E - Commerce Law

The English translation is prepared for convenience. For all purposes, the Arabic language version of these Laws and Regulations shall be the original, governing instrument. In the event of any conflict between the Arabic version of these Laws and Regulations and any subsequent translation into any other language, the Arabic language version shall govern and control.

Law

Number of parts:0 |Number of chapters:0 |Number of extensions:0 |Number of articles: 26

Article One

In this Law, the following terms shall have the meanings assigned thereto, unless the context requires otherwise:
Law: E-Commerce Law.
Regulations: Implementing Regulations of the Law.
Ministry: Ministry of Commerce.
Minister: Minister of Commerce.
E-Commerce: An activity of economic nature undertaken, in whole or in part, by a service provider and a consumer through electronic means to sell products, provide services, advertise the same, or exchange data related thereto.
Data: Information of any source or form used, directly or indirectly, in an e-commerce transaction.
Person: A natural or legal person.
Merchant: A person registered in the Commercial Register who practices e-commerce.
Practitioner: A person who practices e-commerce but not registered in the Commercial Register.
Service Provider: A merchant or practitioner.
Consumer: A person who engages in e-commerce to obtain products or services provided by a service provider.
Contract: An agreement concluded electronically between parties conducting e-commerce transactions.
E-Shop: An electronic platform through which a service provider displays or sells a product, provides a service, advertises the same, or exchanges data related thereto.
E-Shop Authentication Entity: An entity licensed by the Ministry to authenticate electronic shops.
Electronic Communication: A statement, declaration, notification, request, or offer made by contracting parties via electronic means while negotiating or executing a contract.
Electronic Advertisement: Any advertisement carried out by a service provider via electronic means to directly or indirectly promote the sale of a product or the provision of a service.
Electronic Means: Any information and communications technology (ICT) medium, whether electrical, electromagnetic, visual, optical, digital, or any other form of similar technology.

Article Two

The provisions of this Law shall apply to:
a) service providers in the Kingdom;
b) practitioners outside the Kingdom who offer products or services to consumers in the Kingdom in a manner that enables them to have access thereto; and
c) consumers.

Article Three

1. For the purposes of applying the provisions of this Law, the business address of a service provider shall refer to the following:
a) For a merchant: his business address as specified in the Commercial Register.
b) For a practitioner: his business address as specified in his e-shop, unless otherwise indicated.
2. If a service provider has more than one place of business, none of which has been selected as a business address, his business address shall be the one most closely connected to the contract, taking into consideration the circumstances the parties were aware of or anticipated prior to or at the time of concluding the contract.
3. If a practitioner is a natural person and does not have a place of business, his business address shall be his permanent address. The Regulations shall determine the necessary terms and conditions.
4. A place of business shall not be deemed a business address merely because it houses equipment and technology supporting an information system used by the service provider to conclude the contract, or because it is where such information system may be accessed by other parties.
5. A service provider’s use of a domain or e-mail address connected to a specific country shall not create a presumption that his business address is located in that country.

Article Four

If a consumer makes an error in an electronic communication made through an ICT medium that cannot be rectified, he may notify the service provider of such error as soon as he becomes aware of it within the time limit prescribed by the Regulations. Such notification shall be deemed rectification of the error, unless the consumer has used or benefited from the service provider's product or service.

Article Five

1. Without prejudice to the provisions of other laws, a service provider shall not retain a consumer's personal data or electronic communications, except for the period required by the nature of the electronic transaction, unless a different period is agreed upon. Necessary measures shall be taken to protect and maintain the confidentiality of such data during the retention period. The service provider shall be responsible for protecting the consumer's electronic communications or personal data in his possession or in the possession of the entities or agents thereof he deals with. The Regulations shall specify personal data deemed confidential.
2. A service provider shall not use a consumer's personal data or electronic communications for unauthorized or impermissible purposes, nor disclose the same to other entities, whether at no cost or for a consideration, unless the consumer consents to such disclosure or is required by law.

Article Six

A service provider shall disclose the following in his e-shop:
a) his name or any identifying characteristic, and his address, unless he is registered with an e-shop authentication entity;
b) his contact information;
c) name and number of his commercial registration, if any, or of any other publicly available register; and
d) any other data specified by the Regulations.

