Saudi Arabia Recording Laws: All-Party Consent, PDPL, and Penalties (2026)

Saudi Arabia is an all-party consent jurisdiction: recording any conversation, phone call, or video interaction without every participant's permission violates Article 3 of the Anti-Cybercrime Law (Royal Decree No. M/17, 2007), which carries up to one year imprisonment and a SAR 500,000 fine.

Saudi Arabia Recording Laws: All-Party Consent, PDPL, and Penalties (2026)

Saudi Arabia requires all-party consent before recording any conversation, phone call, or interaction under the Anti-Cybercrime Law of 2007, Article 3 (Royal Decree No. M/17). Unauthorized recording carries up to 1 year imprisonment and a SAR 500,000 fine, with the Personal Data Protection Law (PDPL), fully enforced since September 14, 2024, adding administrative penalties of up to SAR 5 million.

Information last verified on May 15, 2026. This article has not yet been reviewed by a licensed lawyer. It presents general legal information about Saudi Arabian law and is not legal advice. Consult a lawyer licensed in Saudi Arabia for advice on your specific situation.

Jurisdiction scope: This article addresses recording consent law in the Kingdom of Saudi Arabia under the Anti-Cybercrime Law (Royal Decree No. M/17, 2007), the Personal Data Protection Law (Royal Decree No. M/19, 2021 as amended), the Basic Law of Governance (Royal Decree No. A/90, 1992), the Anti-Harassment Law (Royal Decree No. M/54, 1439H), the Law of the Use of Security Surveillance Cameras (Royal Decree No. D/34, 2022), and related implementing regulations. It does not address US state recording laws; for those, see our state-by-state recording laws guide.

Quick Answer: Saudi Arabia Is an All-Party Consent Jurisdiction

Saudi Arabia requires the consent of every person participating in a conversation before any recording may begin. This all-party consent rule applies to telephone calls, VoIP calls, in-person conversations, video recordings, and photographs of identifiable individuals. There is no statutory one-party consent exception that allows a participant to secretly record a conversation without the other parties' knowledge. The rule is grounded in Article 40 of the Basic Law of Governance (Royal Decree No. A/90, 1992), which states that telegraphic, postal, telephone, and other communications are safeguarded and may not be confiscated, delayed, read, or listened to except in cases defined by statute. Criminal enforcement under the Anti-Cybercrime Law of 2007 reinforces this principle. Administrative enforcement under the PDPL, fully operational since September 14, 2024, adds a parallel data-protection layer with its own penalty structure. Together these frameworks make the Kingdom one of the most restrictive recording environments in the Middle East and globally.

The Anti-Cybercrime Law of 2007 (Royal Decree No. M/17)

The primary criminal statute governing unauthorized recording in Saudi Arabia is the Anti-Cybercrime Law (Royal Decree No. M/17, 2007), enacted on March 26, 2007 and amended in 2015. The law applies to conduct carried out through information networks, computer systems, and electronic devices, including smartphones used for audio and video capture.

Article 3: Core Recording and Privacy Offenses

Article 3 of the Anti-Cybercrime Law prohibits:

• Spying on, intercepting, or receiving data transmitted through an information network or computer without legitimate authorization
• Invading the privacy of individuals through the misuse of camera-equipped mobile phones or similar devices
• Producing, preparing, transmitting, or storing material that violates the sanctity of private life

Each offense under Article 3 carries a penalty of imprisonment for up to one year and/or a fine of up to SAR 500,000 (approximately USD 133,000). Courts may impose either or both penalties. The 2015 amendment clarified that the law extends to cloud-stored recordings and content distributed via messaging applications, addressing gaps that appeared when smartphones became widespread.

Article 6: Aggravated Offenses

Article 6 covers the production, preparation, transmission, or storage of material that impairs public order, religious values, public morals, or the sanctity of private life. Unauthorized recordings used to humiliate, extort, or defame individuals frequently fall within this provision. Penalties under Article 6 reach imprisonment for up to five years and/or a fine of up to SAR 3 million (approximately USD 800,000). Courts treat intent and the degree of harm caused as aggravating factors.

