KSA Telecommunications & Information Technology Act
The Communications, Space, & Technology Commission (CST), previously known until 2022 as the Communications & Information Technology Commission (CITC), is the authority responsible for regulating activities within the telecommunication and information technology sectors in KSA.
Until recently, the telecommunications sector in KSA was governed by the Telecommunications Law issued by Royal Decree No. (M/12) of 12/03/1422H (3 June 2001) and its By-Laws, which generally prohibited the provision of telecommunications services or operating (or connecting to) a public telecommunications network without first obtaining a license from the CST. The licensing framework was in flux in recent years, with the CST taking several different approaches and offering a variety of “Class” licenses authorizing specific types of activity. To date, the number of fixed and mobile service providers in KSA that have been issued with an “Individual” license remains very limited, however, the CST has issued class licenses to various service providers offering IoT, ISP, VoIP, VSAT, SMS and other specialized services.
The new Telecommunication and Information Technology Act, issued by Royal Decree No. M/106 of 02/11/1443H in June 2022 came into effect on 4 December 2022 (the Telecommunications Act) replacing the previous Telecommunications Law. Implementing regulations for the Telecommunications Act were subsequently issued in November 2022 (the Telecommunications ByLaws).
however, the CST has issued class licenses to various service providers offering IoT, ISP, VoIP, VSAT, SMS and other specialized services.
The new Telecommunication and Information Technology Act, issued by Royal Decree No. M/106 of 02/11/1443H in June 2022 came into effect on 4 December 2022 (the Telecommunications Act) replacing the previous Telecommunications Law. Implementing regulations for the Telecommunications Act were subsequently issued in November 2022 (the Telecommunications ByLaws).
The express goal of the Telecommunications Act is to promote digital transformation in the Kingdom and enhance the services provided within the ICT sector, particularly in light of recent exponential growth. At the same time, the new Telecommunications Act and ByLaws continue to require a license or authorization to provide certain communications or technology services in KSA and, in fact, they have effectively widened the scope of the CST’s regulatory jurisdiction to include additional technology and digital services. Whether these changes advance or hinder these policy goals, therefore, may ultimately depend on the burden created by the CST’s implementation practices.
The most notable changes introduced in the Telecommunications Act include the following:
- ‘Telecommunications’ and ‘Information Technology’ have been given broad definitions to bring a range of new telecommunication and digital services under the scope of the new framework and the CST. While the stated aim of the regulators in this regard is clear, until further guidance is issued by the regulators, the change is likely to leave many service providers operating or looking to operate in KSA uncertain as to whether they would be obligated to obtain licensing and/or authorization from the CST. Regulatory counsel experienced with the views of the CST can assist in clarifying these matters or can seek guidance directly from the CST concerning more complex scenarios.
- In addition to service providers requiring a license for the provision of telecommunication services, service providers that use telecommunication networks to provide telecommunication functionalities are now also required to obtain an appropriate license from the CST.
- Service providers may now obtain a ‘General Class License’ to provide services captured under the Telecommunications Act, provided they also obtain a separate ‘Service Permit’ for each of the captured services. Pursuant to the latest version of the Classification Regulations and the General Class License Regulations issued by the CST in 2024, there are currently 11 categories of services for which service provider may be granted permits by CST, however, this list continues to be updated regularly.
- The CST Board has now been given the authority to require a license, registration or authorization for the provision of any other services related to the telecommunication or information technology sector, above and beyond the activities which may be captured under the current framework. This change is likely to perpetuate regulatory uncertainty as the CST has effectively been granted the power to regulate future technologies in unspecified ways as and when they may emerge into the KSA market.
- The Telecommunications Act now includes specific provisions relating to the processing and protection of user information and confidential documents and places an obligation on service providers to abide by applicable KSA laws and regulations in this regard. These include the data protection regulations and policies issued by CST and the National Cybersecurity Authority, as well as the new KSA Personal Data Protection Law, discussed below.