Saudi e-commerce law sets clear limits on how long sellers can retain your personal data. Under Article 5, unless you and the seller have specifically agreed to a different retention period, the seller may not keep your personal data or electronic records for longer than is necessary to complete the transaction and fulfil any related legal obligations.
This means a seller cannot indefinitely store your payment details, address, phone number, or browsing data without a legitimate reason or your explicit consent to a longer period. The law is designed to protect consumers from unnecessary data accumulation by online businesses operating in the Kingdom.
If you believe a Saudi online store is retaining your data longer than permitted, or using it for purposes beyond the original transaction, you should first contact the seller directly to request deletion of your data. If the seller does not comply, you can escalate the matter to the Ministry of Commerce. It is also worth noting that Saudi Arabia's Personal Data Protection Law (PDPL) provides additional, more detailed rights regarding your personal data, including the right to request access, correction, and deletion of your information.
This is general legal information, not legal advice. For advice on your specific situation, consult a lawyer licensed in Saudi Arabia.