Article Seven

A service provider shall provide the consumer with a statement that includes the terms and conditions of the contract to be concluded, in addition to the following:
a) procedures to be taken to conclude the contract;
b) information related to the service provider;
c) basic characteristics of the products or services subject of the contract;
d) total price, including all charges and taxes, and delivery fees, if any;
e) arrangements relating to payment, processing, and delivery;
f) warranty information, if any; and
g) any other information specified by the Regulations.
The Regulations shall specify the rules governing the service provider’s provision of information according to the nature of each transaction.

Article Eight

Upon conclusion of a contract, the service provider shall provide the consumer with an itemized invoice stating the total price, including all charges and taxes, and delivery fees, if any, as well as the date and place of delivery, as specified by the Regulations.

Article Nine

A service provider practicing a regulated profession which requires a license or permit shall disclose the following:
a) The agency he is registered with, and the details of the license or permit issued thereby.
b) His professional title and the granting country.
c) Any other information specified by the Regulations.

Article Ten

1. An electronic advertisement shall be deemed an integral part of the contract, and shall be legally binding.
2. An electronic advertisement shall include:
a) name of the advertised product or service;
b) name of the service provider and any identifying characteristic, unless he is registered with an e-shop authentication entity;
c) contact information of the service provider; and
d) any other information specified by the Regulations.

Article 11

An electronic advertisement must not include:
a) a false offer, statement, or claim, or a misrepresentation that directly or indirectly deceives or misleads a consumer; or
b) a logo or trademark that is either counterfeit or the service provider does not hold the right to use.

Article 12

Without prejudice to the penalties stipulated in Article 18 of this Law, if a service provider is proved to have violated any of the provisions of Article 10(2) or Article 11, the Ministry may compel the service provider to rectify the violation or withdraw the advertisement within one day from the date of notification.

Article 13

1. Without prejudice to contractual and regulatory provisions of the warranty, a consumer may, in cases not provided for in paragraph (2) of this Article, rescind the contract within seven days following the date of receipt of the product or the date of the service contract, provided he has not used the product, received the service, or benefitted from either one. In such case, the consumer shall bear the cost of rescinding the contract unless agreed otherwise.
2. Notwithstanding paragraph (1) of this Article, a consumer may not rescind a contract in the following cases:
a) If the subject of the contract is a customized product or a product manufactured at the consumer’s request, except for defective products or products that do not meet agreed specifications.
b) If the subject of the contract is videotapes, records, compact discs, or computer software that have been used.
c) If the subject of the contract is the purchase of newspapers, magazines, books, or other publications.
d) If the defect is attributed to the consumer’s mishandling of the product.
e) If the subject of the contract is the provision of accommodation, transportation, or catering services.
f) If the subject of the contract is the purchase of an online downloadable software, except for faulty software that cannot be downloaded or does not conform to the agreed specifications.
g) Other cases specified by the Regulations according to the nature of the product or service.

Article 14

1. Unless a service provider and a consumer agree to extend the date for delivery of item(s) or execution of service(s) subject of the contract, the consumer shall be entitled to rescind the contract if the service provider delays delivery or execution for more than 15 days from the date of concluding the contract or the agreed date, and demand a refund of amounts paid under the contract and any other costs incurred due to such delay, unless the delay is due to force majeure.
2. Without prejudice to paragraph (1) of this Article, a service provider shall notify the consumer of any anticipated delay or of any circumstances that may affect the delivery of the items subject of the contract or the execution thereof.

Article 15

A merchant shall register his e-shop in the Commercial Register pursuant to the Law of Commercial Register. The Regulations shall specify the necessary requirements.

Article 16

The Ministry shall oversee the e-commerce sector and shall issue, as needed, the rules necessary to regulate the sector, including the following entities and platforms, for the purpose of enhancing e-commerce and ensuring the safety of its transactions, including the following:
a) E-shop authentication entities.
b) Electronic platforms acting as intermediaries between a service provider and a consumer.

