Saudi PDPL and Direct Marketing: What Your Campaigns Must Change

Most Saudi marketing teams know the Personal Data Protection Law (PDPL) exists. Fewer have checked whether their lead forms, WhatsApp broadcasts, email lists and CRM records match what its Implementing Regulation asks for when personal data is used for marketing. The gap is usually small and practical: a pre-ticked box, an unsubscribe link that needs a login, a sales rep who keeps messaging after “please stop”, or a CRM that cannot show when and how a contact said yes.

This guide reads the official text published on the Saudi Data and AI Authority (SDAIA) portal, notes what the draft amendments under public consultation in October 2026 would change, and turns both into changes you can hand to your web, sales and CRM teams. It is a working summary built from the sources linked, not legal advice. For a specific campaign, check the current text and speak to a qualified Saudi lawyer.

We worked from the Arabic text on SDAIA’s portal; the summaries below are our own paraphrases. If you rely on an English translation, check it against the Arabic, which is the text we quote from.

What the law and the regulation actually say

Four provisions matter for marketing. Two sit in the PDPL itself, issued by Royal Decree M/19 of 9/2/1443H and amended by Royal Decree M/148 of 5/9/1444H (as referenced in the Implementing Regulation on SDAIA’s portal). Two sit in the Implementing Regulation.

Article 1 of the Regulation defines direct marketing as communicating with the data subject directly, by any physical or electronic means, to send marketing material, including advertisements and promotional offers (SDAIA, Implementing Regulation). On that wording, WhatsApp, SMS, email, calls and a letter in the post all appear to fall within it.

Article 11 sets the bar for consent: freely given, with no misleading methods, for a clear and specific purpose, by a person with full legal capacity, documented so it can be verified later, and given separately for each purpose. Explicit consent is required for sensitive data, credit data and decisions made entirely by automated processing.

One point is genuinely unclear. Article 28 asks for consent only “where there is no prior dealing”, while Article 29 asks for consent before any direct marketing processing. The text does not explain how the two fit together for existing customers, and the 2025 and 2026 drafts both touch this wording (see below). Until SDAIA settles it, the safer plan is to hold a recorded consent for every contact you market to, including past customers.

What the October 2026 draft would change

SDAIA opened a public consultation on amendments to the Implementing Regulation on 6 October 2026, closing on 5 November 2026 through the Istitlaa platform (Clyde & Co, 8 October 2026). It follows an earlier round that ran from 27 April to 27 May 2025 (Bird & Bird). Neither round has been adopted as of this writing; these are proposals, not rules.

The law-firm summaries of the 2026 draft report these marketing changes:

• Wider scope for Article 29. It would cover all processing of personal data for marketing, not only sending direct marketing messages (Clyde & Co).
• Withdrawal means deletion, not just silence. On withdrawal, the controller would have to stop the underlying processing and destroy personal data generated by it without undue delay (Clyde & Co).
• Prior relationships need evidence. Where a business relies on a prior relationship under Article 28, it would have to check that valid consent exists, keep evidence of it, and provide clear and accessible ways to withdraw (Clyde & Co).
• Strengthened withdrawal and opt-out requirements, and removal of the standalone “Direct Marketing” definition from the definitions article, with references updated elsewhere (Al Tamimi, 9 October 2026).

The two firms describe the draft differently. Clyde & Co reports the wider Article 29 scope, the deletion duty and the prior-relationship evidence; Al Tamimi’s note does not mention Articles 28 or 29 by number and speaks more generally of a revised consent framework for promotional and direct marketing with strengthened withdrawal and opt-out requirements. Al Tamimi also does not give an entry-into-force period; the 60-day figure comes from Clyde & Co. Neither publishes the full proposed wording, so read them as summaries and check the draft on the Istitlaa platform or SDAIA’s portal. The 2025 draft, as Bird & Bird summarised it, went the other way on prior dealing: it would have removed the “no prior interaction” wording from Article 28 altogether. The practical message is consistent: consent has to be provable, withdrawal has to be easy, and after withdrawal the data built on that consent may have to go.

Lead forms and landing pages

Your forms are where consent is either captured properly or lost. Our suggested checks for each form on the website and on campaign landing pages:

1. Separate the inquiry from the marketing consent. Answering a quotation request is one purpose; sending offers is another. Article 11 asks for separate consent per purpose, so we suggest a separate, unticked checkbox for marketing.
2. Name the channels and the sender. “I agree to receive offers from [Company] by WhatsApp and email” is clearer than “I agree to receive updates”. If you plan to use SMS or calls, say so.
3. Do not bundle consent into the privacy policy. A link to the policy is useful, but agreement to a policy is not a marketing opt-in. The telecom regulator’s spam rules say the same for SMS and calls (see below).
4. Capture proof automatically. Store the form name, page URL, timestamp, the exact checkbox wording and the language shown (Arabic or English). Without this, you cannot verify consent later as Article 11 requires.
5. Check lead-ad forms too. Platform lead forms need the same custom consent question; do not assume the platform’s own terms cover your marketing.