Distributing Recordings Without Consent

Posting a recording on social media, messaging platforms, or websites without the consent of all persons depicted is a separate criminal offense under Article 3 and potentially Article 6. Saudi authorities have actively prosecuted individuals who share videos or photographs of others without permission. The Saudi Public Prosecution has publicly warned that filming people without consent carries serious criminal consequences, including jail time and the maximum fine.

Watch out: Sharing even a brief clip of another person in a public setting without their consent can trigger Article 3 liability if their face or identifying features are visible. The act of distribution is independently criminalized from the act of recording.

The Personal Data Protection Law (PDPL) and SDAIA

The Personal Data Protection Law (Royal Decree No. M/19, 2021), amended by Royal Decree No. M/148 dated 05/09/1444 AH (March 2023), entered full enforcement on September 14, 2024 after a three-year compliance grace period. The law is administered by the Saudi Data and Artificial Intelligence Authority (SDAIA).

What Qualifies as Personal Data Under the PDPL

Under the PDPL, personal data means any information that may lead to identifying an individual specifically, or that directly or indirectly makes it possible to identify a person. Audio recordings, video footage, photographs, voice prints, facial recognition data, and biometric identifiers all qualify as personal data when they can identify an individual. This definition means that any audio or video recording of an identifiable person triggers PDPL obligations.

Consent Requirements Under the PDPL

The PDPL requires prior, explicit, documented consent before collecting or processing personal data. For recordings, this means:

• The person being recorded must be informed of the purpose before recording begins
• Consent must be recorded and stored in verifiable form
• Consent must be specific: a general privacy policy acknowledgment is insufficient for recording consent
• Individuals may withdraw consent at any time, and withdrawal must be honored promptly
• If the purpose for which a recording was made changes, fresh consent is required

The SDAIA Executive Regulations (issued alongside the amended PDPL in 2023) specify requirements for data subject rights management, including access, correction, and deletion of personal data, which includes recordings.

PDPL Enforcement Activity (2024-2025)

Since full enforcement began on September 14, 2024, SDAIA has activated its enforcement committees and begun reviewing compliance across organizations. SDAIA is empowered to request documents from controllers, conduct compliance inspections, receive and investigate data subject complaints, and impose administrative penalties. The first enforcement decisions issued by SDAIA's committees in late 2024 and into 2025 addressed unlawful collection and processing of personal data, insufficient security controls, and sending marketing communications without prior consent. Organizations operating call centers, hospitality businesses, and healthcare facilities have been among the first to receive compliance guidance from SDAIA inspectors.

PDPL Penalties

Sensitive Data Categories

The PDPL designates certain categories as sensitive personal data requiring heightened protection: data revealing racial or ethnic origin, religious beliefs, political opinions, criminal records, biometric or genetic data, health information, and financial information. Recordings that capture sensitive data face the strictest penalty tier under the PDPL.

Cross-Border Transfer of Recording Data

Transferring recordings or any personal data outside the Kingdom is governed by the Regulation on Personal Data Transfer Outside the Kingdom issued by SDAIA in August 2024. Key requirements include:

• The recipient country must provide an adequate level of data protection, or appropriate safeguards such as Standard Contractual Clauses or Binding Corporate Rules must be in place
• SDAIA reserves the right to halt any transfer affecting national security or vital Kingdom interests
• Organizations conducting continuous or large-scale transfers of sensitive data must complete a risk assessment under the SDAIA Risk Assessment Guideline for Cross-Border Personal Data Transfers (February 2025)

Violations of cross-border transfer rules carry penalties of up to one year imprisonment and SAR 1 million in fines. The list of countries deemed to provide adequate data protection has not yet been published by SDAIA as of May 2026, meaning organizations should rely on contractual safeguards or explicit data-subject consent in the interim.

The Basic Law of Governance: Constitutional Privacy Foundation

Article 40 of the Basic Law of Governance (Royal Decree No. A/90, 1992) provides the constitutional foundation for Saudi recording restrictions. The article states that telegraphic, postal, telephone, and other means of communication are safeguarded and may not be confiscated, delayed, read, or listened to except in cases defined by statute. This constitutional guarantee predates the 2007 Anti-Cybercrime Law and the 2021 PDPL, establishing privacy in communications as a fundamental right within the Kingdom's governing framework.

