The Communications and Information Technology Commission issued a document regulating the provision of digital certification services in the Kingdom of Saudi Arabia based on what is stated in the Electronic Transactions Law issued by Royal Decree No. (M/18) dated 8/3/1438 AH, Article fifteen, which stipulates that the Commission shall implement the Electronic Transactions Law.

The Commission aims, through this document, to organize the service in accordance with the specific competencies defined in the aforementioned Electronic Transactions Law, without prejudice to what is issued by the relevant competent authorities. The document regulating the provision of digital certification services includes general and specific provisions for licenses to provide digital certification services, as well as the conditions and requirements for obtaining the license related to providing digital certification services in the Kingdom of Saudi Arabia (the Kingdom). The Commission will publish it from time to time as needed to offer more of this license, as detailed in paragraphs (9-2) and (9-3) of this document.
The Commission issues this regulatory document in its third version, amending the second edition, which was issued under the Commission's decision No. (1442/455) dated 15-5-1442 AH, with the aim of updating the validity period of the license and the approved date mechanism.

2-1 The words and phrases defined in the Electronic Transactions Law and its Executive Regulations shall have the same meaning when used in this document. 

• 2-2 The words, terms, and phrases defined in the Authority's regulations shall have the same meaning when used in the document "Regulations for Providing Digital Certification Services" ("the Regulations"): However, the following words and phrases shall have the meanings specified below unless the context requires otherwise:

  • 2-2-1 "The Center" means the National Center for Digital Certification (www.neda.gov.sa)

  • 2-2-2 "Digital Certification Services" are electronic data systems specifically designed to operate independently or in participation with other electronic data systems to create an electronic signature, verify the identity of electronic participants, obtain their consent for electronic transactions, and detect any modifications made to this electronic transaction.

2-3 "The User" or "The Beneficiary": means any person who uses or benefits from the services provided by the service provider in accordance with the terms and conditions set forth in this service license.
2-4 "Digital Certification Service Provider": means the entity licensed to provide digital certification services or any related service or task in addition to electronic signatures in accordance with the Electronic Transactions Law.

2-5 "Registration Center": the entity responsible for the registration process and verifying the identity of applicants for digital certificates.
2-6 "Business Plan": means the plan that includes the technical and commercial details provided by the applicant.
2-7 "License": means the license to provide digital certification services.

This regulatory document applies to providers of digital certification services.

1-4 The license to provide digital certification services allows the licensee to offer "digital certification services," which consist of issuing digital certificates or related services from the National Center for Digital Certification.
2-4 The service operates through a digital certification certificate issued by the certification service provider, which is included in an electronic transaction logically associated with it, enabling users of various categories via the Internet to perform various electronic operations with privacy, confidentiality, and reliability.

• 3-4 The National Center for Digital Certification is an entity affiliated with the Ministry of Communications and Information Technology, established under the Electronic Transactions Law. Its role under this law and its executive regulations is to supervise tasks related to issuing digital certification certificates and managing the digital certification infrastructure. In order to fulfill this mandate, it may undertake the following:

  • 1-3-4 Provide a comprehensive system for managing the public key infrastructure aimed at preserving the confidentiality of information and verifying the identity of the parties involved, in addition to maintaining the integrity of data from tampering and alteration.

  • 2-3-4 Manage, operate, and maintain the hardware and software related to the public key infrastructure.

  • 3-3-4 Issue digital certificates for digital certification centers in the Kingdom and carry out procedural tasks for those certificates such as cancellation, renewal, and acknowledgment of their validity, among others.

  • 4-3-4 Publish a list of licensed certification service providers and work on continuously updating it.

  • 5-3-4 Develop standards and requirements for the public key infrastructure and coordinate this with the relevant authorities.

  • 6-3-4 Coordinate with the authority regarding the licensing of entities wishing to provide licensed certification services.

  • 7-3-4 Provide technical support to the authority concerning its supervision of digital certification service providers.

  • 8-3-4 Notify the authority of any violations related to the licenses of digital certification service providers.

1-5 Unless otherwise specified in the future in any of the Authority's regulations or related laws: The licensee providing digital certification services must comply with the document titled "Regulations for Providing Digital Certification Services" (this document), the Electronic Transactions Law and its executive regulations, and the decisions and guidelines issued by the Authority.

