• The following words and phrases - wherever they appear in these rules - shall have the meanings set forth opposite each of them, unless the context requires otherwise:

  • Statutory Enablers: Statutory Enablers of the National Cybersecurity Authority, issued by Royal Decree No. (M/117) dated 21/6/1446 AH.
  • Rules: Rules Regulating the Reporting of Cybersecurity Violations.
  • Authority: The National Cybersecurity Authority.
  • Governor: The Governor of the Authority.
  • Violations: Violations stipulated in Clause (First) of the Statutory Enablers.
  • Report: Information submitted to the Authority - as stipulated by the rules - regarding any acts or practices that constitute or are suspected to constitute a violation according to the violations listed in Clause (First) of the Statutory Enablers.
  • Committee: The Committee for Rewards for Reporters of Cybersecurity Violations.
  • Reporter: Anyone who submits a report to the Authority, excluding Authority employees.
  • Authority Employees: All those working for the Authority and its affiliated centers, including inspectors, and all those working for any entities assigned with the tasks of monitoring, inspection, and violation control; as stipulated in paragraph (6) of Clause (Second) of the Statutory Enablers.
  • Reported Person: Anyone against whom a report is submitted to the Authority.
  • Reward: A monetary amount granted to the reporter, in accordance with what is stipulated in the rules.

• 1- The Authority receives reports through the Authority's website, or through any other means determined by the Authority.

• 2- The Authority receives reports via the means stipulated in paragraph (1) of this article; according to forms adopted for this purpose, provided that they include the following information:

  • A- The name of the reporter, his identification number, address, and contact details.
  • B- The name of the reported party, his address, and contact details; if available.
  • C- A description of the violation, its nature, location, and the date it was known in a precise and complete manner.
  • D- Data, documents, or evidence directly related to the report.
  • E- The reporter's desire to receive the reward or not.
  • F- Any other information the Authority deems important to request.

• 3- Without prejudice to what is stated in paragraph (2) of this article; the Authority may receive reports anonymously, and in this case, the reporter's right to receive the reward is forfeited.

• Upon receiving the report, the Authority shall undertake the following:

  • 1- Register the report and follow up on its outcome in a confidential register prepared for this purpose.
  • 2- Study the report, verify its accuracy, and validate the data, documents, and supporting evidence, and communicate with the reporter for clarification if needed, or request any additional relevant data or documents related to the report.
  • 3- Verify that the Authority has not previously discovered the violation subject to the report.
  • 4- Verify that no other similar reports have been received.

• The Authority grants the informant a reward according to its discretionary power, provided that the following conditions are met:

  • 1- The violation subject to the report is proven, by the finality of the decision establishing the violation; either by the issuance of a judicial ruling, or by the lapse of the statutory period for appeal, and the report must have played a role in proving the violation.
  • 2- The informant must be a natural person.
  • 3- The informant must not be an employee of the Authority, nor be a spouse, brother-in-law, or relative up to the fourth degree of any of the Authority’s employees, or of the employees of entities contracted by the Authority, which undertake main or operational tasks for the Authority.
  • 4- The violation must not have been previously reported or rewarded by the Authority.
  • 5- The disclosure of the violation by the informant must not result from his job duties.
  • 6- The informant must not disclose any information related to the report to others.
  • 7- The report must have been submitted using legitimate means and without involving any irregular practices, including any unauthorized access to the systems of the entity or others.
  • 8- The violation subject to the report must be punishable by a financial fine, and the Authority must have collected the amount of the fine.

1- A committee shall be formed by a decision of the Governor, consisting of at least (three) members from the Authority’s staff, whose jurisdiction is to study the reports referred to it, determine the eligibility of the informants for rewards, and also determine the amounts thereof, in accordance with the provisions set forth in the regulations.

2- When selecting the committee members and its chairman, consideration shall be given to their expertise and knowledge in financial, accounting, and regulatory matters.

3- The committee shall submit its recommendations regarding the reports referred to in paragraph (1) of this article to the Governor for approval.

4- The committee members and its chairman shall maintain the confidentiality of the documents and information they have access to.

• 1- The reward amount shall not exceed (50,000) fifty thousand Saudi Riyals, or the equivalent of (1%) of the collected financial fine; whichever is less.

• 2- The Committee shall consider the following criteria when determining the reward amount:

  • A- The role of the report in proving the violation; including the importance, accuracy, and completeness of the information contained therein.
  • B- The severity and significance of the violation.
  • C- The difficulty of detecting the violation and the effort exerted by the informant in discovering it.
  • D- The extent of the damages that would have resulted from the effects of the violation if it had not been reported.
  • E- The availability of the information contained in the report, and whether it is publicly accessible or not.
  • F- The level of cooperation of the informant; in case of communication with him.
  • G- The extent of the informant’s contribution in persuading other parties to cooperate regarding the subject of the report; if any.

1- All information provided to the Authority pursuant to these rules shall be considered confidential.

2- The Authority shall ensure the confidentiality of the reports submitted to it and shall not disclose any information related thereto except within the limits permitted by the law, especially concerning the identity of the informant; it shall take all necessary measures to achieve this.

3- The Authority has the right not to disclose the measures taken regarding the reports submitted to it and the results it has reached in this regard.

1- The Authority shall take whatever procedural measures it deems appropriate against anyone proven to have submitted a malicious report; provided that such measures include referring the reporter to the competent authorities.

2- Any procedure stipulated in the rules may be carried out using electronic and technological means.

3- The Governor shall issue what is necessary to implement these rules.

4- These rules shall come into effect from the date of their publication on the Authority’s website, and all provisions that conflict with them are hereby repealed.