Cookie banners and analytics consent are a separate topic; we cover them in our guide to cookie consent and consent mode for GCC websites. If your forms are built on a website you manage yourself, this is usually a short development task; RX’s website design work covers form structure and the CRM connection behind it.

WhatsApp templates and broadcast lists

WhatsApp has its own rules on top of the PDPL. Its Business Messaging Policy (last updated 23 September 2026) says you may contact people only with their opt-in permission, that you are “solely responsible for determining the method of opt-in” and its legality, and that you must respect all requests, on or off WhatsApp, to block, discontinue or opt out (WhatsApp Business Messaging Policy). Meta’s developer guidance adds that the opt-in must clearly say the person is agreeing to messages over WhatsApp and must name the business (Meta for Developers: Getting opt-in).

Changes to make:

• Audit the source of every broadcast list. Numbers copied from business cards, exhibition scans or group chats rarely come with a recorded marketing consent. PDPL Article 26 also expects marketing data to be collected directly from the person, which makes bought or scraped lists hard to justify.
• Put the business name and an opt-out in every marketing template. A “Stop offers” quick-reply button or a line such as “Reply STOP to stop offers” comes much closer to the “as easy as or easier than giving consent” test than “contact our office”.
• Make stopping someone’s job. When a contact replies “stop”, “لا أرغب” or similar, we suggest someone updates the CRM the same day, and the number must be suppressed from every future broadcast, not just the current one.
• Keep service and marketing apart. A customer who opted in to delivery updates has not opted in to promotions. Meta’s guidance recommends separate opt-ins per message category.

If you also market to Egypt, the rules differ, including a licence requirement for electronic direct marketing; see our guide to Egypt’s data protection law and direct marketing.

Email, SMS and calls: the telecom layer

Article 29 applies “without prejudice to” the telecom law, so SMS and call campaigns must also meet the regulator’s rules. The Regulations for Curbing SPAM Messages & Calls (Version Three, October 2022), published by the regulator then known as CITC and renamed the Communications, Space and Technology Commission (CST) in November 2022 (CST, Who we are), include these obligations (CITC regulations portal):

• Recipients must expressly opt in to promotional messages and calls, and consent contained in privacy policies and service contracts does not count. Senders must be able to prove consent.
• Opt-out requests must be honoured within 24 hours, with a confirmation sent to the recipient.
• Promotional and awareness messages and calls are barred between 10:00 pm and 9:00 am, and between 1:00 am and 12:00 pm during Ramadan (KSA time).
• Sender names are registered through the Bulk SMS e-System and used only via authorised providers; advertising sender names carry an “-AD” suffix; promotional SMS may not be sent from a mobile number.
• Callers must state at the start who they represent and why they are calling, and ask whether the person wants to continue.

The 24-hour SMS stop rule is stricter than the PDPL’s “without undue delay”, so if you run one suppression process for every channel, set it to the 24-hour standard. Check with your SMS provider and on CST’s site that you are working to the current version of these rules.

For email, PDPL Article 25 names email addresses directly: consent first, and a clear way to stop. The article does not prescribe a format; our suggestion is a working one-click unsubscribe in every marketing email, with the company’s name as the sender.

The CRM fields that make consent provable

Most of the obligations above fail in the CRM, not on the form (our CRM requirements checklist covers the wider system choice). A contact record should be able to answer “did this person agree, to what, when, and have they withdrawn?” These fields cover it:

Keep one source of truth. If the WhatsApp platform, the email tool and the sales team’s spreadsheet each hold their own list, an opt-out in one will be missed in the others. Agreeing who owns these fields, and writing the reply scripts and opt-out handling for the sales team, is the kind of work RX does under business solutions and sales enablement.

Penalties, and where to start

The PDPL sets administrative penalties in Article 36: a warning or a fine of up to SAR 5 million for private persons and companies that breach the Law or its Regulations, decided by a committee of at least three members that includes a technical specialist and a legal adviser. For repeat violations the fine may be doubled, up to twice the maximum, and the committee’s decisions can be challenged before the competent court. Article 35 sets criminal penalties, up to two years’ imprisonment and a fine of up to SAR 3 million, for disclosing or publishing sensitive data in breach of the Law with intent to harm the data subject or for personal benefit; the court may also double the fine for repeat offences. Article 40 lets anyone harmed claim compensation for material or moral damage (SDAIA, PDPL text). Those are maximums; the law does not set a fixed amount per message.

Our suggested order of work:

1. Stop the riskiest sends. Pause broadcasts to lists with no recorded consent until each contact is re-confirmed or removed.
2. Fix the forms. Unticked, separate, channel-specific consent with automatic proof, in Arabic and English.
3. Add an easy opt-out to every template and email, and a same-day suppression routine that covers every tool.
4. Add the CRM fields above and back-fill what you can prove.
5. Watch the consultation outcome. If the 2026 draft is adopted, plan how to delete data built on withdrawn consent in the 60 days between publication and entry into force that Clyde & Co describes.

Step 1 can start this week: export every list you currently broadcast to and add one column, consent recorded, unclear or none. That column tells you how much of the next campaign can go out as planned and how many contacts need re-confirming first. For the legal sign-off, use your lawyer.