: 36–48 months for comprehensive legislative review and amendment.4.7.3.2 Develop comprehensive AI governance frameworkAddressing transparency requirements for automated decision-making (PDPL Article 22-type provisions), bias testing and mitigation for high-stakes decisions, and human review requirements for consequential decisions. The framework could be integrated into PDPL amendment or through standalone AI regulation modeled on the EU AI Act (2024).This would address the gap identified in Table 5 where SDAIA ethical guidelines exist but lack enforcement mechanisms. Implementation timeline: 36–48 months for comprehensive regulatory development.4.7.3.3 Develop consumer protection standards for E-commerceIncluding cooling-off periods (14-day withdrawal right modeled on EU Consumer Rights Directive Article 9), reverse burden of proof for defective goods, clear seller identification requirements, and return and refund procedures.These standards would strengthen ECS provisions and increase consumer confidence in e-commerce, supporting Vision 2030 digital economy objectives. Implementation would require ECS amendment and supporting regulatory guidance. Implementation timeline: 24–36 months for legislative amendment and implementation.4.7.4 Implementation benefitThese reforms, taken together, would address the critical gaps documented in Section 3 while respecting Saudi institutional autonomy and Vision 2030 objectives. The three-tier approach allows phased implementation without overwhelming institutional capacity, prioritizing high-impact procedural reforms in the near term while addressing deeper structural challenges and emerging issues (AI governance) over extended timelines.4.8 Limitations of the analysisThis study has several methodological limitations that should be acknowledged when interpreting its findings.4.8.1 Doctrinal scopeFirst, the study adopts a comparative doctrinal legal methodology that focuses on statutory frameworks, regulatory structures, and published academic literature. It does not examine judicial interpretation, prosecutorial decision-making, or systematic patterns of enforcement. Consequently, the analysis evaluates the legal design of the Saudi regulatory framework rather than its practical application in individual cases. Future research incorporating judicial decisions, official enforcement records, and prosecutorial practice would provide a more comprehensive understanding of how these legislative instruments operate in practice.4.8.2 Limited empirical evidenceSecond, although recent empirical studies provide valuable insights into the early implementation of the Personal Data Protection Law (PDPL), the available evidence remains limited in both scope and representativeness. The empirical discussion presented in section 3.4.4 relies primarily on three published studies (Alhazmi and Daghistani, 2025; Alashwali and Alhuzali, 2026; Alaeaid et al., 2026), each examining specific sectors rather than the Saudi regulatory environment as a whole. Existing research focuses on selected samples of commercial websites or government institutions, leaving important sectors including healthcare, financial services, telecommunications, education, and local government largely unexplored. Broader cross-sector studies employing larger and more representative samples would strengthen future assessments of regulatory implementation.4.8.3 Early stage of regulatory implementationThird, the PDPL has only recently entered into practical implementation, and the available body of empirical evidence remains relatively small. As regulatory practice evolves, additional compliance studies, official guidance, and publicly available enforcement information will allow more robust evaluation of long-term implementation trends and institutional adaptation.4.8.3.1 Institutional capacity beyond the scope of the studyFourth, the study evaluates legislative design rather than the operational capacity of the institutions responsible for implementation, including the Saudi Data and Artificial Intelligence Authority (SDAIA), the National Cybersecurity Authority (NCA), the National Data Management Office (NDMO), and the Public Prosecution. Assessing institutional effectiveness would require organizational research, budgetary analysis, staffing assessments, and performance indicators that extend beyond the scope of doctrinal legal analysis.4.8.4 Limited analysis of Islamic jurisprudenceFifth, although the discussion recognizes that several Saudi regulatory choices reflect broader Islamic legal values and public policy