Saudi Arabia Recording Laws: All-Party Consent Rules and Penalties (2026)

Overview of Saudi Arabia Recording Laws

Saudi Arabia enforces strict recording and surveillance laws rooted in both Islamic legal traditions and modern statutory frameworks. The Kingdom treats unauthorized recording of conversations, phone calls, photographs, and video as serious criminal offenses.

Several overlapping laws govern recording activity in Saudi Arabia. The Anti-Cybercrime Law of 2007 addresses electronic recording and interception. The Personal Data Protection Law (PDPL) regulates how personal data, including recordings, may be collected and processed. The Basic Law of Governance provides constitutional-level privacy protections. Together, these laws create one of the most restrictive recording environments in the Middle East.

Understanding these rules is critical for residents, visitors, business operators, and journalists in the Kingdom. Violations can result in imprisonment, heavy fines, deportation for foreign nationals, and reputational consequences under Saudi social and legal norms.

Saudi Arabia Is an All-Party Consent Jurisdiction

Saudi Arabia follows an all-party consent model for recording. This means every person involved in a conversation, phone call, or interaction captured on audio or video must give their permission before recording begins.

This consent requirement applies broadly. It covers phone calls, in-person conversations, video recordings, photographs of identifiable individuals, and any form of electronic data capture that reveals private information. There is no exception allowing a single participant to secretly record a conversation they are part of.

Article 40 of the Basic Law of Governance (Royal Decree No. A/90, 1992) establishes the constitutional foundation for this rule. It states that telegraphic, postal, telephone, and other means of communication are safeguarded and may not be confiscated, delayed, read, or listened to except in cases defined by statute.

The Anti-Cybercrime Law of 2007

The primary criminal law governing recording in Saudi Arabia is the Anti-Cybercrime Law (Royal Decree No. M/17, 2007). This law criminalizes multiple forms of unauthorized electronic surveillance and recording.

Article 3: Core Recording Offenses

Article 3 of the Anti-Cybercrime Law prohibits the following acts:

• Spying on, intercepting, or receiving data transmitted through an information network or computer without legitimate authorization
• Invading privacy through the misuse of camera-equipped mobile phones or similar devices
• Defaming or harming others through the production, preparation, transmission, or storage of content via information networks or computers

Each of these offenses carries a penalty of imprisonment for up to one year and/or a fine of up to SAR 500,000 (approximately USD 133,000). Courts may impose either or both penalties depending on the severity of the violation.

Article 6: Aggravated Offenses

More serious recording-related offenses fall under Article 6, which covers the production, preparation, transmission, or storage of material that impairs public order, religious values, public morals, or the sanctity of private life. These offenses carry penalties of imprisonment for up to five years and/or a fine of up to SAR 3 million (approximately USD 800,000).

Sharing Recordings Online

The Anti-Cybercrime Law treats the distribution of unauthorized recordings as a separate offense. Posting recorded content on social media, messaging platforms, or websites without consent from all individuals depicted constitutes both a privacy violation and potentially a defamation offense. Saudi authorities have actively prosecuted individuals who share videos or photos of others on social media platforms without permission.

The Personal Data Protection Law (PDPL)

The Personal Data Protection Law (Royal Decree No. M/19, 2021), amended in March 2023 and fully enforced since September 14, 2024, adds a comprehensive data protection layer to Saudi recording regulations.

What Qualifies as Personal Data

Under the PDPL, personal data includes any information that may lead to identifying an individual specifically, or that directly or indirectly makes it possible to identify a person. This definition covers audio recordings, video footage, photographs, biometric data, and any captured content that could identify someone.

Consent Requirements Under the PDPL

The PDPL requires prior, explicit consent before collecting or processing personal data. For recordings, this means:

• The person being recorded must be informed of the purpose of the recording before it begins
• Consent must be documented and stored
• Individuals may withdraw their consent at any time
• If the purpose for the recording changes, new consent is required

PDPL Penalties

The Saudi Data and Artificial Intelligence Authority (SDAIA) enforces the PDPL with significant penalties:

Violation	Maximum Penalty
Disclosing or publishing sensitive personal data with intent to harm	Up to 2 years imprisonment and/or SAR 3 million fine
Violating cross-border data transfer rules	Up to 1 year imprisonment and/or SAR 1 million fine
General PDPL violations	Warning or fine up to SAR 5 million
Repeat offenses	Fines may be doubled

Sensitive Data Categories

The PDPL designates certain data as sensitive, requiring heightened protection. These categories include data revealing racial or ethnic origin, religious or political beliefs, criminal conviction records, biometric or genetic identification data, and health information. Recordings that capture sensitive data face the strictest penalty tier.

Sharia Law and the Concept of Hurma

Saudi Arabia's recording laws do not exist in a vacuum. They are reinforced by Islamic legal principles that have shaped Saudi society for centuries.

The concept of hurma (sanctity or inviolability of private life) is a foundational principle in Islamic jurisprudence. It protects the home, personal correspondence, and private affairs of individuals from intrusion. Several Quranic verses and Hadith explicitly prohibit spying on others, eavesdropping, and spreading private information.

