The short answer: a Saudi government portal is judged against a high national bar. Citizens sign in through Nafath, the unified national access platform; the entity must comply with the National Cybersecurity Authority's Essential Cybersecurity Controls (ECC); the site should meet the Digital Government Authority's web accessibility guideline, built on WCAG 2.1 at level AA; and every service handles personal data under the Personal Data Protection Law (PDPL). Build Arabic-first and mobile-first, integrate with legacy systems through APIs rather than rekeying, and log every transaction so it can be audited. Getting these foundations right at the start costs far less than retrofitting them after launch.
Vision 2030 mandates the digital transformation of Saudi government services. Citizens expect the same seamless digital experiences they get from commercial platforms: instant processing, mobile-first design and Arabic-native interfaces.
The digital government mandate
The Saudi Digital Government Authority (DGA) sets the standards and targets for government digital transformation, and the Kingdom already sits near the top of global rankings: Saudi Arabia ranked 6th of 193 countries in the UN E-Government Development Index 2024, up from 31st in 2022, and 7th in the E-Participation Index. Usage is just as high. The General Authority for Statistics reports that 98.2% of individuals aged 15-74 carried out government services online in 2025. That raises the bar for every new platform: services are expected to be reachable through the unified national portal and mobile channels, to verify identity through Nafath, and to serve Arabic as the primary language with English as secondary.
Who sets the rules
Three national bodies shape the technical requirements for a government portal:
| Body | What it governs | What it means for the portal |
|---|---|---|
| Digital Government Authority (DGA) | Standards for government digital services, including web accessibility | Service design, the national portal, accessibility |
| National Cybersecurity Authority (NCA) | The Essential Cybersecurity Controls and related controls | Architecture, hosting, secure development, authentication |
| Saudi Data and AI Authority (SDAIA) | The PDPL, AI ethics, and the Nafath identity platform | Personal data handling, sign-in, AI features |
The NCA's Essential Cybersecurity Controls (ECC-2:2024) apply to government agencies, including ministries, authorities and establishments, to their affiliated companies inside and outside the Kingdom, and to private operators of critical national infrastructure. For a portal, three groups of controls matter most:
- Web application security (2-15): a web application firewall, a multi-tier architecture, secure protocols such as HTTPS, and authentication factors chosen from an assessment of what a failed or bypassed login would cost.
- Secure development (1-6): secure coding standards, trusted and licensed sources for development tools and libraries, compliance testing of the software against the entity's cybersecurity requirements, and secure integration between applications.
- Cloud computing and hosting (4-2): protection of the entity's data by the provider according to its classification, return of data in a usable format when the service ends, and separation of the entity's environment from other tenants.
The Personal Data Protection Law names public entities as controllers alongside private companies, so a ministry's portal has the same duties to collect only what it needs, secure it and respect data subjects' rights. Its Implementing Regulation requires the controller to notify the regulator within 72 hours of becoming aware of a personal data breach that could cause harm, which means the incident process must be designed before launch, not after the first incident.
Absher and Nafath integration
Most government services require citizen identity verification. Absher is the Ministry of Interior's e-services platform. Sign-in across government and private services runs through Nafath, which SDAIA describes in its Nafath user guide as a national platform for signing on to public and private sector platforms using unique electronic identifiers based on international standards. According to the Saudi Press Agency, Nafath was developed by SDAIA together with the Ministry of Interior, and by November 2024 it had passed 3 billion verifications, served more than 23.5 million users and connected more than 530 government and private platforms.
The sign-in flow shapes your user experience. In the app-based flow described in the user guide, the citizen enters their ID number on your portal, your portal displays a request number, and the citizen confirms the login in the Nafath app. Design for that hand-off: a clear waiting screen, a sensible timeout, an easy retry, and guidance for users switching between a desktop browser and their phone. Integration is arranged with SDAIA, which operates the platform, and requires compliance with its API specifications and security requirements. Resist building a parallel username-and-password system for citizens; it adds attack surface and support load.
Architecture for government portals
Government digital services require a different architecture than commercial applications. Key considerations include:
- Availability: high availability backed by an explicit uptime SLA, with load tests sized for peak periods such as registration windows and deadline days.
- Integration: an API gateway in front of legacy government systems, with message queues so a slow back-end system does not freeze the citizen-facing front end.
- Security: a multi-tier design, multi-level security clearances for staff, and the ECC controls above built in from the first sprint.
- Auditability: complete audit trails for all transactions, recording who did what, when, and on whose behalf.
- Hosting: classify the data first, then choose hosting that meets the ECC cloud controls and any data residency obligations your entity's cybersecurity function sets.
- Arabic-first, mobile-first: right-to-left layouts designed from the start rather than mirrored from English, and every journey completable on a phone.
Accessibility and inclusion
Saudi government portals must be accessible to all citizens, including people with disabilities and older users. The DGA's guideline for web accessibility of government websites builds on WCAG 2.1 with level AA as the baseline, according to Deque's summary of Saudi accessibility requirements. The current W3C standard is WCAG 2.2, and content that conforms to WCAG 2.2 also conforms to 2.1, so targeting 2.2 level AA is a safe superset. Two of its newer criteria, accessible authentication and minimum target size, bear directly on login screens and mobile forms.
In practice that means screen reader compatibility in Arabic, correct right-to-left reading and focus order, keyboard navigation, sufficient colour contrast, and text that can be resized without breaking the layout. Test with real assistive technology and with users, not only with automated scanners.
How to plan the delivery
- 1.Discovery: map the service end to end, including the offline steps, the back-end systems involved and the data each step really needs.
- 2.Prototype and test with citizens: validate the Arabic journey on mobile before building integrations.
- 3.Build in increments: ship one high-volume service first, with Nafath sign-in, audit logging and monitoring in place from day one.
- 4.Assure before launch: cybersecurity testing against the ECC, an accessibility audit, and a load test at expected peak volume.
- 5.Measure after launch: completion rate, drop-off points, processing time and support contacts, published on internal dashboards.
Common pitfalls are designing in English and translating at the end, publishing PDF forms instead of online services, leaving accessibility testing until the week before launch, and underestimating the time needed to integrate with legacy systems.
How Mantiqi can help
Our team delivered the applicant portal, Moodle learning platform and barcode attendance system for Saudi Arabia's National Construction Academy, an institution supporting Vision 2030 workforce goals. We build Arabic-first portals through our web development and mobile app teams, and plan the wider programme through our digital transformation practice. See the wider government sector picture, read our guides to government KPI dashboards and AI agents in Saudi organisations, or contact us to discuss your digital government project.