Article 17

If a service provider violates any of the provisions of this Law or its Regulations, the Minister, or his designee, may, in urgent cases, issue a decision to partially or completely block his e-shop, in coordination with the competent authority, until the violation is rectified or decided upon, whichever is earlier, and refer the violation to the committee stipulated in Article 19(1) of this Law within a maximum period of three days from the date of blocking the e-shop, provided the committee issues its decision within a period not exceeding 10 days from the date of referral. The committee may, for justifiable reasons, suspend the decision of partial or complete blocking of the e-shop.

Article 18

Without prejudice to any harsher penalty provided for in other laws, a person who violates any of the provisions of this Law or its Regulations shall be subject to one or more of the following penalties:
a) A warning.
b) A fine not exceeding 1,000,000 riyals.
c) Temporary or permanent suspension of the e-commerce activity.
d) Blocking the e-shop, partially or completely, temporarily or permanently, in coordination with the competent authority.

Article 19

1. One or more committees shall be formed pursuant to a decision by the Minister to consider violations of the provisions of this Law or its Regulations and to impose the penalties stipulated in Article 18 of this Law, provided the committee is composed of not less than three members, including at least a legal advisor. Committee decisions shall be issued by majority vote. The Minister shall, pursuant to a decision issued thereby, determine the committee work procedures and remuneration of its members.
2. The penalty imposed shall be proportionate with the gravity and frequency of the violation, the damage it caused to others, and the size of activity of the service provider.

Article 20

Any person may appeal a decision issued against him pursuant to this Law before the Administrative Court in accordance with the Law of Procedures before the Board of Grievances.

Article 21

A decision imposing a penalty may include the publication of the verdict at the expense of the violator in one or more local newspapers published in the area where he resides, or through any other appropriate medium, depending on the type, gravity, and impact of the violation committed, provided the publication takes place after the decision becomes unappealable due to the lapse of the statutory period for appeal or the judgment rendered thereon becomes final.

Article 22

The competent court shall rule on disputes, including compensation claims arising from the implementation of this Law.

Article 23

Monitoring and inspecting e-commerce transactions and detecting any violations of this Law and its Regulations shall be carried out by employees appointed pursuant to a decision by the Minister.

Article 24

In cases where this Law is silent, e-commerce shall be subject to the provisions of the Electronic Transactions Law and other relevant laws.

Article 25

The Minister shall issue the Regulations within 90 days from the date of publication of this Law in the Official Gazette, and shall enter into force on the date this Law becomes effective.

Article 26

This Law shall enter into force 90 days following its publication in the Official Gazette.

Regulation

Number of parts:0 |Number of chapters:0 |Number of extensions:0 |Number of articles: 20

Article One

The terms and expressions mentioned in these Regulations shall have the meanings indicated to each of them in Article 1 of the Electronic Commerce Law, issued by Royal Decree No. (M / 126) dated 7/11/1440 AH.

Article Two

The activity of the Service Provider shall be of an economic nature if it is continually done for the generation of profit, and the provisions of the Law and the Regulations shall apply to this activity.

Article Three

1. The place of business of the Practitioner (natural person) is the place that is determined in the Electronic Shop, or in the authentication certificate issued by the E-Shops Authentication Entity.
2. If the Practitioner (natural person) within the Kingdom does not have a place of business, then his place of business shall be his place of residence, in accordance with the registered National Address.
3. The place of business in which the Practitioner is practicing shall be appropriate to the nature of the activity and the scope of work undertaken in the place of business, and the exercise of the activity therein shall not prejudice public tranquility.

Article Four

1. The Consumer may correct an error in Electronic Communications if the Consumer notifies the Service Provider of the error within (24) hours of the time the Electronic Communication is sent.
2. The Service Provider shall comply with the correction of the error notified in accordance with paragraph (1) of this Article, unless the Consumer has benefited from the Service Provider's product or service, or otherwise derived utility from them.
3. The Service Provider may correct unintended errors in Electronic Communications sent to the Consumer, provided that this ability to correct errors is stipulated in the contract with the Consumer, and provided that the Consumer is notified of the error as soon as the Service Provider becomes aware of it, and before the product is shipped or service is commenced. The consumer has the option in this case to either continue to implement the contract with the Service Provider after the correction of the Electronic Communication, or to terminate the contract and recover the cost incurred for the product or service, and other costs resulting from this error.