Saudi courts may look to Article 40 when assessing the scope of privacy protections in cases where no specific statute directly addresses the circumstances. The Basic Law also incorporates Islamic governance principles, reinforcing the Sharia-based concept of hurma (sanctity of private life) as a parallel source of protection.

The Anti-Harassment Law (Royal Decree No. M/54, 1439H / 2018)

The Anti-Harassment Law was issued on May 31, 2018 and published in the Legal Gazette on 24 Ramadan 1439H (June 8, 2018). It is directly relevant to recording because it criminalizes recording and photography as tools of harassment.

Recording as Harassment

The law defines harassment broadly as any verbal, physical, or electronic act or signal of a sexual nature targeting an individual's body or modesty by any means, including through modern technology and digital platforms. Photographing or filming a person without consent for the purpose of harassment, humiliation, stalking, or sexual targeting constitutes an offense under the law regardless of whether the conduct is also prosecutable under the Anti-Cybercrime Law.

Penalties Under the Anti-Harassment Law

Where a recording-based harassment offense also violates the Anti-Cybercrime Law, prosecutors may charge both statutes simultaneously. Victim identity is protected by statute: the law guarantees the confidentiality of victims' personal information throughout investigation and prosecution.

Workplace Dimension

Employers are required to establish complaint procedures for harassment under the law. Unauthorized recording of a colleague or subordinate for purposes related to harassment, extortion, or intimidation is an aggravated offense. The Anti-Harassment Law complements the PDPL's workplace surveillance provisions: both require consent, and both impose independent penalties for violations.

Sharia Principles and the Concept of Hurma

Saudi Arabia's recording statutes are reinforced by Islamic legal principles that have governed Saudi society for centuries. The concept of hurma (sanctity or inviolability of private life) is a foundational principle in Islamic jurisprudence. It protects the home, personal correspondence, and private affairs from intrusion. Several Quranic verses and Hadith explicitly prohibit spying on others, eavesdropping, and spreading private information without justification.

Before modern privacy statutes were enacted, Saudi courts applied Sharia principles directly to privacy disputes. Judges may still consider Sharia principles when interpreting recording and privacy cases where statutory text is silent or ambiguous. This dual framework means that unauthorized recording in Saudi Arabia is treated as both a legal violation and a moral transgression under the Kingdom's governance system.

Phone Call Recording Laws

Recording telephone conversations in Saudi Arabia without the consent of all parties is a criminal offense under Article 3 of the Anti-Cybercrime Law. This applies to landline calls, mobile calls, and voice-over-internet calls made through any application or platform.

The Lawful Interception Exception

The only exception to the all-party consent rule for phone calls is lawful government interception. Under Article 57 of the Criminal Procedure Law (Ministry of Justice), the Public Prosecutor may authorize monitoring and recording of telephone conversations if:

• A warrant or reasoned authorization from the Public Prosecutor is issued
• The interception relates to an actual crime under investigation
• Authorization is for a maximum of 10 days, renewable upon demonstrated investigative need
• The interception is proportionate and necessary to the investigation

The Saudi Public Prosecution has publicly confirmed that correspondence, letters, and phone conversations may not be intercepted or monitored except in cases specified by law and with proper authorization.

Telecommunications Confidentiality

The Telecommunications and Information Technology Act requires service providers to protect the confidentiality of users' personal information. Telephone communications and information disclosed over public communication networks are expressly confidential and may not be accessed, viewed, or recorded except as required by law. The Communications, Space and Technology Commission (CST) enforces telecommunications confidentiality requirements.

In-Person Conversation Recording

Recording in-person conversations without the consent of all participants carries the same criminal penalties as unauthorized phone recording under Article 3 of the Anti-Cybercrime Law. The statute draws no distinction between electronic network interception and direct device-based recording during a face-to-face interaction.

