New telecommunications and data protection regulations come into force in Saudi Arabia

KSA Act on Telecommunications and IT

The Communications, Space and Technology Commission (CST), formerly known as the Communications and Information Technology Commission (CITC) until 2022, is the body responsible for regulating activities in the telecommunications and information technology sectors in KSA.

Until recently, the telecommunications sector in the KSA was regulated by the Telecommunications Law issued under Royal Decree No. (M/12) of 12/03/1422H (3 June 2001) and its Regulations, which generally prohibited the provision of telecommunications services or the operation (or interconnection) with the public telecommunications network without first obtaining a license from CST. The licensing framework has changed continuously in recent years, with the CST taking several different approaches and offering a variety of ‘class’ licenses allowing for specific types of activity. To date, the number of fixed and mobile service providers in the KSA that have been issued “individual” licenses remains very limited, however CST has issued class licenses to various service providers offering IoT, ISP, VoIP, VSAT, SMS and other specialized services.

On December 4, 2022, the new Telecommunications Law came into force, issued by Royal Decree No. M/106 of 02/11/1443H in June 2022 (Telecommunications Law), replacing the existing Telecommunications Law. Subsequently, in November 2022, implementing regulations for the Telecommunications Law (Telecommunications Regulations) were issued.

however, CST has issued class licenses to various service providers offering IoT, ISP, VoIP, VSAT, SMS and other specialized services.

The express purpose of the Telecommunications Act is to promote digital transformation in the Kingdom and improve the services provided in the ICT sector, especially in light of recent exponential growth. At the same time, the new Telecommunications Act and Regulations continue to require a license or authorization to provide certain communications or technology services in the KSA and have effectively expanded the scope of the CST’s regulatory powers to include additional technologies and digital services. Whether these changes advance or hinder policy goals may therefore ultimately depend on the burdens caused by CST implementation practices.

The most important changes introduced in the Telecommunications Law include:

“Telecommunications” and “information technology” have been given broad definitions to bring a range of new telecommunications and digital services under the scope of the new framework and CST. While the regulators’ stated objective in this regard is clear, until further guidance is issued by regulators, the change is likely to leave many service providers operating or seeking to operate in the KSA uncertain as to whether they will be required to obtain a license and/or authorization from the CST. Regulatory counsel with experience of CST’s views can help clarify these issues or may seek guidance directly from CST on more complex scenarios.
In addition to service providers requiring a license to provide telecommunications services, service providers using telecommunications networks to provide telecommunications functionalities are now also required to obtain an appropriate license from CST.
Service providers can now obtain a “general class license” to provide services covered by the Telecommunications Act, provided they also obtain a separate “service authorization” for each of the acquired services. According to the latest version of the Classification Regulations and the General Class License Regulations issued by CST in 2024, there are currently 11 categories of services for which a service provider can obtain CST permits, however, this list is updated on an ongoing basis.
The CST Board has now been given the power to require a licence, registration or authorization for the provision of any other services relating to the telecommunications or information technology sector beyond those activities that may be covered by the current framework. This change is likely to perpetuate regulatory uncertainty, as the CST has effectively been granted authority to regulate future technologies in an unspecified manner as and when they may appear in the KSA market.
The Telecommunications Law currently contains detailed provisions regarding the processing and protection of user information and confidential documents and obliges service providers to comply with applicable laws and regulations of the KSA in this respect. These include data protection regulations and policies issued by the CST and the National Cybersecurity Authority, as well as the new KSA Personal Data Protection Act, described below.