What counts as cyber crime in Saudi Arabia, and what is the punishment?
Cyber crime in Saudi Arabia is any act using a computer or network in violation of the Anti-Cyber Crime Law (Royal Decree No. M/17 dated 8/3/1428H, Article 1). Maximum penalties range from one year in prison and 500,000 riyals (Article 3) to ten years and 5 million riyals (Article 7), and the court may impose both or either. Victims report through the Kollona Amn app, the Public Prosecution investigates, and a cybercrime lawyer in Saudi Arabia can help with evidence and the private claim.
This guide explains the three elements of an informatics crime, every offence and penalty in Articles 3 to 10, when penalties are increased, how to report and what evidence to keep, and the main defence points if you are the one accused. It is written for residents, expats and companies in the Kingdom.
You can book a consultation on WhatsApp with the team at Al-Safwa Law Firm for Advocacy and Legal Consultations to review your documents and explain your legal options clearly.
Table of Contents
What is a cyber crime under Saudi law?
In the official English translation of the Anti-Cyber Crime Law, a cyber crime is “any action which involves the use of computers or computer networks, in violation of the provisions of this Law”. A computer is any fixed or mobile, wired or wireless electronic device that processes, stores, sends or receives data, so smartphones are included.
Saudi law also calls these offences “informatics crimes”. The law defines a person as any natural or corporate person, public or private, so it covers individuals and companies alike.
Article 2 states the purpose of the law: to enhance information security, protect the legitimate use of computers and networks, protect public interest, morals and common values, and protect the national economy.
The three elements of an informatics crime
An act is only a cyber crime when three elements come together. If one is missing, there is no crime under this law: The Anti-Cyber Crime Law in Saudi Arabia defines the offences and penalties discussed in this guide.
| Element | What it means | Where it comes from |
|---|---|---|
| Legal element | A text that criminalises the act and sets its penalty | The Anti-Cyber Crime Law, Royal Decree No. M/17 dated 8/3/1428H, Articles 3 to 7 |
| Material element | The act itself, committed through a computer or an information network (for example unlawful access, interception, publishing or fraud), and its result | The wording of each offence in Articles 3 to 7 |
| Mental element | Criminal intent: the person knows the act is unlawful and wants its result | Article 1 defines unauthorized access as “deliberate”; several offences also require a specific intention |
The mental element matters in practice. Article 3(2) punishes unlawful access “with the intention to threaten or blackmail”, Article 4(2) access to bank or credit data “with the intention of obtaining data, information, funds or services”, and Article 7(2) access to obtain data that jeopardises state security. Proving or disputing that intention is often the centre of the case.
The law also punishes inciting, assisting or collaborating in a crime, and attempting one (Articles 9 and 10).
Penalties for cyber crime in Saudi Arabia by article
The Anti-Cyber Crime Law published by the Bureau of Experts at the Council of Ministers groups the offences into five penalty articles. Each sets a maximum prison term and a maximum fine, and the court may impose both or only one:
| Article | Offences | Maximum prison | Maximum fine |
|---|---|---|---|
| Article 3 | Spying on, intercepting or receiving data sent through a network without legitimate authorization; unlawful access to threaten or blackmail a person; hacking a website to change, destroy or take over it; invading privacy by misusing camera phones; defamation and harming others through IT devices | 1 year | 500,000 riyals |
| Article 4 | Taking movable property or bonds, or signing bonds, through fraud or a false name or identity; unlawful access to bank or credit data or data on ownership of securities | 3 years | 2 million riyals |
| Article 5 | Unlawful access to delete, destroy, leak, damage, alter or redistribute private data; stopping or breaking down a network or deleting or altering programs or data; obstructing or disrupting services | 4 years | 3 million riyals |
| Article 6 | Producing, preparing, sending or storing material that impinges on public order, religious values, public morals or privacy; websites promoting human trafficking or drugs; preparing or promoting pornographic or gambling material | 5 years | 3 million riyals |
| Article 7 | Websites for terrorist organisations; unlawful access to obtain data that jeopardises the internal or external security of the State or its national economy | 10 years | 5 million riyals |
Article 6 was amended by Royal Decree No. M/54 dated 22/7/1436H. A judgment under Article 6 may order a summary of the ruling to be published at the convicted person’s expense in one or more local newspapers or another suitable medium, depending on the type, seriousness and impact of the crime. Publication happens only after the judgment becomes final.