Before the codification of modern privacy statutes, Saudi courts applied Sharia principles directly to privacy disputes. The PDPL explicitly acknowledges this heritage, and judges may still consider Sharia principles when interpreting recording and privacy cases. This dual framework of statutory law and Sharia principles means that unauthorized recording in Saudi Arabia is treated as both a legal violation and a moral transgression.

Phone Call Recording Laws

Recording telephone conversations in Saudi Arabia without the consent of all parties on the call is a criminal offense under Article 3 of the Anti-Cybercrime Law.

Private Individuals

Private citizens may not record phone calls unless every participant has given explicit consent. This applies to both landline and mobile phone calls, as well as voice-over-internet (VoIP) calls made through apps and platforms.

Law Enforcement Interception

The only exception to the consent requirement is lawful interception by government authorities. Under Article 57 of the Criminal Procedure Law, the Public Prosecutor may authorize the monitoring and recording of phone conversations under specific conditions:

• A warrant or reasoned permission from the Public Prosecutor is required
• The interception must relate to an actual crime under investigation
• Authorization lasts a maximum of 10 days, renewable based on investigation requirements
• The interception must be proportionate and necessary

The Saudi Public Prosecution has publicly confirmed that phone conversations may not be intercepted or monitored except in cases specified by law and with proper judicial authorization.

Telecommunications Act Protections

The Telecommunications and Information Technology Act reinforces these protections by requiring service providers to take all necessary steps to protect the confidentiality of users' personal information. Telephone communications and information disclosed over public communication networks are expressly stated to be confidential and may not be accessed, viewed, or recorded unless required by law.

In-Person Conversation Recording

Recording in-person conversations without consent carries the same penalties as unauthorized phone call recording under the Anti-Cybercrime Law. The law makes no distinction between electronic interception and direct recording using a device present during a face-to-face conversation.

Using a hidden recording device, a camera-equipped mobile phone, or any other technology to capture an in-person conversation without the knowledge and consent of all participants violates Article 3 of the Anti-Cybercrime Law. The penalties remain up to one year in prison and/or SAR 500,000 in fines.

This applies equally to audio-only recordings and video recordings that also capture audio content.

Public Places and Photography Rules

Saudi Arabia's approach to recording in public spaces is more nuanced than many expect, but it remains restrictive compared to Western countries.

General Photography

Photography and filming in public places are generally permitted in Saudi Arabia unless a sign prohibiting photography is posted. Tourists and residents may photograph landscapes, architecture, and public scenes.

However, the critical limitation is that you cannot photograph or film identifiable individuals in public without their consent. Even in a public park or market, capturing a person's face or identifying features without permission can trigger Anti-Cybercrime Law penalties.

Restricted Locations

Photography and filming are strictly prohibited in certain locations:

• Military installations and security facilities
• Government administrative offices (without permission)
• Infrastructure facilities including bridges, tunnels, power plants, and oil installations
• Border zones and security installations
• The Holy Mosques in Mecca and Medina during Hajj (photography ban extended in 2025)
• Any location displaying a "No Photography" sign

Commercial Filming Permits

Any filming intended for commercial use, broadcast, streaming, or marketing purposes requires official permits from the General Commission for Audiovisual Media (GCAM) and local municipalities. Content creators, production companies, and businesses must apply for permits before filming. Unauthorized commercial filming can result in equipment confiscation, fines, and potential criminal charges.

Drone Recording

Drone photography and videography face particularly strict regulations. Operations require approval from both the General Authority of Civil Aviation (GACA) and GCAM. Pilots must be registered and certified. Unauthorized drone operations near airports, military areas, or religious sites carry heavy fines and potential jail terms.

Workplace Recording and Employee Surveillance

Saudi labor law and the PDPL create specific rules for workplace recording that both employers and employees need to understand.

Employee Rights

Employees in Saudi Arabia may not secretly record workplace conversations without consent from all parties. The Anti-Cybercrime Law applies in the workplace just as it does in any other setting. An employee who records a meeting, conversation with a supervisor, or interaction with a colleague without permission faces the same criminal penalties.

Employer Surveillance Obligations

The PDPL does not create specific exemptions for employee monitoring. Employers who wish to monitor workplace activity through audio or video surveillance must obtain consent, typically through provisions in the employment agreement.

Saudi law does note that photographing civil servants at their workplace does not constitute a violation of their individual privacy when they are performing their official duties. This narrow exception applies to government employees in the course of their public functions.

Workplace CCTV

Employers may install workplace surveillance cameras subject to the Surveillance Camera Law requirements. Cameras are prohibited in restrooms, changing rooms, prayer rooms, and other areas where employees have a heightened expectation of privacy. Signage informing employees of camera presence is mandatory.

Security Camera and CCTV Regulations

The Law of the Use of Security Surveillance Cameras (Royal Decree No. D/34, 2022), effective April 2023, establishes comprehensive rules for surveillance camera systems across Saudi Arabia.