Article Five

1. Any Data - whatever its source or form – that leads to specific knowledge of the Consumer’s identity, including: names, identity information, addresses, contact numbers, license numbers, records and personal property, account and bank card numbers, and still and moving pictures, is considered protected Personal Consumer Data.
2. The Service Provider shall comply with the following:
a. Protection of Personal Consumer Data from access, disclosure, alteration or processing for non-legitimate purposes, by applying technical and administrative measures commensurate with the nature of such Data.
b. Personal Consumer Data shall not be retained except for the purpose of fulfilling the obligations of the Service Provider, and shall not be used for any other purpose, such as advertising or marketing, without the express prior consent of the Consumer.
c. If the Personal Consumer Data is breached, the Service Provider must notify the Ministry - according to the mechanism determined by the Ministry - and the Consumer, within (3) days from the date of the Service Provider’s knowledge of the breach, with an explanation of the scope of the breach and its effects, and the measures taken to address it. The notice shall not exempt the Service Provider from liability towards the Consumer, and the Service Provider must comply with what is issued by the competent authorities in this regard.
3. If the Consumer’s relationship with the Electronic Shop is continuous and requires the establishment of an account to facilitate future contracts, the Service Provider may, after obtaining the consent of the Consumer, retain Personal Consumer Data until the Consumer requests the closure of this account, and the Service Provider shall allow for the closure of the account in a clear and easy fashion.

Article Six

1. Subject to the provisions of Article 6 of the Law, the Service Provider shall disclose in the Electronic Shop the following Data:
a. The Electronic Shop’s Privacy Policy (if any), including measures to protect Personal Consumer Data, and the scope of dealing with user profiles.
b. Procedures and methods used to receive and resolve Consumer complaints.
c. The Service Provider’s tax number (if any).
2. The Service Provider shall provide access to the Data contained in Article 6 of the Law and paragraph (1) of this Article by providing a link to it in the Electronic Shop, with an explanation of any subsequent amendment to the Data.

Article Seven

1. Subject to the provisions of Article 7 of the Law, the Service Provider shall include the following in the statement given to the Consumer clarifying the terms ‎and conditions of the contract to be concluded :
a. Reference to the right to terminate the contract in accordance with paragraph (1) of Article 13 of the Law where termination is permissible, and the costs incurred by the Consumer in the exercise of this right, the steps the Consumer should take if he wishes to exercise the right to terminate the contract, or reference that the Consumer is not entitled to terminate the contract due to the applicability of paragraph (2) of Article 13 of the Law or Article 11 of the Regulations.
b. Details of the price to be paid, such as the original price, delivery costs, and taxes (if any) in addition to any other costs that may be incurred in the future, along with an indication of how they are calculated and their terms of entitlement.
c. After-sales services (if any) and conditions for the provision of these services.
d. The duration of the contract and its expiry date, if applicable.
e. Payment terms, recurring payments (if any), and shipping and delivery provisions if so required.
2. The Service Provider shall clarify to the Consumer the procedure for concluding the contract by stating in the field designated for payment that once this field has been clicked, the contract shall be concluded, and that the contract shall entail the obligation to pay, in a clear and easy fashion.

Article Eight

Subject to the provisions of Article 8 of the Law, the Service Provider shall submit to the Consumer after concluding the contract a downloadable receipt which includes the following Data:
a. The name of the Service Provider if the Service Provider is a Practitioner, or the trade name of the Service Provider if the Service Provider is a Trader, and a description of the product or service subject to the contract.
b. Confirmation of the contract and the date of its execution.
c. The total price of the product or service, and the value of taxes (if any) clarifying the details of the price, how it is calculated and the conditions of claiming it.
d. Shipping, transportation and delivery charges (if any).
e. The Service Provider’s tax number (if any).
f. The delivery date of the product or service.
g. The name of the carrier delivering the product, and delivery route tracking data (if any).
h. A summary of the replacement and refund provisions in cases where this is permissible (if applicable).
i. The method of payment, and confirmation of full payment if it has been made.

Article Nine

1. Subject to the provisions of Article 9 of the Law, a Service Provider practicing a profession subject to special regulation and requiring a license or permit to practice shall be obliged to disclose the license or permit number, its expiry date and the granting authority in the Electronic Shop.
2. The provisions of these Regulations are without prejudice to the provisions in force in the Kingdom in relation to the professional activity of the Service Provider.