2-5 The obligations of the licensee in providing services to users (beneficiaries) and the public are subject to the provisions contained in the Authority's regulations, the provisions of this document, the Electronic Transactions Law and its executive regulations, and any decisions, guidelines, and regulations issued by the Authority and other applicable laws in the Kingdom.

3-5 The relationship between the licensee and the users is subject to the Authority's regulations and the provisions of the Electronic Transactions Law and its executive regulations, the terms and conditions of the license, in addition to the texts of the announcements issued by the licensee that do not conflict with or are consistent with the Authority's regulations.

4-5 The licensee is obligated to submit periodic reports to the Authority and provide any other information requested by the Authority, which will specify the types of those reports, the nature of the required information, and the time for submission.

5-5 The licensee must adhere to high-quality performance levels that comply with recognized international standards, along with complying with what the Authority stipulates in this regard in the future.
6-5 Implement all obligations stipulated by the Authority's regulations and the provisions of the Electronic Transactions Law and its executive regulations, including the continuous provision of services and working on their development and improvement in line with the objectives of the law.
‏7-5 Implement all decisions, controls, and instructions issued by the Authority and other official entities regarding the provision of digital certification services, and comply with them.
8-5 Inform beneficiaries (users) of the digital certification services covered by the provisions of Article Twenty-Two of the Electronic Transactions Law regarding the responsibilities of the certificate holder.
9-5 The digital certification policy issued by the National Center for Digital Certification.
10-5 The privacy policy issued by the National Center for Digital Certification, which can be viewed on the Center's website (www.ncdc.gov.sa), and the protection of the privacy of subscribers and their accounts.

11-5 Compliance with any amendments or additional requirements for the services provided as determined by the Authority or the Center, as necessitated by regulatory rules and in a manner that serves the interests of the beneficiaries (users).

12-5 Provide the service to beneficiaries without discrimination.

13-5 Provide digital certification services according to the service deployment plan.

14-5 Ensure the accuracy of the certified information contained in the certificate at the time of delivery, and the accuracy of the relationship between the certificate holder and its electronic data, and the certificate holder shall be liable for any harm caused to any person who relied - in good faith - on the accuracy of that information.
15-5 Appoint a sufficient number of employees in the registration centers who possess expertise in information technology and its security, provide services to beneficiaries, and establish a call center that operates around the clock to handle emergencies and certificate cancellations. The employees responsible for registering certificates and verifying the identity and data of subscribers must be citizens.

16-5 All devices, software, and servers used in digital certification procedures must be located within the Kingdom.

17-5 Provide the Authority and the Center with all required information.

18-5 Provide the necessary facilities for the Center or its delegate to conduct audits according to the auditing procedures approved by the Center.
19-5 Submit periodic reports every six (6) months or as requested by the Center regarding the services provided, including the number of registered beneficiaries.
20-5 Notify the Center immediately of any emergency issue, such as a breach of the service provider's system or other problems that may affect the services of the users.

• 21-5 The annual fees for issuing the digital certificate are determined as follows:

  • 1-21-5 The cost of issuing a regular digital certificate for individuals shall not exceed 100 Saudi Riyals.

  • 2-21-5 The cost of issuing a regular digital certificate for companies shall not exceed 1000 Saudi Riyals.

22-5 Issue the digital certificate to the subscriber within a maximum of five (5) working days from the date of the subscriber's application.

23-5 Cancel the digital certificate upon receiving a cancellation request from the subscriber according to the procedures specified by the Center in coordination with the Authority.
24-5 User data (such as contact numbers or email addresses, or numbers generated by them) may not be shared with any third party or used for any commercial purposes such as sending advertisements.
25-5 The service provider shall retain user data for no less than 12 calendar months.
26-5 The Center provides its services to licensed entities free of charge during the initial service authorization period (the first five years), and fees may be added to cover the Center's costs after the initial service authorization period ends.
27-5 All claims related to confidentiality and the processing of all confidential information are subject to the regulatory rules of the Authority and the provisions of the Electronic Transactions Law and its executive regulations.
28-5 The service provider must act with integrity and in good faith, without discrimination between users, while ensuring the preservation of their privacy.
29-5 The service provider must clearly state - in advance - the financial compensation and characteristics of the services it offers to those wishing to obtain them before they use them.
30-5 The service provider must comply with copyright and other rights according to the relevant regulatory rules when providing any programs to users, ensuring that the service provider obtains the Authority's approval and the approval of the relevant entities before providing the service.

