Building a website for a Saudi business in 2026: Arabic-first, mada, ZATCA and the PDPL

Saudi Arabia is the largest market in the Gulf, and the one where a website built for Dubai is most likely to fall flat. The language balance is different, the payment habits are different, the tax regime is stricter, and since 2024 there is a data-protection law with real enforcement. Here is what we change when a client asks us to build for Riyadh, Jeddah, Mecca or Medina rather than for the UAE.

Arabic first, not Arabic too

In the UAE a site can get away with English as the main language and Arabic as a mirror. In Saudi Arabia that is backwards. Most customers, almost all government buyers and the large majority of Google.sa searches are in Arabic. The practical consequences:

• Write the Arabic copy first with a Saudi copywriter, then translate into English. Arabic that was translated from English reads as foreign, and Saudi readers notice within a sentence.
• Make Arabic the default language at the root of the domain and serve English under /en/, the reverse of the usual Gulf setup. Use hreflang="ar-SA" and "en-SA" so Google.sa shows the right version.
• Do Arabic keyword research separately. Saudi spelling and dialect differ from Levantine and Egyptian Arabic, and from the formal Arabic that machine translation produces.
• Choose a typeface designed for Arabic and test it on the phones people use: Cairo, IBM Plex Sans Arabic and Tajawal all work well at small sizes.

Checkout: mada, STC Pay and instalments

Around nine in ten card payments in the Kingdom go through mada, the national debit scheme. A checkout that offers only Visa and Mastercard logos will lose buyers who have a mada card and no credit card. The list Saudi shoppers expect to see:

• mada, through a gateway that supports it natively (HyperPay, Moyasar, PayTabs, Tap, Checkout.com and Shopify Payments all do).
• STC Pay and Apple Pay, both heavily used on mobile.
• Tabby and Tamara for instalments, which lift average order value on anything above a few hundred riyals.
• Cash on delivery, still expected by first-time buyers outside the big cities.

Show the logos on the product page and in the footer, not only at the last checkout step.

VAT at 15% and ZATCA e-invoicing

Saudi VAT has been 15% since July 2020, the highest rate in the Gulf. A VAT-registered business must show its 15-digit VAT number (it starts with 3) on tax invoices and, sensibly, in the website footer. Prices shown to consumers must be VAT-inclusive.

Since the second phase of ZATCA's e-invoicing programme, invoices have to be generated in the approved electronic format and, for larger businesses, integrated with ZATCA's Fatoora platform. If you sell online, your store's invoicing has to produce compliant invoices, which usually means a ZATCA-approved plugin or a connected accounting system rather than the default order email.

The Saudi PDPL

The Personal Data Protection Law (Royal Decree M/19) has been fully enforced since 14 September 2024, with SDAIA as the regulator. For a typical business website it means:

• A privacy policy in Arabic and English that names the lawful basis for each type of processing, retention periods, the rights of data subjects and how to contact you.
• Consent that is specific and recorded, so a pre-ticked marketing box or a cookie banner that only says "we use cookies" does not meet the standard.
• Care with data transfers outside the Kingdom. Hosting on a server abroad is allowed in most cases, but the policy has to say so and the transfer has to meet the law's conditions. Many of our Saudi clients choose hosting in the Kingdom or in a nearby region anyway, for speed.
• A named contact for data requests. Larger organisations need a data protection officer.

Showing you are a real Saudi business

Saudi customers, banks and payment providers look for the same signals:

• Your Commercial Registration (CR) number and the registered Arabic company name in the footer.
• Your e-commerce registration with the Saudi Business Center (formerly Maroof) if you sell online.
• A Saudi phone number (+966) and a WhatsApp button; WhatsApp is the first channel most customers try.
• A physical address in a named city, matching your Google Business Profile, with a Google Maps link.
• LocalBusiness schema with addressCountry: "SA", so Google's map pack and AI assistants can place you.

Local SEO for Riyadh, Jeddah, Mecca and Medina

Saudi search behaviour is city-specific. A dental clinic in Jeddah competes in Jeddah, not nationally, and a hotel near the Haram in Mecca competes for pilgrims searching in a dozen languages. Build a page for each city you serve, in Arabic and English, with the city's name in the title and the first paragraph, its own address and phone number, and its own Google Business Profile. For Mecca and Medina, add the official spellings, Makkah Al-Mukarramah and Al-Madinah Al-Munawwarah, so both forms rank.

A checklist before launch

1. Arabic as the primary language, reviewed by a Saudi speaker.
2. mada, STC Pay, Apple Pay and instalments at checkout; VAT-inclusive prices.
3. 15% VAT number in the footer and ZATCA-compliant invoices.
4. Privacy policy and consent written for the Saudi PDPL.
5. CR number, Saudi Business Center registration, +966 number, WhatsApp and a city address.
6. City pages and Google Business Profiles for each location.
7. Hosting that is fast from inside the Kingdom, and a mobile-first build: well over 80% of Saudi traffic is on phones.

Paste your URL into the GCC Website Checker, choose Saudi Arabia, and it will tell you which of these are missing.