Article 23 of the Saudi Electronic Transactions Law

This article sets out the acts that violate the Electronic Transactions Law, which can be divided into two groups:

First - violations relating to the certification services provider:

• practicing as a certification services provider without a license from the Authority.
• using the information it collected about a certificate applicant for purposes outside certification activities without the owner's written or electronic consent.
• disclosing information it learned in the course of its work, unless the certificate holder authorizes it in writing or electronically or in cases the Law permits.
• giving the Authority false data or misleading information, or any misuse of certification services.

Second - violations anyone may commit:

• creating, publishing or using a digital certificate or electronic signature for a fraudulent or unlawful purpose.
• forging an electronic record, electronic signature or digital certification certificate, or using any of them knowing it is forged.
• deliberately giving false information to a certification services provider, or about an electronic signature to those who relied on it.
• accessing another person's electronic signature system without valid authorization, or copying, reconstructing or seizing it.
• impersonating another person or falsely claiming authority to act for them in applying for, accepting, suspending or revoking a digital certification certificate.
• publishing a forged, incorrect, revoked or suspended certificate, or making it available to others knowing its status. The provider's right under paragraph 4 of Article 18 is excepted, namely to maintain a database of certificates, including suspended and revoked ones, and make it available for electronic access.

Note that knowledge or intent is required in some forms, such as using a forged item knowing it is forged and deliberately giving false information. The penalty is set by Article 24: a fine of not more than SAR 5,000,000 or imprisonment for not more than five years, or both, with the possible confiscation of the devices, systems and programs used, without prejudice to any more severe penalty in another law. Anyone facing an accusation, or harmed by one of these acts, would do well to consult a lawyer specializing in cybercrime.