31-5 The service provider must provide the necessary equipment to deliver the service according to the technical standards approved by the Authority and the Center, and the use of that equipment is limited to providing the services covered by this license.
32-5 The service provider may not use the contact numbers or email addresses of users that they provided or disclosed to him for any purpose, such as using them in advertising campaigns or selling databases available to the licensee that contain these numbers and addresses to another party without prior consent from the owner.

33-5 The service provider provides the technical capabilities in the devices and materials of its network used to connect its devices and equipment, and the special requirements form for operating and using the network must be filled out and signed.
34-5 The service provider must provide the technical capabilities in the devices and materials of its network that can be used to identify user data for reference when needed for no less than twelve (12) calendar months or as determined by the Authority.

1-6 The licensee who has obtained a license to provide digital certification services in accordance with this document is obligated to launch the services to the public within twelve (12) Gregorian months from the date of issuance of the license.
 

1-7 The duration of this License shall be two (2) Gregorian years starting from the date of its issuance.
2-7 The License shall be renewed at least ninety (90) days before the end of its term. In the event of a desire not to renew the License, to cancel it, or to waive it, the licensee is obligated to provide the center with a plan detailing the procedures to be taken within a period of no less than ninety (90) days.
 

• 1-8 The licensee shall pay the following financial fees:

  • Financial fee for issuing the license (1,000) one thousand Riyals.

  • Annual financial fee for the license (10,000) ten thousand Riyals.

  • Financial fee for any works or services that may be provided by the authority in accordance with its regulations.

2-8 The authority shall determine the method of issuing invoices for the financial fees, the method of payment, the periods of issuance, and the details of the payment that the licensee is obligated to comply with after being notified, unless otherwise specified according to the authority's regulations.
3-8 The financial fee is due immediately upon the issuance of the invoice.
 

1-9 Obtaining a digital certification license from the Authority is required to provide digital certification services. 

2-9 The Authority has the right, at its sole discretion and in accordance with its regulations, in coordination with the National Center for Digital Certification, to determine the number of licenses for providing digital certification services as needed.

3-9 The Authority has the right, at its sole discretion and in accordance with its regulations, to coordinate with the National Center for Digital Certification to increase or decrease the number of licenses whenever it deems necessary.
4-9 The licensee may, after obtaining prior written approval from the Authority, waive the license, provided that the assignee meets all regulatory, technical, financial, and commercial requirements to obtain the license, in accordance with what the Authority decides and in line with its regulations.
5-9 The licensee may not contract with other parties to provide the services licensed to be provided under the license issued to them by the Authority, or to provide them on their behalf; except with written approval from the Authority.

6-9 The Authority may revoke or suspend the license in accordance with its regulations and the provisions of the Electronic Transactions Law and its Implementing Regulation in the event that the licensee commits any cause for that, and the licensee alone bears full responsibility arising from that, without the Authority bearing any consequences or liabilities resulting from the revocation or suspension of the license.

7-9 The licensee must, when wishing to cancel the license, submit a written request to the Authority and comply with the provisions of Articles Sixteen and Eighteen of the Implementing Regulation of the Electronic Transactions Law.
‏8-9 Violations and fines related to the license are processed in accordance with the Authority's regulations and the provisions of the Electronic Transactions Law and its Implementing Regulation.
9-9 The Authority shall, from time to time, review and amend this document whenever it deems necessary; in accordance with the Authority's regulations. The updates that occur shall be approved by the Authority's Governor.
 

1-10 Taking into account the provisions of paragraphs (9-2) and (9-3) of this document, the Authority shall coordinate with the National Center for Digital Certification in publishing the document titled "Conditions and Requirements for Obtaining a License to Provide Digital Certification Services" on its website (www.citc.gov.sa).
2-10 The document "Conditions and Requirements for Obtaining a License to Provide Digital Certification Services" is approved by the Governor of the Authority.