Article 18 of the Saudi Electronic Transactions Law
المادة 18 من نظام التعاملات الإلكترونية · الفصل السابع: واجبات مقدم خدمات التصديق ومسؤولياته
The article lists eight obligations of a certification services provider, including prior licensing, issuing and protecting certificates, an accessible database, confidentiality, and handing documents to the Authority when its activity stops.
Official text (Arabic)
This article has not been amended since the law was issued.
يجب على مقدم خدمات التصديق الالتزام بما يأتي:
1 - الحصول على الترخيص اللازم من الهيئة قبل البدء في ممارسة نشاطه.
2 - إصدار شهادات التصديق الرقمي ، وتسليمها وحفظها وفقا للترخيص الصادر له من الهيئة والضوابط والإجراءات التي تحددها اللائحة.
3 - استعمال وسائل موثوق بها لإصدار الشهادات وتسليمها وحفظها واتخاذ الوسائل اللازمة لحمايتها من التزوير والتدليس والتلف وفقا لما يحدد في اللائحة والترخيص الصادر له.
4 - إنشاء قاعدة بيانات للشهادات التي أصدرها وحفظ تلك البيانات وما يطرأ عليها من تعديل بما في ذلك الشهادات الموقوفة والملغاة، وأن يتيح الاطلاع إلكترونيا على تلك البيانات بصفة مستمرة.
5 - محافظته - ومن يتبعه من العاملين - على سرية المعلومات التي حصل عليها بسبب نشاطه، باستثناء المعلومات التي سمح صاحب الشهادة كتابيا أو إلكترونيا بنشرها أو الإعلام بها ، أو في الحالات المنصوص عليها نظاما.
6 - أخذ المعلومات ذات الصفة الشخصية من طالب الشهادة مباشرة، أو من غيره بشرط أخذ موافقة كتابية من طالب الشهادة على ذلك.
7 - إصدار الشهادات متضمنة البيانات الموضحة في اللائحة ومطابقة لشروط أمن الأنظمة وحمايتها وقواعد الأنظمة وحمايتها وقواعد شهادة التصديق الرقمي التي يضعها المركز.
8 - تسليم المعلومات والوثائق التي في حوزته إلى الهيئة وذلك في جميع حالات وقف نشاطه ليتم التصرف بها وفقا للأحكام والمعايير الموضحة في اللائحة.
This is the official Arabic wording, the only legally binding version. We do not translate the law itself; the explanation below is ours. Official source: Bureau of Experts at the Council of Ministers
Article 18 explained in plain English
This article sets out the duties of the certification services provider, who, according to Article 1, is a person licensed to issue digital certification certificates or provide services related to them. The provider must:
- Obtain prior licensing from the Authority before starting its activity.
- Issue, deliver and retain certificates in accordance with its license and the controls and procedures set by the Regulations.
- Use reliable means to issue, deliver and retain certificates and to protect them from forgery, fraud and damage, in accordance with the Regulations and the license.
- Maintain a database of the certificates it has issued and any changes to them, including suspended and revoked ones, with continuous electronic access to it.
- Confidentiality: maintain, itself and through its staff, the confidentiality of the information obtained because of its activity, except what the certificate holder has allowed in writing or electronically to be published or disclosed, or in cases provided for by law.
- Source of personal information: obtain it directly from the certificate applicant, or from another person on condition of the applicant's written consent.
- Content of certificates: they must include the data set out in the Regulations and conform to the system security and protection requirements and the digital certification certificate rules set by the Center.
- Hand over the information and documents in its possession to the Authority in all cases of suspension of its activity, to be dealt with in accordance with the provisions and standards of the Regulations.
Linked to this article is what Article 19 provides: a provider may not stop its activity, assign it or merge except with the Authority's prior written approval.
Practical example
Abdullah applies for a digital certification certificate from a licensed certification services provider in Riyadh. The provider must take his personal data from him directly, or from another person with his written consent, keep it confidential, and record the certificate in a continuously available electronic database that later shows whether it has been suspended or revoked.
Translated from our Arabic explanation with machine assistance. For guidance only; it does not replace advice from a lawyer on your situation.