Article 3: blackmail, defamation and privacy
Article 3 covers many everyday situations: online blackmail and threats, hacked accounts, secret photos or videos taken with a phone, and defamation on social media. For the specific rules on reputation cases, see our guide to the defamation penalty in Saudi Arabia. Blackmail victims can also read about the urgent steps a blackmail lawyer in Saudi Arabia takes to stop the threat.
Article 4: online fraud and bank data
Article 4 deals with electronic fraud: getting money, property or a signed bond by deception, a false name or a fake identity, and reaching bank or card data without right. Fraud committed offline falls under other rules, explained in our article on the fraud penalty in Saudi Arabia.
Articles 5, 6 and 7: systems, content and state security
Article 5 protects data and systems themselves (deletion, leaks, disruption). Article 6 covers unlawful content and websites. Article 7 carries the heaviest penalties in the law and covers terrorism-related websites and access to data that affects state security or the national economy.
When is the penalty increased, reduced or waived?
Under Article 8, the prison term and the fine may not be less than half the maximum if the crime is coupled with any of these circumstances:
- it was committed through organised crime;
- the offender holds a public office and the crime relates to that office, or the offender used power or influence;
- it involved luring and exploiting minors and the like;
- the offender was previously convicted of similar crimes inside or outside the Kingdom.
Other rules that change the outcome:
| Situation | Rule | Article |
|---|---|---|
| Inciting, assisting or collaborating, and the crime happens | Up to the maximum penalty of that crime | Article 9 |
| Inciting, assisting or collaborating, and the crime does not happen | Up to half the maximum penalty | Article 9 |
| Attempting a cyber crime | Up to half the maximum penalty | Article 10 |
| Offender informs the authority before the crime is discovered and before damage occurs | The court may exempt the offender from punishment | Article 11 |
| Offender informs after the crime | Exemption requires that the information leads to arresting the other offenders or seizing the means used | Article 11 |
| Devices, software and proceeds of the crime | May be confiscated, without prejudice to persons acting in good faith; the website or venue may be closed permanently or temporarily if the owner knew of the crime | Article 13 |
How to report a cyber crime in Saudi Arabia
The right channel depends on who was harmed. For an individual victim of blackmail, defamation, hacking or online fraud, the report goes to the security authorities. A cybersecurity incident affecting a national entity goes to the National Cybersecurity Authority (NCA).
| Situation | Where to report | Notes |
|---|---|---|
| Blackmail, threats, defamation, hacked account, privacy violation, online fraud against you | The Ministry of Interior’s security reports app Kollona Amn; the Cyber Crime Reports service on the National Unified Portal (my.gov.sa) | The app accepts photos, videos and audio recordings as attachments |
| Cybersecurity incident involving a national (government or critical) entity | NCA, Report an Incident | The NCA page is for incidents involving a national entity and security vulnerabilities |
| A cybersecurity violation you want to report as an individual | NCA, Report a Cybersecurity Violation (Beta) | Available 24/7 in English and Arabic; the NCA states a service period of 3 working days (page updated 20 July 2026) |
| Money taken from your bank account or card | Your bank, as soon as possible, plus a security report | See our guide on how to recover money after fraud in Saudi Arabia |
Steps after you file the report
- Preserve the evidence first (see the checklist below), before blocking or deleting anything.
- File the report through Kollona Amn or the my.gov.sa service and attach the evidence.
- Investigation and prosecution: under Article 15, investigation and prosecution of these crimes belong to the Bureau of Investigation and Public Prosecution, today called the Public Prosecution.
- Technical support: under Article 14, the Communications and Information Technology Commission, now the Communications, Space and Technology Commission (CST), gives technical support to the security agencies during investigation and trial.
- Trial and private claim: the competent court rules on the penalty. The victim can also claim the private right, including compensation for the damage, before the competent court, where a lawyer drafts the requests and presents the evidence.