Using a hidden recording device, a smartphone held discreetly, or any electronic tool to capture an in-person conversation without the knowledge and consent of all participants violates Article 3. Penalties remain up to one year in prison and/or SAR 500,000 in fines. This applies equally to audio-only recordings and to video recordings that also capture audio content.

Recording Police and Government Officials

There is no statutory provision in Saudi Arabia that creates a right to record police officers or government officials while they perform their duties in public. The Anti-Cybercrime Law does not contain a public-official exception. The PDPL does not create a journalism or public-interest carve-out broad enough to cover recording law enforcement in the field.

Saudi law provides a narrow acknowledgment that photographing civil servants at their workplace does not necessarily violate their individual privacy when they are acting in their official capacity. However, this principle does not extend to recording police during enforcement operations, arrests, or security actions. In practice, filming a police officer, soldier, or security force member may additionally attract prosecution under statutes protecting state security, military secrecy, or public order.

Watch out: Foreign nationals filming security operations, checkpoints, or government buildings face particular risk. Detention and device confiscation have occurred in such cases. If documenting a matter of legal necessity (for example, an accident or a crime), ensure the recording does not inadvertently capture identifiable uniformed personnel or government infrastructure. When in doubt, do not film.

Voyeurism and Hidden Cameras

Installing or using a hidden recording device to capture images or audio of individuals in private settings is subject to criminal liability under multiple overlapping statutes.

Criminal Liability

Article 3 of the Anti-Cybercrime Law prohibits invading privacy through the misuse of camera-equipped devices. A hidden camera placed in a restroom, bedroom, changing room, hotel room, or any location where individuals have a reasonable expectation of privacy falls squarely within this prohibition. Penalties are up to one year imprisonment and SAR 500,000 in fines under Article 3, or up to five years and SAR 3 million under Article 6 if the recordings are used to impair morals or the sanctity of private life.

The Anti-Harassment Law independently criminalizes the use of technology, including recording devices, to target an individual's body or privacy in a manner of a sexual nature, with penalties up to two years imprisonment and SAR 100,000.

CCTV Law Prohibition on Hidden Cameras

The Law of the Use of Security Surveillance Cameras (Royal Decree No. D/34, 2022), effective April 2023, explicitly prohibits surveillance cameras in locations where persons have heightened privacy expectations:

• Medical examination, procedure, and therapy rooms
• Changing rooms and washrooms
• Hotel guest rooms and residential accommodation units
• Women's lounges and salons

Installing a camera in any prohibited location carries a fine of up to SAR 10,000 per camera under the Surveillance Camera Law, in addition to any criminal liability under the Anti-Cybercrime Law or Anti-Harassment Law.

SDAIA Deepfakes Guidelines (September 2024)

In September 2024, SDAIA published its Deepfakes Guidelines (Version 1.0) as a practical governance instrument addressing synthetic media risks in the Kingdom. A public consultation ran from September 18 to October 11, 2024. These guidelines are relevant to recording law because they regulate the use of recorded likenesses in AI-generated content.

Key Requirements

The guidelines establish mandatory and recommended standards for deepfake content creators and platform operators:

• Consent: Developers and content creators must obtain explicit, auditable consent from individuals whose voice, face, or biometric data is used to generate synthetic media. Consent records must be stored in a manner that allows later verification.
• Watermarking: All synthetic media must carry a visible, tamper-resistant digital watermark identifying the content as AI-generated. Developers must embed non-intrusive watermarks at the creation stage.
• Documentation: AI model developers must maintain comprehensive documentation including training data provenance, model architecture, and output monitoring logs.
• Privacy frameworks: Developers must comply with both the PDPL and the Anti-Cybercrime Law, treating the generation and distribution of deepfake content as a form of personal data processing.

Governance Structure

SDAIA coordinates national AI policy for deepfakes. Sectoral regulators including the Communications, Space and Technology Commission adopt sector-specific controls. Platform operators implement detection, labeling, and rapid-response workflows. Content created using recordings of real persons without their consent may constitute a violation of Article 3 of the Anti-Cybercrime Law in addition to any violation of the deepfakes guidelines.

