Selling online in Saudi Arabia means meeting a short list of legal and administrative requirements, and almost every one of them shows up somewhere visible on your store: the footer, the product page, the checkout or the confirmation email. This Saudi e-commerce law checklist for online stores maps each requirement to the exact place it belongs, so you and your developer can close the gaps before launch. It is a practical build guide, not legal advice; confirm current rules with the Ministry of Commerce and the relevant authorities.

What the Saudi e-commerce law actually asks of a store

The Saudi E-Commerce Law and its implementing regulations, overseen by the Ministry of Commerce, apply to anyone selling to consumers in the Kingdom online, whether through a website, an app or a Salla or Zid store. The principle: before paying, the customer should know who is selling, what they are buying, the full price, and how delivery, cancellation and complaints work.

For you, that means content (identity details, policies, clear prices), UX (where that content sits and how checkout confirms the order) and systems (invoicing and integrations that keep reliable records). Most gaps we see are not missing knowledge but a policy that never reached the store, or a return policy that contradicts the checkout.

Identity disclosures and store documentation

Identity details the store must show

The E-Commerce Law requires a store to disclose identifying details so the customer can identify and reach the seller. Plan for at least:

  • The legal name of the business, as it appears on the commercial registration, not only the brand name.
  • An address or a clear contact method.
  • The commercial registration (CR) number.
  • The VAT registration number, if you are registered for VAT.

Place these in the footer of every page and repeat them on a "Store information" page. If your brand name differs from your legal name, as with many Jeddah and Riyadh brands, show both so a customer who checks the CR is reassured.

Store documentation through the Saudi Business Center

Online stores are documented through the Saudi Business Center's business platform, which replaced Maroof for store documentation. If your store still shows an old Maroof badge, review the current process on the Saudi Business Center platform and replace it with what the platform now provides.

The freelance certificate route for individuals

Individuals without a CR can sell under a freelance certificate. A home baker in Riyadh or a template designer in Dammam would check this route first, then show the certificate details in place of a CR number. Confirm with the Ministry of Commerce which activities are eligible and what you must display, because conditions can change.

Online store requirements in Saudi Arabia: where each one lives

Use this table in a review session with whoever builds or runs your store.

Requirement Where it appears on the store Typical owner
Legal name, contact, CR or freelance certificate Footer on every page, About/Store information page Owner + developer
VAT number (if registered) Footer, tax invoices, order confirmation Finance + developer
Store documentation badge or link Footer or trust area near checkout Owner
Full price including VAT and fees Product page, cart, checkout summary Store manager + developer
Delivery cost and expected timeline Product page estimate, checkout, delivery policy Operations
Terms and conditions Dedicated page, linked and accepted at checkout Owner, with legal review
Cancellation, return and refund policy Dedicated page, link on product page, order email Operations + owner
Privacy notice and consent Privacy page, signup and checkout forms, cookie notice Developer + owner
Order confirmation with full details Confirmation page plus email or SMS Developer
Tax invoice Order email or account area, stored in the back office Finance + developer
Complaints and support channel Contact page, account area, order email Customer service

If the honest answer in the "owner" column for any row is "nobody", that row is your first risk.

Prices, VAT and e-invoicing

Show the price the customer will actually pay

Saudi VAT is 15%, and prices shown to consumers should include VAT. Surprise fees that appear only after card details are exactly what the rules aim to prevent, and they also hurt conversion. Show delivery cost, any cash-on-delivery fee and any instalment terms before the customer commits.

E-invoices and ZATCA Phase 2

Your store must issue tax invoices that follow ZATCA's e-invoicing rules. Phase 2, the integration phase, is being rolled out in waves. Wave 24 covered taxpayers with VAT-subject revenue above SAR 375,000 in 2022, 2023 or 2024, with integration due by 30 June 2026. Wave 25, announced in July 2026, covers taxpayers above SAR 187,500 in 2022 to 2025, with integration due by 1 February 2027 (per ZATCA's announcement as reported by EY). Integration means the software that issues your invoices connects to the Fatoora platform.

What this means for the build:

  • On a platform store, confirm how the platform or your invoicing app handles Phase 2 for your account, well before your deadline.
  • On a custom store, invoicing belongs in the architecture from day one: sequential invoice numbers, the QR code on simplified invoices, credit notes for refunds, and an integration path to Fatoora through your invoicing software.
  • Either way, check ZATCA's website for your own notification.

Terms, cancellation, returns and delivery

Terms and conditions

Your terms should cover what you sell, payment, delivery, warranty where relevant, and cancellation. Link them at checkout, make acceptance explicit, and keep dated versions: a dispute is judged against the terms live on the order date.