The 16 articles of the Anti-Cyber Crime Law do not set a deadline for reporting. Even so, delay is risky: messages get deleted, accounts disappear and platforms keep some data only for a limited time.
Evidence to keep before you report
- Screenshots that show the full message, the date and time, and the sender’s username or profile link.
- The full links (URLs) of posts, profiles and websites, copied as text, not only as images.
- The original conversations, kept on the device. Do not delete the chat or the account.
- Exported chats, emails with their headers, and any voice notes or videos you received.
- Bank transfer receipts, the account details you sent money to, and card statements in fraud cases.
- A short written timeline: what happened, when, on which platform, and any witnesses.
- The device itself, unchanged, in case a technical examination is needed.
Common mistakes that weaken a cyber crime report
These are common patterns that make a report harder to prove or follow up:
- Deleting or blocking first: blocking the account or deleting the chat before capturing it can remove the only proof of the sender’s identity.
- Cropped screenshots: images without the date, username or link are hard to tie to a specific account.
- Answering back in public: posting insults or the other party’s private details may itself fall under Article 3(5) as defamation or harm through IT devices.
- Paying or negotiating with a blackmailer: the other party still holds the material, and the report is delayed.
- Using the wrong channel: the NCA incident line serves national entities; a personal blackmail or fraud case belongs in a security report.
Defence considerations if you are accused
If you receive a summons from the police or the Public Prosecution in an electronic case, the points a defence usually examines are:
- Intent: unauthorized access must be deliberate (Article 1), and several offences require a specific intention. An accidental or authorised act is analysed differently.
- Authorization: Article 3(1) punishes interception “without legitimate authorization”, so whether you had permission (for example as a system administrator) is relevant.
- Attribution: the prosecution must link the account, number or device to the accused, not only show that the content exists.
- Integrity of digital evidence: screenshots can be edited, so their source, completeness and the technical report matter.
- The correct article: the same facts can be described under Article 3 or Article 6, with very different maximum penalties. The legal description of the act affects the whole case.
- Aggravating circumstances: the minimum of half the maximum under Article 8 applies only if one of its four circumstances is actually proved.
- Attempt, assistance and exemption: Articles 9, 10 and 11 set lower limits or allow exemption in defined cases.
Avoid deleting data, contacting the complainant or posting about the case before you get legal advice. A criminal cases lawyer in Jeddah can review the charge, the evidence file and the article applied.
Information checked in November 2026 against the published text of the Anti-Cyber Crime Law and the official service pages linked above.
Frequently Asked Questions about Cyber Crime in Saudi Arabia
Cyber crime in Saudi Arabia is handled article by article: the act, the intent and the article applied decide the maximum penalty, and aggravating circumstances can raise the minimum. Whether you are a victim or accused, the strength of the case usually depends on how early and how carefully the digital evidence is preserved.
To get a legal consultation from our team, contact us via the WhatsApp button at the bottom of the screen.
Read also:
- Defamation lawyer in Saudi Arabia
- Fraud and scam lawyer in Saudi Arabia
- Penalty for insult and cursing without witnesses
Sources:
- Anti-Cyber Crime Law, Royal Decree No. M/17 dated 8/3/1428H, Bureau of Experts at the Council of Ministers (Articles 1 to 16, including Article 6 as amended by Royal Decree No. M/54 dated 22/7/1436H)
- Anti-Cyber Crime Law, official English translation (Bureau of Experts), Ministry of Communications and Information Technology (checked November 2026)
- Cyber Crime Reports service, National Unified Portal (my.gov.sa)
- Report an Incident, National Cybersecurity Authority (checked November 2026)
- Report a Cybersecurity Violation, National Cybersecurity Authority (page updated 20 July 2026)
- Communications, Space and Technology Commission (CST)
A legal advisor holding a Bachelor’s degree in Law from the prestigious Cairo University. He possesses extensive experience spanning over 25 years in criminal, civil, and family law, during which he has achieved notable accomplishments that have solidified his reputation as a valuable asset to any legal team
