Article 5 of the Saudi E-Commerce Law
المادة 5 من نظام التجارة الإلكترونية
The Article requires the service provider not to keep consumer data longer than necessary and to protect it, and bars using it for unauthorized purposes or disclosing it without the consumer's consent.
Official text (Arabic)
This article has not been amended since the law was issued.
1- ما لم يتفق موفر الخدمة والمستهلك على مدة أخرى، ودون إخلال بما يقضي به نظام آخر، لا يجوز لموفر الخدمة الاحتفاظ ببيانات المستهلك الشخصية أو اتصالاته الإلكترونية إلاَّ في المدة التي تقتضيها طبيعة التعامل بالتجارة الإلكترونية، ويجب اتخاذ الوسائل اللازمة لحمايتها والحفاظ على خصوصيتها خلال مدة احتفاظه بها، ويكون موفر الخدمة مسؤولاً عن حماية البيانات الشخصية للمستهلك أو اتصالاته الإلكترونية التي تكون في عهدته أو تحت سيطرة الجهات التي يتعامل معها أو مع وكلائها. وتحدد اللائحة البيانات الشخصية التي يجب المحافظة على خصوصيتها وفقاً لأهميتها.
2- لا يجوز لموفر الخدمة استعمال بيانات المستهلك الشخصية أو اتصالاته الإلكترونية لأغراض غير مصرح لها أو مسموح بها، أو الإفصاح عنها لجهة أخرى، بمقابل أو بدون مقابل، إلا بموافقة المستهلك الذي تتعلق به البيانات الشخصية أو إذا اقتضت الأنظمة ذلك.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 5 explained in plain English
This Article protects the consumer's personal data and electronic communications that the service provider obtains, and places obligations on him in three respects:
1- Retention period: the service provider may not keep this data except for the period that the nature of dealing in e-commerce requires, unless he agrees another period with the consumer, and without prejudice to what another law provides.
2- Protection and responsibility: the service provider must take the necessary means to protect the data and preserve its privacy for as long as he keeps it. He is responsible for protecting it whether it is in his custody or under the control of the parties he deals with or their agents. It is not enough for him to say the data was with a shipping company or a service provider he deals with. The Regulations set the personal data whose privacy must be preserved according to its importance.
3- Use and disclosure: the service provider is barred from:
- using the data for purposes that are not authorized or not permitted.
- disclosing it to any other party, whether for payment or free.
There are only two exceptions to this bar: the consent of the consumer to whom the data relates, or where the laws require it.
A consumer who believes his data was used or disclosed contrary to this Article can consult a lawyer specialized in commercial cases to learn what is available to him.
Practical example
Noura bought a device from an online store in Jeddah, and weeks later she began receiving marketing messages from another company she does not know, and it turned out the store had shared her number and address without her consent. This disclosure to another party without her consent, and not required by the laws, violates paragraph 2 of the Article.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 5 of E-Commerce Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Commercial & Corporate Law lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
Commercial & Corporate Law lawyers
Lawyers who handle this kind of case
شركة امتداد النظام للمحاماة والاستشارات المهنية
- Labour & Employment Law
- Criminal Law
- Criminal Law
- Commercial & Corporate Law
Frequently asked questions about Article 5 of the Saudi E-Commerce Law
May the online store share my data with another party?
No, except with your consent or where the laws require it, whether the disclosure is for payment or free.
How long can the store keep my data?
Only for the period the nature of the dealing requires, unless you agree another period with the store, and without prejudice to what another law provides.
Who is responsible if my data leaks from a company the store deals with?
The service provider is responsible for protecting data in his custody or under the control of the parties he deals with or their agents.
More articles on Duties of Service Providers and Online Stores
- Article 6
The Article requires the service provider to disclose in his e-store his name, address, contact means and register details if any, and whatever the Regulations specify.
على موفر الخدمة الإفصاح في محله الإلكتروني عن البيانات الآتية: أ- اسمه أو أي بيان مميز له، وعنوانه، ما لم يكن مسجلاً لدى إحدى جهات توثيق المحلات الإلكترونية. ب-
- Article 9
The Article requires a service provider who practices a profession that needs a license or permit to disclose the body he is registered with, his license details, his professional title and the country that granted it.
على موفر الخدمة الذي يمارس مهنة تخضع لتنظيم معين، وتتطلب ترخيصاً أو تصريحاً بممارستها، الإفصاح عما يأتي: أ- الجهة المسجل لديها، وبيانات الترخيص أو التصريح الصاد
- Article 15
The article requires a merchant to register its online store in the commercial register under the Commercial Register Law, and refers the rules to the Implementing Regulations.
على التاجر أن يُقيِّد محله الإلكتروني في السجل التجاري وفقاً لنظام السجل التجاري، وتحدد اللائحة الضوابط اللازمة لذلك.
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.