Wadira: Find your way through Saudi data & privacy law.

Home › Frameworks › Telecommunications & ICT › Telecommunications and Information Technology Act

Telecommunications and Information Technology Act

Primary law for the telecom and ICT sector (Royal Decree M/106)

Type	Law
Issuing authority	Communications, Space & Technology Commission (CST)
Framework	Telecommunications & ICT
Tier	Primary law: niẓām (Royal Decree M/…)
Legal status	In force, amendment proposed
Instrument number	M/106 · Royal Decree
Issued	(02/11/1443H)
Dates	Royal Decree M/106 (02/11/1443H); in force since 2022
Last verified	2026-10-20

The Telecommunications and Information Technology Act (Royal Decree M/106, 02/11/1443H) is the primary law for the telecom and ICT sector. It has been in force since 2022.

• Legal basis for CST's licensing and registration of telecom and IT services, through its Implementing Regulations (MCIT Ministerial Decision 13).
• Cloud computing and data centre services are registered, not licensed, under CST regulations made under the Act (Cloud Computing Services Provisioning Regulations v4; Data Centre Services Regulations).
• User data duties (consent to collect or disclose user data, CST data requests, retention) sit in the Implementing Regulations.
• Pending: MCIT published draft amendments in 2024. They are not known to have been enacted as at 20 October 2026.
• Applies alongside the PDPL, the NCA's controls and CST's own sector regulations.

Documents

• Official source (www.cst.gov.sa)

In this framework

• Organisation of the Communications, Space and Technology Commission (as amended)
• Implementing Regulations of the Telecommunications and IT Act
• Regulations for Curbing Spam Messages and Calls (RC01 v3)
• Regulations of User Rights Protection Rules
• Regulations for Providing Digital Content Platform Services
• Internet of Things Regulations (RT18 v3)
• Telecom Infrastructure Risk Management Regulations (v2)
• Space Sector Regulations and Guidelines (draft)
• CST licensing and registration (index)
• Cybersecurity Regulatory Framework (CRF) for ICT Service Providers (Second Version)

---

Content and register data licensed CC BY 4.0. Cite the live URL. Machine-readable register (JSON) · Markdown register · Content last verified: 2026-10-21