considerations, the study does not undertake a detailed jurisprudential analysis of Islamic criminal law or Islamic legal theory relating to cybercrime, digital privacy, or data protection. Future interdisciplinary research integrating comparative law with Islamic jurisprudence could provide additional insights into the normative foundations of Saudi digital regulation.4.8.5 Absence of stakeholder perspectivesFinally, the study does not incorporate qualitative evidence from businesses, regulators, legal practitioners, judges, consumers, or civil society organizations. Such perspectives could enrich understanding of practical implementation challenges, compliance costs, regulatory expectations, and the real-world effectiveness of Saudi Arabia’s evolving cyber regulatory framework.4.9 Future research directionsSeveral important research questions emerge from this study that warrant future investigation.4.9.1 Empirical enforcement studiesHow are courts actually applying ACCL provisions to cases involving novel cybercrimes (deepfakes, cryptojacking, AI-generated fraud)? What prosecutorial practices have emerged in PDPL enforcement post-September 2023? Qualitative case studies would illuminate actual enforcement patterns and reveal implicit judicial interpretation of vague provisions like “religious values” and “public morals” in ACCL Article 6.4.9.2 Compliance behavior researchWhat compliance rates have organizations actually achieved under PDPL post-enforcement? Which sectors lead (financial services outpacing e-commerce?), and why? Do multinationals face disproportionate compliance burden under localization requirements? Survey research and organizational case studies would address these questions and reveal whether the 31% full disclosure rate found in post-enforcement audits represents a stable equilibrium or a transitional phase.4.9.3 Comparative institutional analysisHow do SDAIA enforcement practices compare to independent Data Protection Authorities in comparable non-OECD jurisdictions (India, Brazil, Indonesia)? Are there institutional advantages to SDAIA’s executive positioning that might inform broader debates about optimal DPA design? Comparative study of non-independent DPAs could challenge EU-centric assumptions about necessary institutional independence.4.9.4 International cooperation studiesWhat barriers exist to effective mutual legal assistance in cybercrime investigations between Saudi Arabia and third jurisdictions? Would bilateral MLAT negotiation substantially improve cooperation or are deeper barriers present (language, technical capacity, trust)? Interviews with law enforcement officials across jurisdictions would illuminate this question.4.9.5 Consumer behavior and e-commerceHow do regulatory gaps (absent ODR, unclear platform liability, restrictive e-signatures) affect consumer confidence in cross-border e-commerce originating from Saudi Arabia? Behavioral economics research could quantify costs of regulatory uncertainty on digital market participation and identify which gaps impose greatest consumer deterrence.4.9.6 AI governance and data protectionHow are organizations currently handling AI-driven automated decision-making in Saudi Arabia absent explicit PDPL standards? What governance frameworks are organizations adopting informally? Ethnographic research in technology companies would reveal emergent governance practices and potential risks from unregulated algorithmic decision-making.4.9.7 GCC harmonization mechanismsWhat institutional mechanisms would facilitate effective GCC-wide harmonization of cybercrime and data protection law? Why has the Riyad Document adoption been uneven across member states? Political economy research into GCC regulatory cooperation would illuminate these questions and identify prerequisites for successful regional integration.These research directions would extend and deepen the statutory analysis presented here, moving toward a more comprehensive understanding of Saudi Arabia’s cybercrime governance in practice not merely in statutory design and revealing how formal legal requirements translate into actual organizational behavior and enforcement outcomes.5 ConclusionThis study presented a comparative doctrinal analysis of Saudi Arabia’s legal framework governing cybercrime and digital regulation through four principal legislative instruments: the Anti-Cyber Crime Law (ACCL), the Electronic Transactions System (EOTS), the E-Commerce System (ECS), and the Personal Data Protection Law (PDPL).The analysis leads to four principal findings.First, Saudi Arabia has