Relationship to Vision 2030

The Deepfakes Guidelines form part of Saudi Arabia's broader AI ethics framework, which includes the SDAIA AI Ethics Principles (2023) covering fairness, transparency, accountability, and inclusivity, and the SDAIA Generative AI Guidelines (2024). The Kingdom's Vision 2030 program promotes AI-driven economic development, and these guidelines reflect an effort to balance innovation with privacy protection.

Public Places and Photography Rules

Saudi Arabia's approach to recording in public spaces remains more restrictive than most Western jurisdictions, even as the Kingdom has opened to tourism under Vision 2030.

General Photography

Photography and filming in public places are generally permitted unless a sign prohibiting photography is posted. Tourists and residents may photograph landscapes, architecture, and general public scenes.

The critical limitation is that you cannot photograph or film identifiable individuals in public without their prior consent. Even in a public park, marketplace, or tourist site, capturing a person's face or other identifying features without permission can constitute a violation of Article 3 of the Anti-Cybercrime Law. The all-party consent rule does not relax simply because the setting is public.

Restricted Locations

Photography and filming are prohibited without prior authorization in:

• Military installations and security facilities
• Government administrative offices and ministries
• Infrastructure including bridges, tunnels, power plants, and oil installations
• Border zones and security installations
• The Holy Mosques in Mecca and Medina (with additional restrictions during Hajj)
• Any location displaying a "No Photography" sign

Commercial Filming Permits

Filming intended for commercial use, broadcast, streaming, or marketing purposes requires official permits from the General Commission for Audiovisual Media (GCAM) and relevant municipal authorities. Content creators, production companies, and businesses must secure permits before filming. Unauthorized commercial filming can result in equipment confiscation, fines, and criminal charges.

Drone Recording

Drone photography and videography require approval from both the General Authority of Civil Aviation (GACA) and GCAM. Operators must be registered and certified. Unauthorized drone operations near airports, military zones, or religious sites carry substantial fines and potential imprisonment.

Workplace Recording and Employee Surveillance

Saudi labor law and the PDPL together govern recording and surveillance in the workplace. Neither statute grants employers broad rights to monitor employees without consent.

Employee Obligations

Employees may not secretly record workplace conversations. The Anti-Cybercrime Law applies equally in employment settings. An employee who records a meeting, a conversation with a manager, or an exchange with a colleague without the consent of all participants faces the same criminal penalties as any other unauthorized recorder.

Employer Surveillance

The PDPL does not create an automatic employee-monitoring exemption. Employers seeking to conduct audio or video surveillance of employees must obtain consent, typically through explicit provisions in the employment contract or a documented consent process during onboarding. Blanket monitoring without consent violates the PDPL's consent requirements.

Mandatory and Prohibited CCTV Zones

Under the Surveillance Camera Law (Royal Decree No. D/34, 2022), many commercial facilities are required to install CCTV systems. Cameras are prohibited in restrooms, prayer rooms, changing rooms, and any space where employees have a heightened privacy expectation. Visible signage alerting employees and visitors to camera presence is mandatory.

Security Camera and CCTV Regulations

The Law of the Use of Security Surveillance Cameras (Royal Decree No. D/34, 2022), effective April 2023, establishes mandatory and prohibited camera locations, technical standards, and data retention requirements.

Mandatory Installation Locations

The law requires surveillance camera systems in:

• All ministries and government agencies
• Oil and gas installations
• Power generation and water desalination plants
• Commercial complexes and shopping centers
• Financial institutions
• Healthcare and educational facilities
• Hotels and tourist accommodations
• Restaurants and event venues
• Mosques
• Streets, roads, and highways

Businesses must have operational camera systems in place before receiving or renewing their commercial operating licenses.

Prohibited Camera Locations

Cameras are strictly prohibited in:

• Medical examination, procedure, and physical therapy rooms
• Changing rooms and washrooms
• Hotel guest rooms and residential accommodation units
• Women's lounges and salons
• Any private residential unit (entirely exempt from the law)

Signage Requirements

Facilities operating surveillance cameras must display visible signboards at conspicuous entry and operational points confirming that cameras are in operation. This notice requirement operates as a form of constructive consent for persons entering the premises.

