Article 24 of the Saudi Electronic Transactions Law

This article sets out the penalty for the acts that Article 23 treats as violations of the Electronic Transactions Law, including:

• practicing as a certification services provider without a license from the Authority.
• a certification services provider using a certificate applicant's information for other purposes, or disclosing it without the owner's permission or legal permission.
• creating, publishing or using a digital certificate or electronic signature for a fraudulent or unlawful purpose.
• forging an electronic record, electronic signature or digital certification certificate, or using them knowing they are forged.
• accessing another person's electronic signature system without valid authorization, or copying or seizing it.
• impersonating another person or falsely claiming authority to act for them in applying for, accepting, suspending or revoking a digital certification certificate.

The penalty: a fine of not more than SAR 5,000,000, or imprisonment for not more than five years, or both, without prejudice to any more severe penalty provided for in another law.

Confiscation: a judgment may be issued confiscating the devices, systems and programs used in committing the violation.

Publication of the judgment: the competent court may provide in its judgment for publishing a summary of it at the convicted person's expense in a local newspaper in their place of residence, or in the nearest area to them if there is no newspaper, or in any other way the court considers appropriate, according to the type of offense and its gravity and impact, provided that publication takes place after the judgment becomes final.

Under Article 25, the Authority handles the detection and inspection of these violations and may seize the devices, systems and programs used pending their determination. This text was issued by Royal Decree No. M/57 dated 1/8/1436 AH. Anyone facing an accusation of this kind is advised to consult a lawyer specializing in cybercrime.