established a comprehensive legislative foundation for cybercrime, electronic transactions, e-commerce, and personal data protection. The principal challenges arise not from the absence of substantive legislation but from institutional coordination, procedural development, and adaptation to rapidly evolving digital technologies.Second, comparative analysis demonstrates that Saudi legislation has progressively converged with international regulatory developments while preserving legal solutions that reflect national priorities, including data sovereignty, public policy considerations, and the objectives of Vision 2030. Divergence from international models should therefore be understood as a matter of regulatory choice rather than regulatory deficiency.Third, the effectiveness of cybercrime regulation depends not only on legislative design but also on institutional capacity, procedural clarity, and implementation readiness. The empirical compliance literature reviewed in this study indicates that organizational readiness and technical capability remain decisive factors influencing the practical implementation of recent legislation, particularly the Personal Data Protection Law.Fourth, this study contributes to the literature by providing an integrated comparative analysis of Saudi Arabia’s four principal cyber-related legislative instruments, developing a structured analytical framework for assessing legislative coherence and implementation, and applying a socio-legal perspective to explain how legal design influences institutional coordination, organizational compliance, and public trust.These findings have three principal policy implications.Future legislative reform should prioritize procedural modernization and institutional coordination rather than extensive substantive legislative revision.Regulatory adaptation should focus on emerging technologies, digital evidence procedures, cross-border cooperation, and periodic legislative review while maintaining consistency with Saudi legal principles and Vision 2030.Future research should complement doctrinal legal analysis with empirical socio-legal studies examining institutional performance, organizational compliance, public trust, and regulatory implementation.Overall, Saudi Arabia’s cybercrime framework represents an evolving regulatory system with strong legislative foundations and significant potential for continued institutional development as digital governance continues to mature. Statements Data availability statementThe original contributions presented in the study are included in the article/supplementary material, further inquiries can be directed to the corresponding author.Author contributionsFA: Conceptualization, Formal analysis, Investigation, Methodology, Writing – original draft, Writing – review & editing.FundingThe author(s) declared that financial support was not received for this work and/or its publication.Conflict of interestThe author(s) declared that this work was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.Generative AI statementThe author(s) declared that Generative AI was used in the creation of this manuscript. In accordance with the guidelines on transparency regarding generative artificial intelligence (GenAI) in research, the author discloses the following uses of GenAI in this study: Elicit (AI-assisted literature retrieval) and Claude 3.5 Sonnet (Anthropic) were used for literature identification and comparative framework development. All substantive analytical conclusions, gap identification, synthesis of comparative findings, and reform recommendations represent original scholarly analysis. GenAI use was instrumental, not substitutive, assisting in literature retrieval and comparative table organization but not determining analytical conclusions or recommendations.Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.Publisher’s noteAll claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.GlossaryACCLAnti-Cyber Crime Law (Saudi Arabia, 2007a)EOTSElectronic Transactions System (Saudi Arabia, 2007b)ECSE-Commerce System (Saudi Arabia, 2019)PDPLPersonal Data Protection Law (Saudi Arabia, 2021)SDAIASaudi Data and Artificial Intelligence AuthorityNDMONational Data Management OfficeNCANational Cybersecurity AuthorityGDPRGeneral Data Protection Regulation (European Union)eIDASRegulation on Electronic Identification and Trust ServicesEUEuropean UnionNISTNational Institute of Standards and TechnologyISOInternational Organization for StandardizationODROnline Dispute ResolutionMLATMutual Legal Assistance TreatyGCCGulf Cooperation