Saudi E-Commerce Compliance Checklist: Registration to Customer Rights

Orientation, not advice

Requirements depend on what you sell, whether you are an individual or a company, and which sector rules apply on top of the general ones. Regulated categories — food, medical products, cosmetics, telecoms devices — carry their own approvals that this checklist does not cover. Use it to structure a conversation with the Ministry of Commerce guidance at mc.gov.sa and qualified counsel, not as a substitute for either.

1. Be a real, identifiable seller

The Saudi E-Commerce Law requires an online store to identify itself rather than trade anonymously. In practice that means a commercial registration for a business, contact details a customer can actually reach, and a documented address. Individuals selling online have a lighter but non-zero set of expectations. Anonymity is the thing the law is designed to prevent, because it is what makes disputes unresolvable.

• Commercial registration (CR) for a company, kept current
• Store name and identity displayed on the storefront
• A contact channel that is monitored, not a dead form
• Any sector licences your product category requires

2. Register on Maroof

Maroof is the Ministry of Commerce platform for verifying online stores and linking them to a registered merchant. Buyers use it to check whether a store is real, and it is commonly expected of Saudi e-commerce sellers — including those selling through social channels rather than a conventional storefront. Displaying your Maroof identity is a straightforward trust signal and costs you nothing but the registration.

3. Disclose price, terms and returns before purchase

The disclosure duties are where most stores fall short, and they are also the cheapest to fix. The customer should know, before they commit, the total they will pay including VAT and delivery, what the return and exchange policy is, and how long delivery will take. A policy that exists but is buried, or that contradicts what agents say in chat, is functionally a policy you do not have.

• Total price including VAT, with delivery costs stated before checkout
• Return, exchange and refund policy, in plain Arabic
• Expected delivery timeframe
• Warranty terms where they apply
• The same terms reflected in your WhatsApp and social selling, not only on the website

4. Honour the right to return

Saudi consumer protection provides a right to return goods within a defined period for many categories, subject to exceptions — customised items, perishables, and goods unsealed where hygiene applies are typical carve-outs. The operationally important part is that your stated policy cannot be less generous than the law, and your agents need to know which category a product falls into before they refuse a return.

5. Handle customer data under PDPL

Everything above generates personal data: names, phone numbers, addresses, order histories, and — if you sell through messaging — conversation content. Saudi PDPL governs how that is collected, used, retained and transferred, including transfers outside the Kingdom. If your support platform, CRM or AI tooling processes customer conversations, that processing is in scope and belongs in your data inventory.

• Know what you collect and why, before you are asked
• Have a privacy notice that describes actual practice
• Understand where your vendors store and process the data, including subprocessors
• Apply retention limits to conversations and recordings, not only to order records

6. Get consent right for marketing messages

Promotional messaging is regulated separately from the sale itself, and WhatsApp, SMS and email each carry platform rules on top of the law. Consent should be recorded, opt-out should be honoured immediately and permanently, and transactional messages — order confirmations, delivery updates — should be kept distinct from marketing. Merging the two is how businesses lose a messaging channel entirely, and platform enforcement is usually faster and less negotiable than regulatory enforcement.

A checklist you can hand to an operations lead

• CR current, sector licences in place, Maroof registered and displayed
• VAT registration status confirmed, and prices displayed on the correct convention
• E-invoicing solution in place, with credit notes handled properly for refunds
• Return policy published, lawful, and known to every agent
• Privacy notice matching what your systems actually do
• Marketing consent recorded, opt-outs honoured, transactional messages separated
• A named owner for each of the above, because unowned compliance decays quietly