How to Run a Web Agency RFP in Saudi Arabia

A good website RFP in Saudi Arabia sets out clear business goals, a defined scope, Arabic and English requirements, integration and security needs, and transparent evaluation criteria, then runs a fair process from qualification to contract. Done well, it gives agencies enough information to propose realistically and gives your procurement team a defensible basis for choosing. This guide walks through each stage.

Enterprise and mid market organisations in Riyadh, Jeddah and Dammam increasingly treat their website as a business system rather than a brochure. It connects to CRM, ERP, payment gateways and customer portals, and it carries brand and regulatory risk. That makes vendor selection more important and more complicated. The steps below apply to private sector buyers; government entities follow their own formal procurement rules, which take precedence.

Before you write the website RFP

Most weak RFPs fail before they are written. The organisation has not agreed internally what it wants, so the document tries to cover every opinion and ends up vague. Spend time on alignment first.

Agree the business case

• What problem should the new website solve: lead generation, online sales, customer self service, recruitment, investor relations or brand?
• Which measures will show success, such as qualified enquiries, completed bookings or reduced call volume?
• Which departments depend on the site, and who will own it after launch?
• What is the realistic budget range and the decision date?

Form a small evaluation committee

Include marketing, IT or digital, procurement, information security and one senior sponsor who can break ties. Keep it to five or six people. Larger committees slow decisions and dilute accountability.

Consider a request for information first

If the project is large or the scope is uncertain, a short request for information can help. It asks a wider group of agencies about their approach, experience and capacity, without asking for full proposals. You then invite a shortlist to the full RFP.

What to include in the RFP document

A clear structure helps agencies respond consistently and makes comparison easier. Most effective documents follow a pattern like this.

1. Background. Who you are, your audiences, and why you are running this project now.
2. Objectives. The business outcomes the site must support, ranked by priority.
3. Current state. Existing platform, hosting, traffic patterns, content volume, integrations and known problems.
4. Scope. Functional and technical requirements, content and migration, design, languages, accessibility and SEO.
5. Non functional requirements. Performance, security, availability, hosting location and data handling.
6. Deliverables and phases. What you expect at discovery, design, build, testing, launch and support.
7. Submission instructions. Format, deadline, question window and contact person.
8. Evaluation criteria. How proposals will be scored.
9. Commercial terms. Payment structure, contract template, intellectual property and warranty.

Write requirements, not solutions

Describe what users must be able to do, not how to build it. "Customers must be able to book and reschedule appointments in Arabic or English, with confirmation by SMS and WhatsApp" is better than "build a booking module in a named plugin". Requirements written this way invite agencies to propose their best approach and make it easier to compare.

Prioritise clearly

Mark each requirement as must have, should have or could have. Agencies can then price a core scope and options, and your team can trade features against budget without restarting the process.

Saudi specific requirements to state clearly

Several points are often left implicit and then cause disputes later. Put them in writing.

• Arabic first design. Arabic and English versions with right to left layouts designed properly, not mirrored as an afterthought.
• Content and translation. Who writes, translates and enters content, and in which language it originates.
• Data protection. How the site will handle personal data in line with the Personal Data Protection Law overseen by SDAIA, including forms, cookies and vendors.
• Hosting location. Whether data must be hosted in the Kingdom or a specific region, based on your own policies and legal advice.
• Cybersecurity controls. Whether your organisation follows NCA controls and what that means for the vendor.
• Payments. Required methods such as mada, Apple Pay, STC Pay or buy now pay later options like Tabby and Tamara.
• E invoicing. Whether the site or commerce platform must connect to systems that support ZATCA e invoicing.

Regulatory points like hosting and data transfer depend on your sector and status, so confirm them with your legal team or the relevant regulator before you finalise the document.

Integrations and the data behind the website

For enterprise buyers, integrations are often the riskiest part of a web development tender. A website that looks right but cannot reliably exchange data with internal systems will frustrate customers and staff alike.

Describe each integration

Where integrations are complex, consider a paid discovery phase before fixing the build price. It reduces guesswork on both sides. Projects that are really software platforms rather than websites may suit a custom software approach, and projects moving from an old platform should include a dedicated site migration plan covering URLs, redirects and content.

