Saudi Anti-Cybercrime Law explained: the main offences such as online defamation, blackmail and fraud, the maximum penalty for each, and your rights.
Short answer: Saudi Arabia's Anti-Cybercrime Law (1428H) criminalises acts committed through computers and networks, such as interception, blackmail, online defamation, fraud and unauthorised access. Each group of offences has a maximum prison term and fine, from one year and SAR 500,000 up to ten years and SAR 5 million, and the court may impose either or both.
As more of daily life moves onto phones and social media, many people ask whether something they did, or something done to them, is a crime. The answer is in the Anti-Cybercrime Law, issued by Royal Decree No. M/17 dated 8/3/1428H. It has only sixteen articles, but it applies widely.
This guide sets out the offences and penalties as written in the law, explains the rules that raise or reduce a penalty, and covers what to know as a victim or as someone accused. If you already have a case, see our criminal defence and cybercrime services.
What is a cybercrime under the law?
Article 1 defines a cybercrime as any act involving the use of a computer or information network in breach of the law. "Computer" is defined broadly as any fixed or portable, wired or wireless electronic device that processes, stores or sends data, so a smartphone or tablet counts. "Unauthorised access" means intentionally entering a computer, website, system or network without permission.
Which offences and penalties does the law set?
The law groups offences into five tiers. Each article says "or either of these two penalties", so the court may impose prison, a fine, or both, up to the ceiling.
Article 3: up to 1 year and SAR 500,000
Intercepting data sent over a network or device without legal justification.
Unauthorised access to threaten or blackmail someone into doing or not doing something, even if lawful.
Unauthorised access to a website to alter, damage or take over it.
Invading privacy by misusing camera phones or similar devices.
Defaming others and causing them harm through information technology.
Article 4: up to 3 years and SAR 2 million
Obtaining movable property, a bond or a signature through fraud, a false name or impersonation.
Accessing banking, credit or securities-ownership data without legal justification.
Article 5: up to 4 years and SAR 3 million
Unauthorised access to delete, destroy, leak, alter or republish private data.
Stopping or disrupting a network or wiping its programs or data.
Blocking, jamming or disrupting access to a service.
Article 6: up to 5 years and SAR 3 million
Producing, preparing, sending or storing material that harms public order, religious values, public morals or privacy.
Creating or publishing sites for human trafficking, pornography and gambling, or drug trafficking.
An amendment by Royal Decree No. M/54 dated 22/7/1436H allows the judgment to order publication of a summary at the convicted person's expense once it is final.
Article 7: up to 10 years and SAR 5 million
When are penalties increased?
Under Article 8, the prison term or fine cannot be less than half the maximum where the offence is committed through an organised gang, by a public official in connection with their job or by abusing their authority, by exploiting minors, or by someone with previous convictions for similar crimes.
Illustrative example: for Article 3 defamation (ceiling 1 year and SAR 500,000), an aggravating factor means any sentence cannot fall below six months or SAR 250,000. This explains the rule only; it is not a prediction for any case.
Accomplices, attempts and exemption
Article 9: anyone who incites, helps or agrees faces up to the full maximum if the crime occurs, or up to half if it does not.
Article 10: an attempt is punishable by up to half the maximum.
Article 11: the court may exempt an offender who reports the crime before it is discovered and before harm occurs, or afterwards if the report leads to the arrest of the others or seizure of the tools.
Article 13: devices, software and proceeds may be confiscated, and a website closed if its owner knew of the crime, without prejudice to good-faith parties.
What should you do if you are blackmailed or defamed online?
Do not respond to the blackmailer and do not delete the messages.
Document everything: screenshots showing the account name, date and link, and keep the links.
Report through official security channels. The Law of Criminal Procedure requires criminal investigation officers to accept reports and complaints for all crimes (Article 27).
Your complaint counts as a private-right claim unless you expressly waive it (Article 29 of the Law of Criminal Procedure).
The Public Prosecution investigates and prosecutes these crimes, with technical support from the communications and IT regulator (Articles 14 and 15).
What are your rights if you are accused?
An accusation is not a conviction. No criminal penalty may be imposed until guilt is proven after a trial (Article 3, Law of Criminal Procedure). Every accused person may appoint a lawyer during investigation and trial (Article 4), and a detained person must be told the reasons and may contact someone (Article 36). Attend on time, ask to be informed of the charge, and get legal advice from the investigation stage.
Related reading: fraud in Saudi Arabia and defamation (qadhf) and its penalty.
Frequently asked questions
Defaming others and harming them through IT is listed in Article 3, with a maximum of one year and SAR 500,000, or either. How a specific case is classified is for the prosecution and the court.
Is filming someone without permission covered?
Invading privacy by misusing camera phones is an Article 3 offence. Producing or sending material that violates privacy over a network falls under Article 6.
Are the penalties fixed?
No. They are ceilings. The court sets the penalty within them, subject to the Article 8 aggravation rules.
Who investigates cybercrimes?
The Public Prosecution, supported technically by the communications and IT regulator.
Can an offender be exempted?
Yes, under Article 11, if they report before discovery and harm, or later if the report leads to arresting the others or seizing the tools.
Need your position reviewed?
Whether you are a victim or facing an accusation, early review of the facts and documents helps you take the right steps. Kawkaba Law is based in Jeddah and serves clients across Saudi Arabia in person and remotely, and treats your information confidentially.
Request a case assessment
This article is general information about the law and is not legal advice for any specific case. Outcomes depend on the facts, the evidence and the assessment of the prosecution and the court.
