Short answer
Saudi Arabia's Personal Data Protection Law (PDPL), published by SDAIA, requires prior consent before a business sends advertising to someone's personal contact details, plus a clear way to stop receiving it. Marketing data must come directly from the person, with consent that can be withdrawn at any time. SMS and WhatsApp campaigns need consent records and working opt-outs.
What the PDPL says about marketing messages
The English text published by SDAIA sets out the rules that matter most for messaging. They apply to data about individuals in the Kingdom, including processing by parties outside it.
| PDPL provision | What it means for SMS and WhatsApp |
|---|---|
| Article 5 | Processing generally needs consent, and the person may withdraw it at any time |
| Article 12 | Publish a privacy policy before collecting numbers |
| Article 25 | Advertising to personal contact details needs prior consent and a clear way to stop receiving it |
| Article 26 | Personal data, except sensitive data, may be used for marketing if collected directly from the person with consent |
| Article 29 | Transfers of personal data outside the Kingdom are allowed only for set purposes and under conditions |
PDPL checklist for messaging teams
- Capture consent directly from the customer, naming your brand and the channel.
- Link your privacy policy at the point of capture.
- Record the source, timestamp, channel and wording of each consent.
- Include a clear opt-out in every promotional SMS and WhatsApp message.
- Treat a withdrawal as final for marketing until the person consents again.
- Check where your messaging providers store and process data, and whether data leaves the Kingdom.
How the PDPL fits with CST and WhatsApp rules
The PDPL governs personal data. Telecom rules sit alongside it: CST's spam regulations set sender ID approval and promotional sending hours, and WhatsApp's own policy requires opt-in before a business messages anyone. A campaign has to satisfy all three.
Detailed conditions, such as when consent must be explicit, are left to the Implementing Regulations. Read them on SDAIA's website or take legal advice, because this page summarises the law and is not legal advice.