Article Ten

1. Subject to the provisions of Article 10 of the Law, the Electronic Advertisement, when published or sent, shall include the following:
a. A clear statement that it is an advertisement.
b. Information related to the product or service that allows the Consumer to make an informed and conscious decision.
2. The Service Provider shall provide the Consumer with a means to request the cessation of the transmission of electronic advertisements, and the Service Provider shall cease sending electronic advertisements to the Consumer upon receipt of this request.
3. The Service Provider must comply with the provisions of the laws and regulations related to advertisements, and obtain the required licenses in accordance with the nature of the product or service.

Article 11

Subject to the provisions of paragraph (2) of Article 13 of the Law, the Consumer shall not be entitled to terminate the contract in the following cases, unless otherwise agreed:
a. If the subject of the contract is a product liable to deteriorate within the period of permissibility of the contract termination.
b. If the subject of the contract is a product that cannot be resold for health reasons.
c. If the subject of the contract is a product containing several elements that have been merged and cannot be returned to its original condition.
d. If the subject of the contract is a hotel reservation service, travel ticket, vehicle rental, transportation or event management service.
e. If the subject of the contract is a product designed and produced specifically for the Consumer according to the specifications of the Consumer’s request.
f. If the contract is concluded at a public auction.
g. If the subject of the contract is a product or service for which the price may be subject to change during the period in which the contract may be terminated, depending on a market characterized by continuous price volatility outside the control of the Service Provider, such as gold and silver.

Article 12

1. The Trader must register the main Electronic Shop in the commercial register within (30) days from the date of its establishment.
2. The application for registration on the Ministry's website shall include:
a. The name of the applicant.
b. The commercial registration number.
c. The activities to be carried out through the electronic shop.
d. A description of the main Electronic Shop and its address.
3. If the Practitioner wishes to register the Electronic Shop in the commercial register in order to become a Trader, the following information must be included in the application:
a. The Practitioner’s name and ID number.
b. The Practitioner’s residential address, phone number, and e-mail address.
c. The activities that will be practiced through the Electronic Shop.
d. A description of the main Electronic Shop in which the Practitioner operates, and its address.
4. The Trader shall notify the competent department of any change in the Data contained in the registration application, within (30) days of the change, by filling in the form prepared for that purpose on the Ministry’s website.
5. Without prejudice to the provisions of the Law of Commercial Register, the registration of the Electronic Shop in the Commercial Register shall be canceled if the Trader wishes to stop practicing the e-commerce activity.

Article 13

1. The Ministry shall establish a website for the authentication of Electronic Shops, to which the licensed authentication bodies shall be linked in accordance with Article 14 of the Regulations.
2. The Ministry shall supervise the work of the licensed authentication bodies linked to the Ministry's website to verify the extent of its compliance with the provisions of the Law and Regulations. The competent department shall respond to any violations of the provisions of the law and regulations that may occur from the Authentication Entities.

Article 14

1. In order for E-Shops Authentication Entities to be licensed, the applicant must be a company in accordance with the provisions of the Companies Law, and the license application shall be submitted in accordance with the form prepared for that purpose, in addition to the following:
a. Certificate of registration of the company in the commercial register.
b. Proof of the company's technical and administrative ability to provide the service.
c. Description of the services the company intends to provide.
d. Methodology for the authentication of Electronic Shops.
e. Technical and administrative measures and regulations applied for the purpose of data preservation and protection.
f. Data handling policy in case the service is discontinued for any reason.
g. Policy for handling and resolving complaints of Service Providers and Consumers.
h. Undertaking to provide the authenticated Electronic Shop’s Data immediately through the Ministry's website.
i. Details of the liaison officer responsible for supplying the Data.
j. Any additional information or documents requested by the Ministry.
2. After the Authentication Entity obtains the license, the Ministry shall allow it to be linked to the authentication site. The Ministry may exempt internationally accredited Authentication Entities from the provisions of paragraph (1) of this Article and allow them to be linked to the authentication site.

