Cybersecurity law & regulation in Saudi Arabia (2026)

Legal framework

National Cybersecurity Authority (NCA), the supreme national cyber authority (established by Royal Order in 2017) issuing binding controls including the Essential Cybersecurity Controls (ECC); complemented by the Anti-Cyber Crime Law (Royal Decree M/17, 2007) and sectoral/data-protection regimes (SAMA, SDAIA/PDPL).

Key points: cybersecurity in Saudi Arabia

1. 01Central national authority (NCA)

   The National Cybersecurity Authority was established by Royal Order No. 6801 (31 Oct 2017, amended by Royal Order No. 7053 of 2021) as the kingdom's supreme cybersecurity reference, empowered to set national strategy and issue binding cybersecurity frameworks and controls.

   loc.gov nca.gov.sa

2. 02Essential Cybersecurity Controls (ECC)

   The NCA's Essential Cybersecurity Controls (originally ECC-1:2018, updated to ECC-2:2024) set mandatory minimum requirements across domains such as governance, defense, resilience, third-party/cloud, and industrial control systems. They apply to government bodies and to entities owning/operating Critical National Infrastructure.

   nca.gov.sa nca.gov.sa

3. 03Private-sector controls (NCNICC-1:2025)

   The NCA issued new Cybersecurity Controls for Private Sector Entities Not Considered Critical Infrastructure (NCNICC-1:2025), extending mandatory baseline cybersecurity requirements to private organisations across the kingdom that fall outside CNI scope.

   cms.law nca.gov.sa

4. 04Anti-Cyber Crime Law (criminal offences)

   The Anti-Cyber Crime Law, enacted by Royal Decree No. M/17 (2007), criminalizes unauthorized access, interception, data interference, and related offences, providing the penal backbone alongside the NCA's preventive/regulatory frameworks.

   sherloc.unodc.org dig.watch

5. 05Financial-sector framework (SAMA)

   The Saudi Central Bank (SAMA) Cyber Security Framework (launched 2017, based on NIST/ISO/PCI/ISF/BASEL) is mandatory for SAMA-regulated banks, insurers, finance companies, payment service providers and fintechs, covering risk management, security operations, incident response and governance.

   rulebook.sama.gov.sa sama.gov.sa

6. 06Breach notification & incident reporting

   Under the Personal Data Protection Law (PDPL), controllers must notify the data-protection regulator SDAIA of a personal-data breach within 72 hours of becoming aware (where harm or rights infringement may result) and inform affected individuals without delay; reporting runs through the National Data Governance Platform. NCA frameworks separately require incident-response procedures and reporting of cyber incidents.

   sdaia.gov.sa resourcehub.bakermckenzie.com

Timeline of decisions

1. 1 Jan 2026Law · official
   NCNICC-1:2025, Mandatory Cybersecurity Controls Extended to All Private-Sector Entities

   NCA published the Non-Critical National Information and Communications Infrastructure Cybersecurity Controls (NCNICC-1:2025), imposing mandatory minimum controls, covering governance, access management, incident response, and third-party security, on every private-sector organisation in Saudi Arabia regardless of critical infrastructure status, closing the gap that previously limited mandatory NCA rules to CNI operators.

   NCA

2. 1 Dec 2024Law · official
   NCA Cybersecurity Enforcement Regulations 2024 Issued

   The National Cybersecurity Authority published comprehensive enforcement regulations closing gaps in its regulatory powers. Non-compliance now carries fines up to SAR 25 million (~USD 6.7 million), plus licence suspension; NCA-appointed inspectors can enter sites, seize equipment, and copy evidence.

   National Cybersecurity Authority (NCA)

3. 1 Oct 2024Law · official
   ECC-2:2024, Revised Essential Cybersecurity Controls with Mandatory Saudization of Cybersecurity Roles

   NCA issued ECC-2:2024 replacing the 2018 version, streamlining controls from 114 to 108 across four domains, aligning with NIST CSF and ISO/IEC 27001, and introducing a Saudization mandate requiring all cybersecurity positions (not just senior roles) to be filled by qualified Saudi nationals.

   NCA

4. 1 Jan 2022Law · official
   OTCC-1:2022, Operational Technology Cybersecurity Controls Published

   NCA published the Operational Technology Cybersecurity Controls (OTCC-1:2022), establishing minimum security requirements for Industrial Control Systems (ICS) and OT environments in energy, utilities, and other CNI sectors, directly addressing attack vectors exposed by the Shamoon incidents.

