Quick facts for planning a Saudi product
These are the facts that shape most first project plans. Check each one against current official sources before you rely on it.
| Topic | What to know |
|---|---|
| Language | Arabic is the official language. English is widely used in business and technology, so most products need both. |
| Time zone | Arabia Standard Time, UTC+3, with no daylight saving change. |
| Working week | Sunday to Thursday for most organisations. Friday and Saturday are the weekend. |
| Currency | Saudi riyal (SAR). |
| Personal data law | The Personal Data Protection Law (PDPL) and its implementing regulations. SDAIA, the Saudi Data and AI Authority, is the regulator associated with it. |
| National cybersecurity authority | The National Cybersecurity Authority (NCA). Its Essential Cybersecurity Controls (ECC) are the best-known framework. |
| Financial sector | The Saudi Central Bank (SAMA) publishes a Cyber Security Framework for financial institutions. |
| National digital identity | Nafath. |
| Common payment methods | mada debit cards, Apple Pay, Visa and Mastercard cards, digital wallets, bank transfer, buy now pay later and, in some retail, cash on delivery. |
| Calendar | The Hijri calendar (Umm al-Qura) is used for many official purposes, alongside Gregorian dates. |
Every legal or regulatory point on this page is awareness, not legal advice. Laws, regulations and guidance change, so confirm anything that affects your product with qualified local counsel.
Building Arabic-first products for Saudi users
Arabic first means the Arabic interface is designed first, not translated at the end. Line length, line breaks, numbers, icon direction and form order all change in a right-to-left layout, and fixing them late is where budgets slip. Our Arabic and RTL design service and the guide to bilingual Arabic and English products describe the method.
Write for the whole Kingdom
Spoken Arabic differs by region, for example Hejazi in the west and Najdi in the centre. Interface copy works best in clear Modern Standard Arabic that every region reads without effort, with a warm tone where the brand calls for it. Keep dialect for marketing lines that a native editor has approved.
Keep English as a full language
Many Saudi professionals move between Arabic and English in one working day, and many residents read English more easily than Arabic. Build a language switch that keeps the user's place, and test every screen in both directions. The glossary entries on localization and RTL design explain the terms.
Start from the phone
Many of your users will meet the product on a phone first. Design the small screen in Arabic before the desktop layout, and check it on mid-range Android devices as well as recent iPhones. See mobile development for how we approach apps.
Data protection: questions to settle early
Saudi Arabia has a national Personal Data Protection Law (PDPL) with implementing regulations, and SDAIA is the regulator associated with it. We build products with laws like this in mind. We do not interpret them for you, and the points below are questions for your counsel, not answers.
- Consent and other legal grounds. Which processing needs consent, what must the request say, and how do you record it? Design the consent screen and its audit trail around the answer, in Arabic and English.
- Retention. How long may each kind of data be kept, and how is it deleted or anonymised on a schedule?
- Cross-border transfers. If personal data is stored or processed outside the Kingdom, including by an analytics, email or support tool, what conditions apply? List every third-party service that receives personal data.
- Hosting location. Does your sector or a customer's contract expect data to stay in the Kingdom? Some cloud providers offer regions there, and the list changes, so check the current one.
- People's rights. How will someone ask to see or correct their data, and who answers?
- Notices and incidents. What must the privacy notice say, in which language, and who must be told if something goes wrong?
A one-page data map helps counsel and engineers alike: what you collect, why, where it is stored, who can reach it and which outside services receive it. We draw one during threat modelling, and it gives counsel the facts to answer the questions above. The guide to launching software in the Gulf shows where these decisions sit in a wider launch plan.
Cybersecurity expectations
Many Saudi organisations work in the context of the National Cybersecurity Authority (NCA) and its Essential Cybersecurity Controls (ECC), and the NCA publishes further controls for areas such as cloud services. Financial institutions also work with the Cyber Security Framework from the Saudi Central Bank (SAMA). Whether a given control reaches your project is a question for the client's security team and counsel.
