Saudi Arabia's National Cybersecurity Authority (NCA) published its schedule of cybersecurity violations and penalties on 30 October 2026. It lists 26 violations, 21 rated high and 5 medium, with a separate fine range for each company size. Royal Decree M/117 of 21/6/1446H had already capped fines at SAR 25 million and left the amounts to the NCA board. Companies can now read the price of each violation.
Key Highlights
- Top fine: SAR 5 million to 25 million for a large company running a Level 1 cybersecurity activity without an NCA licence.
- Controls: breaching NCA controls costs SAR 15,000 to 5 million depending on size. This covers the Essential Cybersecurity Controls, the private-sector controls, and the cloud, data, telework, social media and operational technology controls.
- Reporting: failing to report a real or potential breach immediately through the Haseen portal costs SAR 10,000 to 500,000.
- Repeat offences: a violation repeated within two years adds 50%, 75%, then 100% to the last fine. The fifth time brings the maximum.
- Reductions: self-reporting takes off 20%, and corrective action before the case reaches the committee takes off 30%.
The Fines by Company Size
Sizes follow the Monshaat classification. Amounts are in Saudi riyals.
| Violation (item number) | Micro (A) | Small (B) | Medium (C) | Large (D) |
|---|---|---|---|---|
| Unlicensed Level 1 activity (1) | 50,000 to 500,000 | 100,000 to 1M | 1M to 5M | 5M to 25M |
| Unlicensed Level 2 activity (2) | 25,000 to 100,000 | 50,000 to 500,000 | 500,000 to 2M | 2M to 10M |
| Other unlicensed activity, breach of controls, misleading information, ignoring NCA decisions and alerts (3, 5 to 17, 19, 25) | 15,000 to 60,000 | 30,000 to 100,000 | 200,000 to 1M | 1M to 5M |
| Breach of licence conditions, refusing information, non-compliant equipment sales, obstructing inspectors (4, 18, 20, 22) | 10,000 to 40,000 | 20,000 to 50,000 | 50,000 to 500,000 | 100,000 to 1M |
| Not reporting a breach or threat immediately (26) | 10,000 to 30,000 | 15,000 to 50,000 | 50,000 to 100,000 | 100,000 to 500,000 |
| Holding non-compliant equipment, not cooperating with inspectors, other breaches (21, 23, 24) | 10,000 to 20,000 | 20,000 to 40,000 | 30,000 to 60,000 | 50,000 to 100,000 |
Some violations also carry separate fines for individuals, from SAR 2,000 to 25,000. Other measures include a warning, a licence suspension of up to one year, licence revocation, and suspension of the service or activity. Licensing fines apply per activity, and equipment fines per category of equipment.
How the Final Amount Is Set
A first offence draws the minimum for the company's size. A first medium-severity offence with no material effect can end in a warning. The fine doubles if the violator made money from the breach, and it can rise by up to 30% if the company owns or operates critical national infrastructure.
The committee can also reclassify. If a violation harms national security, critical infrastructure or government services, it can double the maximum, within the SAR 25 million cap. Going the other way, it can lower the severity, but not below 50% of the minimum.
Under the decree, a committee of at least three members hears the cases. It can order the decision published at the violator's expense and any gains paid to the treasury. Appeals go to the Administrative Court within 60 days of notification. In urgent cases the NCA can suspend an activity at once. It must refer that decision within 3 working days, and the committee then has 10 working days to rule.
Who This Reaches
The private-sector controls (NCNICC-1:2025) sort companies into two groups:
- Category A, large: more than 250 full-time staff or more than SAR 200 million in annual revenue, with 65 controls.
- Category B, small and medium: 6 to 249 staff or SAR 3 million to 200 million in revenue, with 26 controls.
Both apply to the companies "to which the Authority circulates them". So the first question for a company is whether it has received that circular. Note that the letters run in opposite directions: Category A means large in the controls, while (A) means micro in the penalty schedule.
What the Documents Do Not Say
Neither the schedule nor the NCA announcement gives a start date, a grace period or the date the board approved it. The schedule includes a micro column for breaches of controls, while NCNICC starts at six employees or SAR 3 million in revenue. We have not found an official explanation of how the two fit together, so a micro company should ask the NCA or its counsel directly.
What to Do Now
- Check whether the NCA has circulated any controls to your company, and which set.
- Name who owns the Haseen account and who files a report, day or night.
- Keep two clocks in the incident plan. The NCA says "immediately". If personal data is exposed, the PDPL 72-hour rule also applies to SDAIA. Our breach notification deadline calculator works out the SDAIA and EU deadlines, but not the NCA one.
- If you buy security services, ask the provider for its NCA licence where one is required.
The NCA's AI cybersecurity guidelines are a separate document, and our AI security audit for small businesses is a practical starting point for AI systems. If you need your logs and alerts connected to a reporting process that can meet these duties, contact us.
Sources: NCA announcement, the schedule (PDF), Royal Decree M/117 provisions (PDF), NCNICC-1:2025, Okaz