   NCA

5. 1 Jan 2020Law · official
   Cloud Cybersecurity Controls (CCC-1:2020), Mandatory Cloud Security Framework

   NCA published the Cloud Cybersecurity Controls setting mandatory security requirements for cloud service providers and cloud tenants operating in Saudi Arabia, including data residency obligations and shared-responsibility security standards, later updated as CCC-2:2024.

   NCA

6. 1 Jan 2018Law · official
   Essential Cybersecurity Controls (ECC-1:2018), Saudi Arabia's First Unified National Baseline

   NCA issued the first Essential Cybersecurity Controls, 114 mandatory controls across five domains (governance, risk management, operations, resilience, third parties) applicable to all government entities and CNI operators, establishing Saudi Arabia's first binding national cybersecurity framework.

   NCA

7. 31 Oct 2017Decision · official
   National Cybersecurity Authority (NCA) Established by Royal Decree

   The NCA was created as the Kingdom's supreme cybersecurity authority, reporting directly to the Royal Court. It is responsible for issuing mandatory controls (Essential Cybersecurity Controls, Critical Systems Controls, Cloud Controls), developing the national cybersecurity strategy, and coordinating national incident response across all government and critical sectors.

   National Cybersecurity Authority (NCA)

8. 31 Oct 2017Decision · official
   National Cybersecurity Authority (NCA) Established by Royal Order

   Royal Order No. 6801 formally constituted the NCA reporting directly to the King, consolidating previously fragmented cybersecurity functions from the Ministry of Interior and MCIT under a single supreme cybersecurity regulator, the institutional cornerstone of Saudi Arabia's current cybersecurity framework.

   NCA

9. 1 May 2017Law · official
   SAMA Cybersecurity Framework v1.0, Mandatory Controls for the Financial Sector

   Saudi Arabian Monetary Authority issued its mandatory Cyber Security Framework requiring all banks, insurers, and finance companies to establish a Saudi-national CISO, cybersecurity governance committees, and controls spanning risk management, access control, and incident response, with full compliance required by end of 2018.

   SAMA

10. 1 Nov 2016Incident
    Shamoon 2.0, Destructive Wiper Attacks Resume Against Saudi Government and Industry

    A retooled Shamoon variant struck multiple Saudi government agencies and organisations from November 2016 through early 2017, demonstrating the persistent state-sponsored threat and directly accelerating the establishment of the NCA (October 2017) and the subsequent wave of mandatory sector controls.

    Wikipedia / Symantec

11. 15 Aug 2012Incident
    Shamoon Wiper Destroys ~35,000 Saudi Aramco Workstations

    The Shamoon malware (attributed to state-sponsored Iranian actors) destroyed approximately 35,000 Aramco workstations in hours, threatening 10% of global oil supply, the most consequential cyber incident in Saudi history and the primary catalyst for subsequent national cybersecurity legislation and institution-building.

    CNN

12. 26 Mar 2007Law · official
    Anti-Cyber Crime Law (Royal Decree No. M/17), Foundational Criminal Statute

    Saudi Arabia enacted its first national cybersecurity law, criminalising unauthorised computer access, data theft, malware distribution, and online fraud, with penalties up to SAR 5 million and 4 years imprisonment for serious offences, the principal criminal statute still underpinning cybersecurity enforcement today.

    WIPO Lex / MCIT

Sources

1. 1.nca.gov.sa/en/regulatory-documents/controls-list/ecc/
2. 2.nca.gov.sa/ecc-en.pdf
3. 3.nca.gov.sa/en/regulatory-documents/
4. 4.loc.gov/item/global-legal-monitor/2024-02-04/saudi-arabia-national-cybersecur
5. 5.cms.law/en/omn/legal-updates/kingdom-of-saudi-arabia-issues-new-cybersecurity
6. 6.sherloc.unodc.org/cld/en/legislation/sau/anti_cyber_crime_law/article_6/article_6.html
7. 7.dig.watch/resource/anti-cyber-crime-law-saudi-arabia
8. 8.rulebook.sama.gov.sa/en/cyber-security-framework-3
9. 9.sama.gov.sa/en-US/RulesInstructions/CyberSecurity/Cyber%20Security%20Framework.pd
10. 10.sdaia.gov.sa/en/SDAIA/about/Documents/PersonalDataBreachIncidents.pdf
11. 11.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/saudi-arabia/topics/