Saudi E-commerce Law 2026 and Maroof: What Your Store Must Comply With

Your Online Store and the E-commerce Law: What Are You Legally Required to Do?

If you sell products or services online in Saudi Arabia — through a website, an app, or even a social media account — you fall under the E-commerce Law. In short: the law requires you to disclose your commercial identity, show a clear price including VAT, publish a written return policy, protect your customers' data, and register on the Maroof platform. Violating it can cost you a fine of up to SAR 1 million plus suspension of your activity or blocking of your store. This article explains what your store actually needs, in a business owner's language rather than a lawyer's.

What Is the E-commerce Law and Who Does It Apply To?

The E-commerce Law was issued by Royal Decree No. (M/126) dated 7/11/1440H (July 2019), followed by the Implementing Regulations from the Ministry of Commerce that spelled out the practical obligations on service providers and intermediary platforms. The law applies to every "service provider" practising e-commerce inside the Kingdom, and it even extends to traders outside the Kingdom who target the Saudi consumer. That means both the small Instagram shop and the large store on a standalone platform sit under the same umbrella — there is no minimum sales threshold that exempts you.

Disclosure Obligations: What Must Appear in Your Store?

The heart of the law is transparency. Before purchase, the customer must see enough information to make an informed decision, most importantly:

• Store identity: the trade name, a working contact (phone or email), and the commercial registration number where applicable.
• A clear price: the total price including VAT and shipping fees, with no surprises appearing at checkout.
• An accurate product or service description: correct, non-misleading specifications and images that genuinely represent the product.
• Return, exchange, and refund policy: written, clear, and shown before the order is completed, not after.
• Delivery terms: the expected delivery time and how delays are handled.

Missing any of these is not merely a poor customer experience; it is a punishable regulatory violation.

The Maroof Platform: Why Registering Is Not Really Optional

The Maroof platform, run by the Ministry of Commerce, is the national register of online stores. Registering authenticates your store and gives customers a way to verify your credibility and read previous buyers' ratings. In practice, many payment gateways and shipping solutions ask for Maroof verification, and its absence weakens customer trust and raises cart abandonment. Treat Maroof registration as a foundational step, not a nice-to-have you postpone.

The Customer's 7-Day Return Right

The law gives the consumer the right to return a product or cancel the contract within a set period (7 days) in the cases it specifies, unless the product has been consumed or falls into an excluded category. Your store must keep its policy aligned with this right and display it clearly; trying to work around it with phrases like "no returns" may be considered a violation rather than a protection.

Protecting Customer Data — The Link to the PDPL

The law requires you to protect your customers' personal data and not use it for any purpose other than the one it was collected for. This obligation intersects directly with the Personal Data Protection Law (PDPL), supervised by the Saudi Data and AI Authority (SDAIA), which mandates clear consent, data security, and enabling the customer to exercise their rights. In practice: collect no more data than you need, secure your database, and publish a genuine privacy policy rather than a cosmetic one.

E-invoicing and VAT

If your revenue exceeds the statutory registration threshold, you must register for VAT and issue electronic invoices under the "Fatoorah" system of the Zakat, Tax and Customs Authority. Compliance here is technical by nature: your store needs a proper integration that issues a compliant invoice for every sale, not scattered manual workarounds.

Penalties: What Does Non-Compliance Cost?

Penalties for violating the law reach a fine not exceeding SAR 1 million, with the possibility of suspending the e-commerce activity temporarily or permanently and blocking the store wholly or partially in coordination with the relevant authorities. The penalty is doubled for repeat violations. The message to every store owner is clear: compliance is far cheaper than violation.

A Quick Compliance Checklist

• Register your store on Maroof and display the verification badge.
• Show your commercial identity and a clear contact channel.
• Display the price including VAT and shipping, with no surprises.
• Publish a return and refund policy aligned with the 7-day right.
• Enable e-invoicing compliant with the Zakat, Tax and Customs Authority.
• Issue a privacy policy and secure customer data per the PDPL.

How Origami Helps

At Origami, we are a technology company that builds online stores and custom systems that are compliant by design: Maroof and payment-gateway integration, e-invoicing wired into the Zakat, Tax and Customs Authority, transparent pricing and return policies, and a data architecture that respects the Personal Data Protection Law. For us, compliance is not a burden we bolt on later; we design it into the product from day one to protect you and build your customers' trust.

Official Sources

• Ministry of Commerce — E-commerce Law and regulations: mc.gov.sa
• Maroof platform: maroof.sa
• Zakat, Tax and Customs Authority (e-invoicing and VAT): zatca.gov.sa
• Saudi Data and AI Authority (SDAIA) — Personal Data Protection Law: sdaia.gov.sa