Cancellation and refund policy

The implementing regulations give consumers cancellation rights in many situations, with exceptions for certain goods such as made-to-order items. Check the current periods and exceptions with the Ministry of Commerce and write them in plain language. Then make sure customer service follows the written policy; a refund promise the team cannot keep is worse than none.

Delivery timelines

State realistic delivery windows by area: next day inside Riyadh may mean several days for smaller towns. Notify the customer when the order ships and early if it is delayed.

Privacy and customer data under the PDPL

Saudi Arabia's Personal Data Protection Law (PDPL), supervised by SDAIA, has been enforceable since September 2024. For an online store, the practical implications are:

  • A clear privacy notice that says what you collect, why, and who receives it (delivery companies, payment providers, marketing tools).
  • Consent and purpose stated at the point of collection, with marketing consent kept separate from what the order needs.
  • Security safeguards: HTTPS everywhere, restricted admin access, no card data stored on your servers.
  • A breach notification procedure your team knows before anything goes wrong.
  • Attention to transfers outside the Kingdom, which matters if your hosting, email platform or analytics stores data abroad.

This is not legal advice. Our guide to PDPL compliance for websites and apps walks through each point in more depth.

Payments and checkout details that affect compliance

mada is the national debit network, and online spending through mada reached record monthly highs in 2025, with SAR 30.7bn in October 2025 according to official data reported by Arabian Business. Apple Pay is widely used, and BNPL providers Tabby and Tamara are common at Saudi checkouts; Tamara received a SAMA consumer-finance licence in 2025.

Show accepted methods before checkout, explain instalment terms plainly, refund to the original method, and store payment references, never card data. Still choosing a provider? Read our guide to payment gateway options in Saudi Arabia.

Copy-ready pre-launch checklist

Tick each item only when you can see it live on the store:

  • Legal name, contact method and CR or freelance certificate number in the footer.
  • VAT number in the footer and on every tax invoice (if registered).
  • Store documented through the Saudi Business Center; old Maroof badges removed.
  • Every product price includes VAT; delivery and COD fees shown before payment.
  • Terms and conditions page live, linked at checkout, with a dated version.
  • Cancellation, return and refund policy matches what customer service does.
  • Privacy notice live; marketing consent separate and not pre-ticked.
  • Order confirmation page and email show items, total, address and expected delivery.
  • Tax invoices issued correctly; Phase 2 status confirmed against your ZATCA notification.
  • Complaints channel visible and monitored, with a target response time.

Platform store or custom store: who handles what

On Salla or Zid, the platform provides checkout, payment connections and page templates, but you still own the accuracy of your identity details, prices and policies. Our guide to Salla store design covers how to present those pages well. On a custom store, every row in the table becomes a development task that belongs in the requirements document, not a launch-week scramble. If you are planning a custom build, our web development service treats these pages and flows as part of the scope.

Store pages are also content that search engines read. On KWDStore, a Saudi store on Salla, our scope was a content SEO strategy with around 100 articles, technical SEO, performance work and WebP images.

Frequently asked questions

Do I need a commercial registration to open an online store in Saudi Arabia?

Not always. Businesses sell under a commercial registration, while individuals without a CR can sell under a freelance certificate if their activity is eligible. Either way, the store must display clear identifying details such as the name, a contact method and the CR or certificate number. Confirm the eligible activities and current conditions with the Ministry of Commerce before you launch.

Is Maroof still used to document online stores?

No. Online stores are now documented through the Saudi Business Center's business platform, which replaced Maroof for store documentation. If your store still shows an old Maroof badge or link, review the current documentation steps on the Saudi Business Center platform and update the badge or link in your footer and in the trust area near checkout.

Does my Salla store need its own privacy policy and return policy?

Yes. The platform gives you page templates and checkout tools, but the policy text must describe how your business actually works: what data you collect and who you share it with, your real return window, and who pays return shipping. Unedited template text can promise things your team does not do, which is a common source of complaints.

When does my store need ZATCA Phase 2 integration?

It depends on the wave ZATCA notifies you about; Wave 25, for example, covers taxpayers above SAR 187,500 in 2022 to 2025 with a 1 February 2027 deadline, per ZATCA's announcement as reported by EY. Check ZATCA's website for your own notification, then confirm how your invoicing software connects to Fatoora and leave time for testing.

Your next step

Launching a store in Saudi Arabia, or worried about gaps in the one you already run? Share your store link and requirements and we will review the pages and technical flows against this checklist, then propose a clear, prioritised list of fixes before you commit. Final legal confirmation stays with the Ministry of Commerce and the relevant authorities.