E-Commerce Law: Compliance for Digital Stores

The Saudi E-Commerce Law issued under Royal Decree No. M/126 of 1440H regulates buying and selling through electronic means and protects consumers. Online stores — whether platforms or individual sellers — must comply clearly.

Registration and licensing: conducting e-commerce requires a valid commercial registration from the Ministry of Commerce. E-commerce platforms may require additional licensing depending on the nature of the service. Individual sellers conducting business through platforms such as Namshi or Jarir are subject to registration requirements.

Mandatory seller information includes: trade name, address, contact number, email, and commercial registration when applicable. This information must be displayed clearly on the website or app. Concealing seller identity or displaying misleading information constitutes a violation.

Consumer protection: the law grants consumers the right to complete product information before purchase — description, price, payment method, shipping costs, and expected delivery time. The right to return within a specified period is guaranteed — many platforms adopt longer periods as commercial policy.

The E-Commerce Law requires online stores to provide clear information about the seller, product, and return policy — absence exposes to penalties and destroys consumer trust.

Return and refund policies must be published and clear. Specifying return period, refund conditions, and procedures builds trust and reduces disputes. The law prohibits exemption clauses that negate fundamental consumer rights.

Cross-border selling: foreign sellers targeting the Saudi market may be subject to the law. Localizing transactions — such as accepting payment in SAR or delivery within the Kingdom — strengthens application of Saudi law. International platforms typically rely on terms of use compatible with local laws.

Electronic payment: payment processing falls under SAMA oversight and PCI DSS requirements when handling card data. Encryption and payment data protection are required. Relying on approved payment gateways reduces regulatory risk.

Privacy and disclosure: collecting consumer data (name, email, address, phone) is subject to PDPL. A clear privacy policy, proper consent management, and access to rights of access, rectification, and deletion are required. E-commerce intersects with data protection at every touchpoint.

Penalties for violations include fines and activity suspension. Major platforms impose additional requirements on sellers — compliance with both the law and platform rules ensures continuity.