Data Retention and Access

Recordings must be maintained unaltered and stored continuously. The Ministry of Interior and the State Security Presidency may view live feeds and recordings, and may process and analyze the data. Publishing or transferring surveillance recordings externally requires approval from these agencies, a court order, or a formal request from an investigative authority.

CCTV Violation Penalties (January 2024 Clarification)

The Ministry of Interior clarified the penalty schedule in January 2024 following industry requests for guidance:

Business Compliance Requirements

Organizations operating in Saudi Arabia that record customer interactions, run call centers, conduct video surveillance, or process any personal data from recordings must comply with both the Anti-Cybercrime Law and the PDPL.

Core PDPL Obligations for Businesses

• Register with SDAIA as a data controller via the National Data Governance Platform
• Obtain explicit, documented consent before recording customers, employees, or visitors
• Provide a clear privacy notice stating the purpose, legal basis, retention period, and data subject rights before any recording begins
• Implement data minimization: record only what is necessary for the stated purpose
• Establish retention policies and delete recordings when no longer needed
• Respond to data subject requests for access, correction, and deletion within the timeframes specified in the Executive Regulations
• Appoint a Data Protection Officer if processing large volumes of personal data or sensitive data categories
• Notify SDAIA of personal data breaches within 72 hours of discovery

Call Recording in Business Operations

Businesses recording phone calls for quality assurance, training, regulatory compliance, or documentation must inform callers at the start of every call and obtain verbal or written consent. A pre-recorded announcement is the standard industry practice. Recording without notification violates both Article 3 of the Anti-Cybercrime Law and the PDPL's consent requirements.

Penalties Summary

Repeat offenders under the PDPL face doubled fines. Courts may order confiscation of devices used in recording offenses and destruction of unlawfully obtained recordings. Foreign nationals may also face deportation proceedings in addition to criminal penalties.

Enforcement and Reporting

Saudi Arabia actively enforces its recording laws through the Public Prosecution, SDAIA, CST, and the Ministry of Interior. The Saudi Public Prosecution has publicly confirmed that filming persons without consent carries criminal consequences including imprisonment.

Individuals who have been recorded without consent may report violations to:

• Local police or the Public Prosecution (for Anti-Cybercrime Law or Anti-Harassment Law violations)
• SDAIA (via the National Data Governance Platform) for PDPL violations
• The Communications, Space and Technology Commission (CST) for telecommunications interception violations
• The Ministry of Interior for Surveillance Camera Law violations

Evidence useful when filing a complaint includes screenshots, copies of published recordings, device logs, witness statements, and any information identifying the person responsible for the unauthorized recording.

Comparison With Other Gulf States

Saudi Arabia's recording laws are among the most comprehensive in the Gulf Cooperation Council (GCC) region. All GCC states criminalize unauthorized recording to varying degrees, but Saudi Arabia's combination of the Anti-Cybercrime Law, PDPL, Anti-Harassment Law, Surveillance Camera Law, and Sharia-based privacy principles produces an overlapping enforcement regime with no direct equivalent elsewhere in the region.

The United Arab Emirates has parallel cybercrime penalties and a Federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) that entered enforcement in January 2022. Qatar and Bahrain also criminalize secret recording under their respective cybercrime frameworks. However, Saudi Arabia's PDPL, modeled in part on GDPR-style principles, currently represents the most detailed and actively enforced personal data protection regime in the Gulf region.

Disclaimer

This article presents general legal information about recording consent law in the Kingdom of Saudi Arabia. It is not legal advice. The laws discussed include the Anti-Cybercrime Law (Royal Decree No. M/17, 2007), the Personal Data Protection Law (Royal Decree No. M/19, 2021 as amended), the Basic Law of Governance (Royal Decree No. A/90, 1992), the Anti-Harassment Law (Royal Decree No. M/54, 1439H), and the Law of the Use of Security Surveillance Cameras (Royal Decree No. D/34, 2022). Information was last verified on May 15, 2026. Laws change: verify the current in-force text of each statute before relying on this article. Consult a lawyer licensed to practice in Saudi Arabia for advice on your specific circumstances.

