App Development Cost in Saudi Arabia: What the Rules Add

App development cost in Saudi Arabia is set by scope, and the scope is almost always longer than the brief. The same app picks up extra work in the Kingdom: an entry on the national personal data protection register, consent and deletion flows written to the PDPL Implementing Regulation, mada acceptance for card payments, National Address fields in every delivery form, and ZATCA e-invoicing if the app raises the invoice. None of it is exotic. It is simply work an international price list does not contain.

Platforms, features, integrations and store fees drive the price of any app, and those are covered in app development cost in Dubai. This guide lists what the Kingdom adds on top, names the authority behind each item, and ends with an illustrative scope example you can hold a quote against.

Why a Saudi build is not a generic build

Four systems do most of the damage to a naive estimate: SDAIA's data protection regime, SAMA's rules on card payments, ZATCA's e-invoicing platform, and the Saudi National Address. Each one lands inside the product, not beside it. A consent withdrawal screen is a screen. A mada test cycle is a release. An address form with six fields is a different form from the one your designer drew.

The second reason is sequencing. The mada Authorization Center has to approve your payment flow and SDAIA has to issue your register certificate before you launch, and those weeks do not compress because your launch date moved.

The requirements that add scope

Data protection is a registration, not just a policy page

SDAIA's National Data Governance Platform runs a register of controllers. Its registration route for private entities asks for an active commercial registration, a representative delegated through the Saudi Business Center with SDAIA selected as the service provider, and sign in through Nafath. The platform then runs an eligibility assessment for appointing a data protection officer under Article 32 of the Implementing Regulation, plus an AI ethics assessment, before issuing the register certificate.

That is admin, not code, but it is admin with a dependency on your app. The DPO question and the register entry both describe what your app actually collects, so they are easier to answer after the data model is agreed and much harder to answer after launch.

The code side comes from the Implementing Regulation itself. Consent must be given freely and not obtained through misleading methods, explicit consent applies to sensitive data, credit data and decisions made solely by automated processing, and the data subject may withdraw consent at any time. Rights requests must be answered within 30 days under Article 3, extendable by a further 30 in limited cases with advance notice to the data subject. Breaches that may harm personal data or data subjects go to the competent authority within 72 hours. Build the audit log and the delete path at the start, because a true delete has to reach the database, the backups and every downstream copy, and adding that after launch means reopening all three.

Card payments run through mada

SAMA's circular on using mada cards online states that payment transactions for electronic stores within the Kingdom must be processed through the national payments system mada, that purchases from stores outside the Kingdom go through international payment companies, and that stores must complete the necessary tests and obtain the required approvals from the mada Authorization Center. Banks were permitted to activate mada cards for online payments from 1 April 2018. That test and approval cycle with the Authorization Center is calendar time rather than developer days, so the payment flow is not finished when the integration passes in your own sandbox.

E-invoicing only matters if the app invoices

ZATCA describes two phases: generation, enforced from 4 December 2021, and integration, which started on 1 January 2023 and rolls out in waves, where the electronic solution must be integrated with ZATCA's systems. The wave announcements set who is next. The twenty-fifth wave covers taxpayers whose VAT subject revenue exceeded SAR 187,500 in 2022, 2023, 2024 or 2025, with integration due no later than 1 February 2027, and ZATCA says later waves are told at least six months before their integration date.

Ask one question before scoping this: does the app raise the tax invoice, or does it hand the order to a system that already does? If the invoice comes from an accounting platform that is already integrated, you are building a clean handover. If the app is the invoicing system, you are building to a technical specification with structured invoices and external clearance, which is a different size of job.

Addresses and Arabic

Saudi Post describes the National Address as six components: building number, street, secondary number, district, postal code and city. An app that stores one free text address string cannot hand a courier the fields it expects, so the six components have to be captured and validated separately.

Arabic is the other one that gets cut and then added back. A right to left pass touches layout, fonts, icons that point in a direction, and every screenshot in the Saudi storefront listing. The National Address is also mostly digits: four for the building, four for the secondary number, five for the postal code. If your Arabic locale shows those as Arabic-Indic numerals, what you store still has to be the digits a courier's system reads.

App development cost in Saudi Arabia: an illustrative scope example

Say a Jeddah retailer scopes version one: browse, order, pay by card, track delivery, plus a staff admin panel. The day counts below are invented to show the shape of the extra work. They are not a quote and not a rate card.

On these invented figures the Saudi work is a bit over a third again on top of the generic build. The number for your app will differ. What should not differ is the practice: ask every provider to quote those additions as separate lines, so a cheaper quote is visibly cheaper for a reason you can see.

The order to do it in

1. Decide which of SDAIA, mada, ZATCA and the National Address version one actually touches. An internal staff app with no payments and no invoices avoids most of this list.
2. Agree the data model, then answer the register questions, because one feeds the other.
3. Start the register and delegation steps while design is still running.
4. Design Arabic and English together, not Arabic afterwards.
5. Build consent, export and destruction with the first release of the backend.
6. Book the mada tests before you need them.
7. Confirm your ZATCA wave position from your own taxpayer notice, not from a blog.
8. Keep the written record of what personal data you store and why that the SDAIA register entry asks for, since the same record is what answers a 30 day rights request.

What commonly goes wrong

• The quote covers screens and a backend, and the PDPL consent records, the destruction path and the mada test cycle arrive later as change requests.
• Delete means hide. The row is flagged inactive but stays in the database and in every backup, so an Article 8 destruction request cannot actually be honoured.
• Arabic is treated as translation, so the right to left layout breaks and the Saudi storefront listing goes live with English screenshots.
• The mada Authorization Center tests are booked in launch week, after the build is finished and the date is public.
• Nobody owns the breach procedure, so the 72 hour clock starts with an argument about who to call.
• The Saudi Business Center delegation is started after the commercial registration has lapsed, so the SDAIA register entry waits behind a renewal nobody put on the plan.

How Quickship scopes a Saudi app

Quickship is a technology company, so what we sell here is the build. The app development service covers iOS, Android and web apps for businesses in Saudi Arabia and the UAE, with screens designed and agreed before development begins, a written scope and a fixed quote before work starts, store publishing, and support after launch. Where an app needs to talk to systems you already run, that sits with custom software development.

Whoever builds it, ask for the register entry, the mada approval cycle and the ZATCA position as named lines in the signed scope. A provider who will not write those three down is not pricing them.