Mandatory Installation Requirements

The law requires surveillance camera systems in a wide range of facilities:

• All ministries and government agencies
• Oil and gas installations
• Power generation and water desalination plants
• Commercial complexes and shopping centers
• Financial institutions
• Healthcare and educational facilities
• Hotels and tourist accommodations
• Restaurants and event venues
• Mosques
• Streets, roads, and highways

Businesses must have operational camera systems before receiving or renewing operational licenses.

Prohibited Camera Locations

The law strictly prohibits surveillance cameras in locations where privacy expectations are highest:

• Medical examination and procedure rooms
• Changing rooms and washrooms
• Hotel guest rooms and residential accommodation rooms
• Women's lounges and salons
• Physical therapy rooms
• Private residential units (these are exempt from the law entirely)

Signage and Notice Requirements

Facilities with surveillance cameras must display visible signboards at conspicuous locations alerting the public that surveillance cameras are in operation. This notice requirement serves as a form of implied consent.

Data Retention and Access

Recordings must be maintained unaltered and continuously stored. The Ministry of Interior and the State Security Presidency may view live feeds and recordings, and may process and analyze the data. Publishing or transferring recordings requires approval from these agencies, a court order, or an investigative authority request.

CCTV Violation Penalties

Violation	Fine Per Occurrence
Camera not meeting technical specifications	SAR 500 per camera
Camera installed incorrectly or missing signage	SAR 1,000 per camera
Failing to record or retain footage as required	Up to SAR 5,000
Installing cameras in prohibited locations	Up to SAR 10,000
Unlawfully publishing or transferring recordings	Up to SAR 20,000

Facilities classified as high-sensitivity must maintain a direct secure network connection to operation rooms. Medium-sensitivity facilities require an open network connection, while low-sensitivity facilities have no direct connection requirement.

Business Compliance Requirements

Businesses operating in Saudi Arabia face recording-related obligations under multiple laws. Compliance requires attention to both the PDPL and the Surveillance Camera Law.

PDPL Compliance for Businesses

Organizations that record customer interactions, maintain call center recordings, or process any personal data through recordings must:

• Register with SDAIA as a data controller
• Obtain explicit consent before recording customers or visitors
• Provide clear privacy notices explaining the purpose of any recording
• Implement data minimization practices (only record what is necessary)
• Establish data retention policies and delete recordings when no longer needed
• Enable data subject rights including access, correction, and deletion requests
• Appoint a Data Protection Officer if processing large volumes of personal data

Call Recording in Business

Businesses that record phone calls for quality assurance, training, or compliance purposes must inform callers at the start of each call and obtain their consent. Recording without notice violates both the Anti-Cybercrime Law and the PDPL.

Cross-Border Data Transfers

Transferring recorded data outside Saudi Arabia requires compliance with PDPL cross-border transfer provisions. Organizations must ensure the receiving country provides adequate data protection, or obtain explicit consent from data subjects. Violations of cross-border transfer rules carry penalties of up to one year imprisonment and SAR 1 million in fines.

Penalties Summary

Saudi Arabia imposes significant penalties for recording violations across its various laws:

Law	Offense	Maximum Penalty
Anti-Cybercrime Law (Art. 3)	Unauthorized recording, privacy invasion	1 year prison + SAR 500,000 fine
Anti-Cybercrime Law (Art. 6)	Recording impairing public order or morals	5 years prison + SAR 3 million fine
PDPL	Disclosing sensitive personal data with intent to harm	2 years prison + SAR 3 million fine
PDPL	General data protection violations	Warning or SAR 5 million fine
PDPL	Cross-border transfer violations	1 year prison + SAR 1 million fine
Surveillance Camera Law	Various CCTV violations	SAR 500 to SAR 20,000 per occurrence

Repeat offenders under the PDPL face doubled fines. Courts may also order the confiscation of devices used in recording offenses and the destruction of unlawfully obtained recordings.

For foreign nationals, recording violations may also result in deportation proceedings in addition to criminal penalties.

Enforcement and Reporting

Saudi Arabia actively enforces its recording laws. The Saudi Public Prosecution has publicly warned that filming people without consent carries serious consequences.

Individuals who are recorded without consent can report violations to:

• The local police or Public Prosecution
• SDAIA for PDPL-related violations
• The Communications, Space and Technology Commission (CST) for telecommunications interception
• The Ministry of Interior for surveillance camera law violations

When filing a report, authorities recommend collecting evidence such as screenshots, copies of published recordings, witness statements, and any information identifying the person who made the unauthorized recording.

Comparison With Other Gulf States

Saudi Arabia's recording laws are among the strictest in the Gulf Cooperation Council (GCC) region. While all GCC states generally require consent for recording, Saudi Arabia's combination of the Anti-Cybercrime Law, PDPL, Surveillance Camera Law, and Sharia-based privacy principles creates a particularly comprehensive regulatory framework.

The United Arab Emirates has similar cybercrime penalties for unauthorized recording. Qatar and Bahrain also criminalize secret recording. However, Saudi Arabia's PDPL, modeled partly on the EU's GDPR, represents the most detailed personal data protection regime in the Gulf region.