Authorities Cited

1. Anti-Cybercrime Law, Royal Decree No. M/17, 2007. https://laws.boe.gov.sa/BoeLaws/Laws/LawDetails/25df73d6-0f49-4dc5-b010-a9a700f2ec1d/2
2. Personal Data Protection Law (PDPL), Royal Decree No. M/19, 2021 (as amended by Royal Decree No. M/148, 1444H / 2023). https://sdaia.gov.sa/en/SDAIA/about/Documents/Personal%20Data%20English%20V2-23April2023-%20Reviewed-.pdf
3. PDPL Executive Regulations (2023). https://sdaia.gov.sa/en/SDAIA/about/Documents/ExecutiveRegulationsEn.pdf
4. Basic Law of Governance, Royal Decree No. A/90, 1992. https://laws.boe.gov.sa/
5. Criminal Procedure Law, Saudi Ministry of Justice. https://www.moj.gov.sa/Documents/Regulations/pdf/En/08.pdf
6. Anti-Harassment Law, Royal Decree No. M/54, 1439H (2018). https://saudipedia.com/en/article/3311/government-and-politics/systems/anti-harassment-law-in-saudi-arabia
7. Law of the Use of Security Surveillance Cameras, Royal Decree No. D/34, 2022. https://saudipedia.com/en/article/3315/government-and-politics/systems/law-of-the-use-of-security-surveillance-cameras-in-saudi-arabia
8. SDAIA Deepfakes Guidelines Version 1.0, September 2024. https://istitlaa.ncc.gov.sa/en/transportation/ndmo/deepfakesguidelines/Documents/SDAIA_Deepfakes%20Guidelines.pdf
9. Regulation on Personal Data Transfer Outside the Kingdom, SDAIA, August 2024. https://dgp.sdaia.gov.sa/wps/wcm/connect/e5bbede0-1119-4f70-b4ef-f043ce58d780/Regulation+on+Personal+Data+Transfer+Outside+the+Kingdom..pdf?MOD=AJPERES&CONVERT_TO=url&CACHEID=ROOTWORKSPACE-e5bbede0-1119-4f70-b4ef-f043ce58d780-p6OMj1M
10. Saudi Data and Artificial Intelligence Authority (SDAIA). https://sdaia.gov.sa/
11. Saudi Public Prosecution Statement on Wiretapping. https://gulfnews.com/world/gulf/saudi/saudi-arabia-public-prosecution-clarifies-law-on-wiretapping-1.74390702
12. Saudi Arabia: Jail Time, SAR 500,000 Fine for Filming People. https://gulfnews.com/world/gulf/saudi/saudi-arabia-jail-time-sr500000-fine-for-filming-people-1.78618999
13. SDAIA Guide to the Saudi Personal Data Protection Law for Controllers and Processors. https://dgp.sdaia.gov.sa/wps/wcm/connect/f579bc32-fda8-47bd-bc6f-66b8cb77985c/ENG-Guide+to+the+saudi+PDP+law+for+controllersprocessors.pdf?MOD=AJPERES

Related Articles

• World Recording Laws Hub
• Saudi Arabia Data Privacy Laws (PDPL)
• UAE Recording Laws
• Recording Laws by Country

---

Last updated: May 15, 2026. Statutes cited reflect their in-force versions as of May 15, 2026.

Frequently Asked Questions

Is it legal to record a phone call in Saudi Arabia?

Recording a phone call in Saudi Arabia without the consent of all parties is illegal under Article 3 of the Anti-Cybercrime Law (Royal Decree No. M/17, 2007). Penalties reach up to one year in prison and a fine of up to SAR 500,000 (approximately USD 133,000). The only exception is lawful interception authorized by the Public Prosecutor under Article 57 of the Criminal Procedure Law, which requires a warrant and may only last 10 days per authorization period.

Can I take photos or videos in public places in Saudi Arabia?