CouncilUNCITRALUnited Nations Commission on International Trade LawSARSaudi Riyal (currency)B2CBusiness-to-ConsumerDPAData Protection AuthorityAIArtificial IntelligenceGenAIGenerative Artificial IntelligenceCRediTContributor Roles TaxonomyCronbach’s αCronbach’s Alpha (statistical reliability coefficient)LikertLikert Scale (survey measurement scale)VLOPVery Large Online PlatformDSADigital Services Act (European Union)ReferencesAlkhedhairyM. A. (2025). Balancing privacy and risk: A critical analysis of personal data use as governed by Saudi insurance law. Laws, 14, 47. doi: 10.3390/laws14040047AlaeaidT. A.AlfadhelM.AbdelsalamM. M. (2026). Implementing the personal data protection law in Saudi government institutions under AI adoption: a case study of the civil affairs sector. J. Inf. Policy16. doi: 10.5325/jinfopoli.16.2026.0004AlajajiA. (2016). An Evaluation of E-Commerce Legislation in GCC States: Lessons and Principles from International Best Practices (EU, UK, UNCITRAL). United Kingdom: Lancaster University Lancaster.AlashwaliE.AlhuzaliA. (2026). Evaluating PDPL compliance in e-commerce websites: insights and lessons learned from human and LLM analyses. arXiv:2602.18616. doi: 10.48550/arXiv.2602.18616AlazabM.ChonS. (2015). Cyber security in the Gulf cooperation council. SSRN Electron. J.1–3. doi: 10.2139/ssrn.2594624AlhamedS. M.AbdelraheemH. S.Al-ZokrodA. S. (2025). Digital evidence and its applications in commercial records: a comparative study under the Saudi evidence law. J. Cult. Anal. Soc. Change10, 2123–2129. doi: 10.64753/jcasc.v10i3.2717AlhazmiA.DaghistaniA. (2025). Privacy practices of popular websites in Saudi Arabia. J. Umm Al-Qura Univ. Eng. Archit.16, 19–29. doi: 10.1007/s43995-024-00085-xAlhejailiM. O. M. (2024). Securing the kingdom’s e-commerce frontier: evaluation of Saudi Arabia’s cybersecurity legal frameworks. J. Gov. Regul.13, 275–286. doi: 10.22495/jgrv13i2siart4AlmalkiA. (2021). Legal protection for the consumer in e-commerce according to Saudi law (a descriptive, analytical, and comparative study with the laws of the United States of America). Beijing Law Rev.12, 1131–1147. doi: 10.4236/blr.2021.124058AlmansooriS. (2018). Conflict of Laws in E-Commerce in the UAE and the Prospect for Harmonization Among Gulf Cooperation Council Member States. Colchester, United Kingdom: University of Essex.AlmerdasS. (2014). The criminalisation of identity theft under the Saudi anti-cybercrime law 2007. J. Int. Commer. Law Technol.9, 80–93.AlnasserH. (2025). Negligence and data protection in Saudi Arabia: a comparative doctrinal analysis of the GDPR, CCPA, and PDPL with a sharia-based legal framework. J. Cult. Anal. Soc. Change10, 3599–3607. doi: 10.64753/jcasc.v10i2.2146AloufiA.KhanM. A.HussainB. (2025). Legal gaps, Islamic ethics, and digital trust: building a regulatory framework for Saudi e-commerce under vision 2030. J. Cult. Anal. Soc. Change, 10, 3860–3880. doi: 10.64753/jcasc.v10i4.3678AlshammariT. S.SinghH. P. (2018). Preparedness of Saudi Arabia to defend against cyber crimes: an assessment with reference to Anti-Cyber Crime Law and GCI index. Arch. Bus. Res.6, 131–146. doi: 10.14738/abr.612.5771AltayarM. S. (2017) A comparative study of anti-cybercrime Laws in the Gulf cooperation council countries2017 2nd International Conference on Anti-Cyber Crimes (ICACC), 26–27 March 2017, AbhaIEEE.Commonwealth of Australia. (1995). Criminal Code Act 1995.No. 12, 1995. Federal Register of Legislation, Australian Government. Available online at. https://www.legislation.gov.au/C2004A04868/2018-12-29/textCouncil of Europe. (2001). Convention on Cybercrime.European Treaty Series No. 185 (ETS No. 185), Budapest, November 23, 2001.Council of Europe. Available at:https://rm.coe.int/1680081561Crime of Harassment System (2018). Anti-Harassment Law. Royal Decree No. M/96, May 31, 2018, as amended by Royal Decree No. M/48, January 14, 2021. Bureau of Experts at the Council of Ministers, Official Translation Department. Available at:https://laws.boe.gov.sa/Files/Download/?attId=20d22961-edd8-48e4-8ad3-adbb010dcadbEuropean Parliament and Council of the European Union. (2022). Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act). Official Journal of the European Union, L277, 1–102. Available at:https://eur-lex.europa.eu/eli/reg/2022/2065/ojKhammassiS.AlShanqityiY. (2025). Digital rights, AI, and the law: international perspectives on Saudi Arabia’s legal framework and international experience. Access Just. Eastern Eur.8, 146–177. doi: 10.33327/AJEE-18-8.S-a000154KinsaraO. (2022). Revising the Saudi electronic transactions law on e-signatures. Digit. Evid. Electron. Signat. Law Rev.19, 1–11. doi: 10.14296/deeslr.v19i0.5391MoafaF. A.AlmarriH. S. (2026). The Saudi legal approach to cybercrime: a comparative analysis of cyber law evolution, national security implications, and digital governance in Saudi Arabia and Australia. Int. J. Adv. Signal Image Sci.12, 340–352. doi: 10.29284/ijasis.12.1s.2026.340-352Saudi Arabia. (2007a). Anti-Cyber Crime Law. Issued by Royal Decree No. M/17 dated 8 RabiʿI 1428 AH (27 March 2007). Bureau of Experts at the Council of Ministers. Available at:https://laws.boe.gov.sa/BoeLaws/Laws/LawDetails/25df73d6-0f49-4dc5-b010-a9a700f2ec1d/2Saudi Arabia. (2007b). Electronic Transactions Law. Issued by Royal Decree No. M/18 dated 8 Rabiʿ I 1428 AH (27 March 2007). Bureau of Experts at the Council of Ministers. Available at:https://laws.boe.gov.sa/BoeLaws/Laws/LawDetails/6f509360-2c39-4358-ae2a-a9a700f2ed16/2Saudi Arabia. (2019). E-Commerce Law. Royal Decree No. M/126, July 10, 2019. Bureau of Experts at the Council of Ministers, Official Translation Department. Available at:https://laws.boe.gov.sa/Files/Download/?attId=be4eef55-50be-44e3-b94d-adbb011b5736Saudi Arabia. (2021). Personal Data Protection Law. Royal Decree No. M/19, September 16, 2021, as amended by Royal Decree No. M/148, March 27, 2023. Saudi Data and AI Authority (SDAIA). Available at:https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdfScottW. R. (2014). Institutions and Organizations: Ideas, Interests, and Identities. 4th Edn Thousand Oaks, CA: Sage.SinghH. P.AlshammariT. S. (2020). An institutional theory perspective on developing a cyber security legal framework: a case of Saudi Arabia. Beijing Law Rev.11, 637–650. doi: 10.4236/blr.2020.113039SuchmanM. C. (1995). Managing legitimacy: strategic and institutional approaches. Acad. Manag. Rev.20, 571–610. doi: 10.2307/258788SulimanH. O. H. (2025). Evaluating the effectiveness of Saudi Arabia’s PDPL in the global digital economy. J. Data Prot. Priv.8, 97–111. doi: 10.69554/ELUX6976TsyplakovaA. D.ShestakV. A. (2024). Classification of cybercrimes in GCC countries. Law State Telecommun. Rev.16, 66–79. doi: 10.26512/lstr.v16i1.48885UK Fraud Act. (1995). (2006). UK Public General Acts, 2006, c. 35. Available at:, https://www.legislation.gov.uk/ukpga/2006/35/contentsUNCITRAL (United Nations Commission on International Trade Law). (1996). UNCITRAL Model Law on Electronic Commerce with Guide to Enactment 1996, with additional article 5 bis as adopted in 1998. New York:United Nations, 1999. Sales No. E.99.V.4. ISBN 92-1-133607-4. Available at:https://uncitral.un.org/sites/default/files/media-documents/uncitral/en/19-04970_ebook.pdfUN Human Rights Committee. (2011). General Comment No. 34 on Article 19: Freedoms of Opinion and Expression. CCPR/C/GC/34, July 29, 2011. Office of the United Nations High Commissioner for Human Rights (OHCHR). Available at:https://www.ohchr.org/en/documents/general-comments-and-recommendations/general-comment-no34-article-19-freedoms-opinion-andValiakhmetovaG. N.TsukanovL. (2025). Legal and regulatory framework for cybersecurity in Arab gulf monarchies: stages and features of development. Nauchn. Dialog14, 421–441. doi: 10.24224/2227-1295-2025-14-8-421-441YeungK.BygraveL. A. (2022). Demystifying the modernized European data protection regime: cross-disciplinary insights from legal and regulatory governance scholarship. Regul. Gov.16, 137–155. doi: 10.1111/rego.12401Keywordscybercrime law, digital governance, e-commerce, eIDAS Regulation, GDPR, PDPL, personal data protection, Saudi ArabiaCitationAtallah FA (2026) Legal and regulatory responses to cybercrime in Saudi Arabia: a comparative evaluation. Front. Polit. Sci. 8:1923320. doi: 10.3389/fpos.2026.1923320Accepted18 September 2026UpdatesCheck for updates Copyright © 2026 Atallah. This is an open-access article distributed under the terms of the Creative Commons Attribution License (CC BY). The use, distribution or reproduction in other forums is permitted, provided the original author(s) and the copyright owner(s) are credited and that the original publication in this journal is cited, in accordance with accepted academic practice. No use, distribution or reproduction is permitted which does not comply with these terms.*Correspondence: Fouad Ahmed Atallah, fatallah@ju.edu.saDisclaimer All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article or claim that may be made by its manufacturer is not guaranteed or endorsed by the publisher.

Click Here For The Original Source.

——————————————————–

............