detect·deepfakesby Resemble AI
Deepfake law · Saudi Arabia

Deepfake Law in Saudi Arabia

Saudi Arabia regulates deepfakes under the Anti-Cyber Crime Law, SDAIA's AI Ethics Principles, and the Personal Data Protection Law (PDPL). Strict framework aligned with national security and moral-conduct priorities.

Status
enacted
Jurisdiction
Saudi Arabia
Effective
Sep 2023
Statute
Anti-Cyber Crime Law + PDPL 2021 + SDAIA AI Ethics 2023
Cybercrime (including AI-manipulated content)PrivacyMoral conduct
Updated Apr 16, 2026 · 1 min read

Saudi Arabia regulates deepfakes through a layered framework: the Anti-Cyber Crime Law covers criminal misuse; the Personal Data Protection Law (PDPL) covers biometric data; SDAIA's AI Ethics Principles set governance expectations.

Key provisions

Anti-Cyber Crime Law. Criminalizes:

  • Creating or distributing content that affects public order, religious values, or public morals (deepfake content that triggers these categories is prosecutable).
  • Defamation via digital means.
  • Fraud facilitated by technological means.

Penalties include fines up to SAR 3 million (~$800K USD) and imprisonment up to five years for most offenses, with aggravated cases reaching longer terms.

Personal Data Protection Law (PDPL, effective September 2023). Biometric data — including voice and facial features — protected as sensitive personal data. Unauthorized use for deepfake creation implicates PDPL.

SDAIA AI Ethics Principles (2023). Non-binding but authoritative. Published by the Saudi Data and Artificial Intelligence Authority. Sets expectations around fairness, privacy, transparency, human oversight, and accountability in AI use.

Electronic Transactions Law. Covers fraud including deepfake-enabled CEO or identity fraud.

Enforcement context

Saudi enforcement prioritizes:

  • Content affecting state security, religious values, or public morals.
  • Financial fraud via technological means.
  • Non-consensual imagery, though with moral-conduct law applying to both perpetrator and in some cases victim.

SDAIA and the Communications, Space and Technology Commission (CST) are the primary AI and cybercrime regulators.

Practical implications

For organizations operating in Saudi Arabia:

  • AI service providers: PDPL consent and localization requirements; SDAIA guidance compliance expected.
  • Platforms: CST compliance on takedown orders; strict content-moderation expectations.
  • Enterprises: strong regulatory environment; deepfake-enabled fraud is actively prosecuted.

Sources