Photography and filming in public places are generally permitted in Saudi Arabia unless a sign prohibits it. However, you cannot photograph or film identifiable individuals without their prior consent even in a public setting. Capturing a person's face or identifying features without permission can result in criminal charges under Article 3 of the Anti-Cybercrime Law. Commercial filming in public areas requires permits from the General Commission for Audiovisual Media (GCAM) and local municipal authorities.

What are the penalties for filming someone without consent in Saudi Arabia?

Filming someone without consent in Saudi Arabia can result in imprisonment for up to one year and a fine of up to SAR 500,000 under Article 3 of the Anti-Cybercrime Law. If the recording impairs public order, religious values, or the sanctity of private life, penalties increase to up to five years in prison and SAR 3 million under Article 6. Sharing the recording on social media or online platforms constitutes an additional and separately charged offense.

Are employers in Saudi Arabia allowed to use surveillance cameras in the workplace?

Saudi employers may install surveillance cameras in the workplace, and many business types are required to do so under the Law of the Use of Security Surveillance Cameras (Royal Decree No. D/34, 2022). However, cameras are strictly prohibited in restrooms, changing rooms, prayer rooms, and other areas where employees have a heightened privacy expectation. Employers must display visible signage and should address monitoring in employment contracts to comply with the PDPL.

Does Saudi Arabia's Personal Data Protection Law (PDPL) apply to audio and video recordings?

Yes. The PDPL, fully enforced since September 14, 2024, defines personal data to include any information that can directly or indirectly identify a person, which covers audio recordings, video footage, photographs, and biometric captures. Organizations recording customers, employees, or visitors must obtain explicit documented consent, provide a purpose-specific privacy notice, and honor data subject requests for access and deletion. Violations can result in fines up to SAR 5 million, with doubled fines for repeat offenses.

Does Saudi Arabia's Anti-Harassment Law cover recording or filming?

Yes. The Anti-Harassment Law (Royal Decree No. M/54, 1439H / 2018) criminalizes any verbal, physical, or electronic act of a sexual nature targeting an individual's body or modesty, including using technology such as cameras or smartphones to film or photograph a person for purposes of harassment or humiliation. Penalties reach two years imprisonment and a SAR 100,000 fine for standard offenses, and five years and SAR 300,000 where the victim is a child or disabled person.

Can I record a government official or police officer in Saudi Arabia?

Saudi law does not provide a general right to record police officers or government officials in the performance of their duties. The Anti-Cybercrime Law contains no public-official recording exception. Filming security operations, military personnel, or government infrastructure may also attract prosecution under state security and public order statutes. Foreign nationals face particular risk of device confiscation and detention. When in doubt, refrain from recording.

What are the rules for AI-generated deepfakes using recorded voices or images in Saudi Arabia?

SDAIA published Deepfakes Guidelines (Version 1.0) in September 2024. The guidelines require explicit, auditable consent before using a person's recorded voice, face, or biometric data to generate synthetic media. All AI-generated content must carry a visible tamper-resistant watermark. Developers must maintain comprehensive documentation. Creating deepfake content using a person's recorded likeness without consent may also constitute a violation of Article 3 of the Anti-Cybercrime Law and the PDPL.

Can businesses transfer Saudi customer recordings outside the Kingdom?

Cross-border transfer of recordings or any personal data out of Saudi Arabia requires compliance with the PDPL Transfer Regulation issued by SDAIA in August 2024. The recipient country must provide an adequate level of data protection, or appropriate safeguards such as Standard Contractual Clauses must be implemented. Ongoing or large-scale transfers of sensitive data also require a formal risk assessment under SDAIA's February 2025 Risk Assessment Guideline. Violations carry penalties of up to one year imprisonment and SAR 1 million in fines.

What should I do if I have been recorded without consent in Saudi Arabia?

If you have been recorded without consent in Saudi Arabia, you may file a complaint with local police or the Public Prosecution for Anti-Cybercrime Law or Anti-Harassment Law violations, with SDAIA via the National Data Governance Platform for PDPL violations, with the Communications, Space and Technology Commission for telecommunications interception, or with the Ministry of Interior for surveillance camera violations. Preserve any available evidence including screenshots, copies of published content, witness information, and device logs before filing.