Article 15

1. The licensed E-Shop Authentication entity shall specify the Data necessary for authentication, provided that the following Data is provided:
a. The name, address and means of communication of the Service Provider, and an indication of whether it is a Trader or Practitioner, a Saudi or a non-Saudi.
b. The identity information of the Practitioner, or the Trader's Commercial Registration.
c. Names of the authorized signatories of the Service Provider if the Service Provider is a legal person, and names of those who manage it.
d. The platform through which the Service Provider conducts e-commerce activities.
e. Licenses issued by the competent authorities (if any).
2. The E-Shop Authentication Entity shall issue a statement of authentication to the applicant and publish it on its website

Article 16

Authenticated Service Providers shall:
1. Publish the statement of authentication clearly in the Service Provider’s Electronic Shop.
2. Notify the Authentication Entity of any change to the authenticated Data under Article 15 within (30) days from the date of the change.

Article 17

E-Shop Authentication Entities linked to the Ministry's website shall:
a. Implement institutional and administrative measures to store, preserve, protect and retrieve data, taking into account potential risks.
b. Provide qualified and trained staff to provide authentication services in accordance with the provisions of the Law and Regulations.
c. Publish the terms, conditions and procedures of providing the authentication service in the Electronic Shop.
d. Publish the Authentication Entity’s policy for handling complaints from applicants seeking authentication and Consumers on its Electronic Shop.
e. If the Authentication Entity’s Data is breached, the Authentication Entity must notify the Ministry - according to the mechanism determined by the Ministry - and the affected Electronic Shops within (3) days from the date of the Authentication Entity’s knowledge of the breach, clarifying the scope and effects of the breach and the measures taken to address it. The notice shall not exempt the Authentication Entity from its liability towards the beneficiaries of its services, and the Authentication Entity must comply with what is issued by the competent authorities in this regard.
f. Make data and records available to the Ministry upon request.
g. Comply with the provisions of the Laws and Regulations related to data protection issued by the competent authorities.

Article 18

1. An electronic platform that acts as an intermediary between the Service Provider and the Consumer is any website or application that provides services for the facilitation of e-commerce transactions, such as online advertisement services or the promotion of products or services, or enabling the acceptance of orders or payment, or any other service that facilitates the practice of e-commerce.
2. The intermediary platform shall:
a. Publish clearly in the platform the terms and conditions of using the platform, the rights and obligations of its users, the methods of storing personal data and restrictions to its use, the policy used for handling complaints from Service Providers and Consumers, and the policy of settling disputes between Service Providers and Consumers.
b. Publish any material modification to the services provided in its electronic shop and notify registered users at least (1) week before the implementation of the modification.
c. Disclose required platform Data in accordance with Article 6 of the Law and the Regulations.
d. Request the Service Provider’s Data on the platform, contact information, documentation of authentication (if any), and certificate of registration in the Commercial Register (if any), store this Data in a manner that ensures its preservation and protection in order for it to be accessed when needed, update the Data periodically, and submit the Data to the Ministry if requested.
e. Delete any content that violates the provisions of the Law, Regulations, and terms and conditions of using the platform.
f. Enhance the cyber security of the platform, adhere to what the competent authorities issue in this regard, and ensure rapid handling of any incident or breach of the platform to ensure its return to its usual functionality as soon as possible, without prejudice to the cyber security of the platform.
g. Notify the Ministry if the platform is breached - according to the mechanism determined by the Ministry - and those affected by this breach within (3) days from the date of the platform’s knowledge of the breach, clarifying the scope and effects of the breach, and the measures taken to remedy it. The notice shall not exempt the platform from liability to the beneficiaries of its services, and the platform must adhere to what is issued by the competent authorities in this regard.
h. Maintain adequate data on contracts concluded by the platform, and store them in a manner that ensures their safety, to be accessed when needed for a period not less than (3) years from the date of concluding the contract, subject to the provision of Article 5 of these Regulations, unless another law stipulates a longer duration.

Article 19

The application of the provisions of the Law and the Regulations shall not prejudice the competences prescribed for other authorities in regulation, monitoring and supervision in accordance with the relevant laws, regulations and decisions.

Article 20

These Regulations shall come into force from the date of their publication in the Official Gazette.

Attachments

Last Modified 17 Jul 2019

Rate Number of votes: 1185