For a software supplier the effect is practical. Expect security questionnaires, requests for evidence that you test and fix, questions about hosting and who can access data, and contract clauses that pass a control down to you.
We do not promise compliance with any framework and we do not claim any certification. What we give your team is the material these reviews ask for: a threat model of the core flows, secure code review, and a security review before launch with a prioritised fix list. Where the risk justifies it, we add penetration testing. The secure-by-default web checklist shows the baseline.
Payments and identity
Payment methods
Saudi shoppers expect local methods. The national debit network is mada, and Apple Pay and international cards sit alongside it, with digital wallets, bank transfer and buy now pay later providers at many stores. Your audience and what your payment provider supports decide which methods you need.
Integrate through a provider that supports those methods, and use its hosted payment page or fields so card numbers never reach your servers. Ask the provider about its licensing for the Saudi market and the card-industry standards it holds. Our ecommerce development page covers the order flow around it.
Invoicing
If your product issues invoices, the tax authority (ZATCA) has electronic invoicing rules that software must follow. Ask your tax adviser which requirements apply before you design the invoice flow.
Signing in with Nafath
Nafath is the national digital identity sign-in. For government-facing and regulated services, users may expect to confirm who they are with it. Access is controlled by the issuing authority, so ask early what approval your product needs and how long it takes, because it can be the longest dependency on the plan. Keep your own sign-in, with multi-factor authentication, for users and cases it does not cover.
The working week, the calendar and launch timing
Most Saudi organisations work Sunday to Thursday, with Friday and Saturday as the weekend. Plan demos, releases and support cover on that week. A Thursday release lands just before the weekend, when your own team is least able to react, so Tuesday or Wednesday is usually calmer.
Saudi Arabia uses the Hijri calendar (Umm al-Qura) for many official purposes and Gregorian dates for much of commercial life. Decide for each date field which one the user sees, and whether to show both. Store dates in one standard form and convert them for display.
Ramadan changes working hours and usage patterns: many organisations shorten the day, and evening activity rises. The start of Ramadan and the dates of Eid depend on moon sighting and are announced shortly before, so a holiday date can move by a day. Do not tie a launch, a campaign or a deadline to a Hijri date months ahead without a buffer.
National Day (23 September) and Founding Day (22 February) bring their own campaigns, and retail promotions gather around White Friday, Ramadan and Eid. If you run a store, load test and freeze code changes before those peaks.
How we work with Saudi teams remotely
We work remotely with clients and plan calls around your working day, so a weekly demo lands inside your Sunday to Thursday week. A project starts with a short call or a brief, then a scope and an estimate that cover design, build, security and timeline, then a build with a demo every week. Briefs, demos and reviews can run in Arabic or English.
If an on-site meeting is needed, ask us what is practical. Read how we work and the engagement models for the detail.
Sectors and what we build
The examples below are hypothetical. They show where the points above matter most.
- Government: a citizen-facing portal needs Arabic-first accessibility, strong identity and an early conversation about hosting.
- Fintech: a payments app needs mada and Apple Pay, strong authentication and the security evidence a financial partner asks for.
- Ecommerce: an Arabic store needs local payment methods, speed on a phone and a plan for the White Friday peak.
- Healthcare: health data is usually treated as especially sensitive, so ask counsel which rules apply to your product.
- Logistics: a driver app needs Arabic and English, address handling and a design that copes with a weak signal.
- Education: a learning platform serves students, parents and teachers with different accounts, and holds data about minors that needs care.
Our services for Saudi Arabia
Two pages go deeper on the services most Saudi projects start with:
- Web development for Saudi businesses: Arabic-first sites and portals, Arabic search, payments, identity sign-in, hosting and accessibility.
- UI/UX design for Saudi businesses: Arabic type and tone, forms, calendars, payment flows and remote research in Arabic.
Across all six services we offer: UI/UX design, web development, mobile development, no-code, CMS solutions and cybersecurity. For the neighbouring markets, see the UAE and Qatar.