Sourced guides to doing business in each market, and the status of every service there. Partners are in place in 35 markets so far.
One WONE Global Partner for each service in each market. Start from what you need to do, or go straight to a service.
Describe what you need. WONE Global names the service and the professional before any work begins.
Bring a requirement →Licences, value chains and the questions businesses in each industry ask first, with the services that usually apply.
What one country changes for the other, worked journeys step by step, and who handles each side.
When cross-border business becomes a dispute, UNIONE™, also part of the UNBOUNDED™ Global Ecosystem, prevents it, resolves it, arbitrates it and plans enforcement. 334 Fellows in 58 countries.
41 jurisdictions, each with primary sources and the date last checked.
Named senior professionals, each admitted as the one firm for a service in their country, and the firms they lead.
One Partner per service, per jurisdiction, admitted by review against published criteria.
Every statement is labelled: source-checked, professionally reviewed or not yet checked, with its source and date where checked.
Answers cite WONE Global's sourced statements and show how each one was checked. Research, not advice.
Accomplished regional specialists and international cross-border intelligence, across 100 countries, with one contact and one published Standard.
Saudi Arabia × Technology, Data & Cyber
Data, cyber and technology rules for running a digital business internationally. In Saudi Arabia, that means local law, local regulators and local practice, handled by a qualified professional who practises there.
On request
No WONE Global Partner holds this yet. Send us your requirement: WONE Global confirms whether a vetted Associate firm can act, tells you who it is and checks for conflicts before any work begins.
Bring a requirement →Riyadh · Tuesday 3 November
21:05
Local time
What the rules say in Saudi Arabia
From the Saudi Arabia market guide: the points that matter most for technology, data & cyber, each with the source it was checked against.
Full guide · Source-checked research100% of statements checked against a source119 checked against an official source54 checked against a secondary sourceChecked 2026-10-19Not yet professionally reviewed
E-invoicing Phase One (generation) has applied since 4 December 2021 to all taxpayers except non-residents, and Phase Two (integration with ZATCA's Fatoora platform) has been rolled out in waves since 1 January 2023 with at least six months' notice per wave.
VAT-registered resident taxpayers.Zakat, Tax and Customs Authority (ZATCA) · checked 2026-10-19Taxpayers whose VAT-able revenues exceeded SAR 187,500 in 2022, 2023, 2024 or 2025 are targeted in Wave 25 and must integrate with Fatoora by 1 February 2027.
Taxpayers notified by ZATCA for Wave 25.Zakat, Tax and Customs Authority (ZATCA) · checked 2026-10-19The Personal Data Protection Law (PDPL) allows controllers to be fined up to SAR 5 million, or given a warning, for violations other than the criminal offence of unlawfully disclosing sensitive data.
Fines may be doubled for repeat violations, up to twice the maximum. Imposed by the competent authority's violations committee.Ministry of Investment (MISA) · checked 2026-10-18Disclosing or publishing sensitive personal data in breach of the PDPL with intent to harm the data subject or for personal benefit is a criminal offence punishable by up to two years' imprisonment, a fine of up to SAR 3 million, or both.
Applies to any person, not only controllers. Prosecuted through the Public Prosecution.Ministry of Investment (MISA) · checked 2026-10-18Under the PDPL, a controller may transfer personal data outside the Kingdom only for purposes the law lists, must not prejudice national security or the Kingdom's vital interests, and must limit the transfer to the minimum data needed.
Exceptions for extreme necessity to protect life or vital interests, or to prevent, examine or treat disease (Article 29(3)). Detailed conditions are in the Regulation on Personal Data Transfer outside the Kingdom.Ministry of Investment (MISA) · checked 2026-10-18A controller must notify the competent authority of any breach, damage or unlawful access to personal data, and must notify the data subject where the incident could damage their data or prejudice their rights.
Timing and content are set by the Implementing Regulations (see sa-data-005).Ministry of Investment (MISA) · checked 2026-10-18Under the PDPL Implementing Regulations, a controller must notify SDAIA within 72 hours of becoming aware of a personal data breach that may cause harm to personal data or the data subject, and must inform affected data subjects without undue delay.
Current threshold is likely harm. A draft amendment published for consultation in October 2026 would remove the harm threshold for notification to SDAIA (see sa-data-012).Latham & Watkins · checked 2026-10-18The PDPL framework became fully enforceable on 14 September 2024, at the end of a one-year transition period that followed the law's entry into force on 14 September 2023.
Clyde & Co · checked 2026-10-18Read the full guide: Data protection, cybersecurity and digital filing
Scope
Key questions
If your work involves another country or another area of expertise, WONE Global brings in the right professional and keeps all advisers informed.
WONE Global Partners in Saudi Arabia
No named lead for Technology, Data & Cyber yet — these WONE Global professionals already work in Saudi Arabia and can bring the right local colleague in.
Riyadh · Saudi ArabiaWONE Global Partner · Saudi Arabia
Abdullah Yousef Al-Hussaini (License No. 992) is a seasoned accounting and auditing professional with a career spanning leading roles at Ernst & Young (EY) and one of Saudi Arabia’s largest insurance companies, includin…
Jeddah · Saudi ArabiaWONE Global Partner · Saudi Arabia
Jeddah · Saudi ArabiaAlso in Saudi Arabia
Appointed services show their named professional. Open positions link directly to the Expression of Interest form.
Cases
The cases this service leads or joins, each with what is at stake, how WONE Global handles it and who handles it in Saudi Arabia.
WONE Global Intelligence
Ask in your own words. Answers come from WONE Global's checked records, with every source shown, and end with the named Partner who can act. Go deeper on any point, or build a decision file.
Contact WONE Global
Save your questions, decisions and WONE activity in one account.
Forgot your password? Reset it securely.
Partner workspaces are for Partner firms. Explore partnership →
