Article 5 of the Saudi Anti-Cybercrime Law

This article punishes acts aimed at data, networks, and services, and the penalty is imprisonment of not more than four years, a fine of not more than SAR 3 million, or either of these two penalties.

It covers three forms:

1. Attack on private data after unauthorized access: unauthorized access with the aim of canceling, deleting, destroying, leaking, damaging, changing, or republishing private data. This form is conditional on the access being unauthorized.
2. Attack on the information network: stopping it from working or disabling it, or destroying the programs or data in it or used in it, or erasing, deleting, leaking, damaging, or modifying them.
3. Obstructing access to the service, or disrupting or disabling it, by any means.

Comparing the article with its neighbors shows that the law escalates penalties according to the seriousness of the act: Article 4 punishes online fraud and access to banking data with imprisonment of up to three years and a fine of up to SAR 2 million, whereas Article 6 raises the penalty to imprisonment of up to five years and a fine of up to SAR 3 million for content crimes such as producing or sending what violates public order, religious values, public decency, or the sanctity of private life.

The penalty mentioned is a maximum, and its assessment in each case is for the judiciary. Anyone whose data has been leaked or whose services have been disabled can consult a lawyer specializing in cybercrime.