Vendor qualification and references

Vendor selection website projects benefit from a two stage filter: qualify first, then evaluate in depth.

Qualification questions

• Is the company legally able to contract with you, and in which entity?
• How many people work on delivery, and where are they based?
• Which comparable projects have they delivered, in which sectors?
• Can they show live bilingual sites they built?
• Who would lead your project, and will that person stay on it?
• Which parts of the work, if any, are subcontracted?

Checking references well

Ask for references from projects similar in size and complexity, ideally completed within the last few years. When you call, ask about communication, how scope changes were handled, how problems were resolved, and whether the client would hire the agency again. Visit the live sites yourself and test them on a phone in Arabic.

Security questionnaires and data handling

Your information security team will usually want answers before any vendor touches systems or data. Include a security questionnaire with the RFP rather than after selection, so it influences the decision.

Topics to cover

• Secure development practices, code review and dependency management.
• Access control, multi factor authentication and how credentials are stored.
• Hosting architecture, backups, disaster recovery and monitoring.
• Vulnerability testing before launch and how findings are fixed.
• Handling of personal data during development and testing.
• Incident response and notification commitments.

Our article on enterprise website security in Saudi Arabia covers the controls in more depth.

Evaluation criteria and envelopes

Publish the evaluation approach in the RFP. It tells agencies what matters and helps your committee stay consistent.

Separate technical and commercial review

Many organisations ask for a technical proposal and a commercial proposal as separate documents, sometimes called envelopes. The committee scores the technical proposal first without seeing prices, then opens the commercial proposals for vendors that pass a technical threshold. This reduces the pull of a low price on quality judgements.

Typical criteria

Assign weights before proposals arrive and record each evaluator's scores separately before discussing them as a group. If the evaluation is close, invite the top two or three agencies to present and answer questions. For a sense of how build costs are usually structured, see our guide to web development costs in Saudi Arabia.

SLAs, contract and onboarding

Service levels

Define support expectations in the RFP so they are priced in. Typical topics include severity levels, response and resolution targets, hours of cover, uptime commitments for hosting, update and patching routines, and reporting. Our guide to website maintenance SLAs in Saudi Arabia explains each in detail.

Contract essentials

• Intellectual property in code, design and content transfers to you on payment.
• Access to source code, hosting and domains stays in your name.
• Payment linked to accepted milestones, with clear acceptance criteria.
• A change request process with written approval before extra work starts.
• Warranty period after launch for defects.
• Data processing terms and confidentiality obligations.
• Exit and handover terms if the relationship ends.

Contract terms should be reviewed by your legal team, particularly governing law, liability and data protection clauses.

Onboarding the selected agency

Hold a kickoff that covers goals, governance, communication channels, decision makers and access. Provide brand assets, system documentation and test accounts promptly. Delays in client side access are among the most common reasons website project procurement ends with a late launch.

RFP checklist

1. Agree objectives, budget range, owner and decision date internally.
2. Form a small evaluation committee with a named sponsor.
3. Run a request for information if scope or market is unclear.
4. Write prioritised requirements, not prescribed solutions.
5. State Arabic first, data protection, hosting, payments and security needs.
6. Describe every integration and its internal owner.
7. Include a security questionnaire.
8. Publish evaluation criteria and weights.
9. Separate technical and commercial review.
10. Check references and test live work on mobile.
11. Define SLAs and contract terms before signing.
12. Plan onboarding and client side access.

How Codeeo helps Saudi businesses with web agency RFPs

Codeeo is a web, app, software, AI and marketing company. Our team of 80+ people across Dubai, Riyadh and Karachi has delivered 200+ projects across the UAE and the US, and we are rated 4.7 from 23 Google reviews. Procurement and digital teams in Riyadh can meet us at our office; elsewhere in the Kingdom we run workshops and presentations over video calls.

We respond to RFPs with named teams, clear assumptions and a realistic plan, and we are happy to run a paid discovery phase when integrations or scope need clarifying first. Our web development team works alongside design, SEO and software specialists, which suits projects where the website connects to wider business systems. You can also read our guide to choosing a website development company in Saudi Arabia.

If you are preparing a website RFP or would like Codeeo on your shortlist, contact our team.