How we write and review contentA question about Article 18 of Electronic Transactions Law?
Describe what happened and specialist lawyers answer. You can write in English.
- Completely free
- Lawyers from the directory answer
- Your name stays hidden
Administrative Law lawyers: ask a specialist about your case
Describe your situation briefly and we'll suggest a lawyer who specialises in this law
Administrative Law (Board of Grievances) lawyers
Lawyers who handle this kind of case
Dr. Ali Al-Rubaie Law Office and Ittihad Al-Asr Legal Company
Active contributor
Unwan Law Firm
Frequently asked questions about Article 18 of the Saudi Electronic Transactions Law
May certification services be provided without a license?
No. A certification services provider must obtain the necessary license from the Authority before starting its activity.
May a certification services provider publish my data?
It must maintain the confidentiality of the information it obtains because of its activity, except what you have allowed in writing or electronically to be published, or in cases provided for by law.
Can I find out whether a digital certificate has been revoked?
The provider must maintain a database of certificates, including suspended and revoked ones, and make it available for electronic access on a continuous basis.
What happens to a provider's documents if its activity stops?
It must hand the information and documents in its possession to the Authority in all cases of suspension of its activity, to be dealt with in accordance with the provisions of the Regulations.
More articles on Certification Services and Digital Certificates
- Article 15
The article divides oversight of the Law: the Ministry sets policies and plans and represents the Kingdom; the Authority applies the Law, licenses and monitors certification services providers, and sets the fee with the Minister's approval.
يتم الإشراف على تطبيق أحكام هذا النظام وفقا للآتي: 1 - تقوم الوزارة بوضع السياسات العامة ورسم الخطط والبرامج التطويرية للتعاملات والتواقيع الإلكترونية ، ورفع مش
- Article 16
The article establishes a National Center for Digital Certification in the Ministry to oversee the tasks of issuing and managing digital certification certificates, and refers the details of its seat, composition and competences to the Regulations.
1- ينشأ في الوزارة - بموجب هذا النظام - مركز وطني للتصديق الرقمي، يتولى الإشراف على المهمات المتعلقة بإصدار شهادات التصديق الرقمي وإداراتها. 2- تحدد اللائحة الق
- Article 17
The National Center for Digital Certification is competent to approve digital certification certificates issued by foreign bodies, which are treated like their domestic counterparts in accordance with the Regulations' controls and procedures.
يختص المركز باعتماد شهادات التصديق الرقمي الصادرة من الجهات الأجنبية خارج المملكة وتعامل هذه الشهادات معاملة نظيراتها بداخل المملكة، وذلك وفقا للضوابط والإجراءا
- Article 19
A certification services provider may not stop its licensed activity, assign its license or merge into another entity without the Authority's prior written approval, in accordance with the Regulations' procedures.
لا يجوز لمقدم خدمات التصديق التوقف عن مزاولة نشاطه المرخص به أو التنازل عن الترخيص الصادر له أو الاندماج في جهة أخرى إلا بعد الحصول على موافقة كتابية مسبقة من ا
- Article 20
A certification services provider guarantees the validity of the certified information in the certificate at the time of delivery and the validity of the link between the holder and their electronic data, and is liable for harm to anyone who relied on it in good faith.
يتحمل مقدم خدمات التصديق مسؤولية ضمان صحة المعلومات المصدقة التي تضمنتها الشهادة وقت تسليمها وصحة العلاقة بين صاحب الشهادة وبياناتها الإلكترونية، وتقع عليه مسؤو
- Article 21
A certification services provider must revoke or suspend a certificate at its holder's request or in the cases the Regulations set, notify the holder immediately and lift the measure when its cause ends, and is liable for harm to good-faith persons.
يجب على مقدم خدمات التصديق إلغاء الشهادة أو إيقاف العمل بها عند طلب صاحبها ذلك أو في الحالات التي تحددها اللائحة. كما يجب عليه إبلاغ صاحب الشهادة فورا بالإلغاء
The texts are reproduced from the official website of the Bureau of Experts at the Council of Ministers for reference; where they differ, the officially published Arabic text prevails. This content is not legal advice.