Saudi Arabia's Personal Data Protection Law (PDPL) is now a central part of marketing compliance in the Kingdom. It came into effect on 14 September 2023, and after a one-year grace period, it has been fully enforceable since 14 September 2024. The Saudi Data and Artificial Intelligence Authority (SDAIA) is the competent authority for supervision and enforcement.
For marketers, the most important parts are the rules on consent, direct marketing and international data transfers, set out in the law and its Implementing Regulation. This guide explains them in practical terms. It is general information, not legal advice.
Who the PDPL applies to
The PDPL applies to processing of personal data of individuals in Saudi Arabia, including by organisations outside the Kingdom that process such data. If you are a UAE, Indian, UK or US business running campaigns to Saudi customers, the law can apply to you.
Personal data includes any information that can identify a person directly or indirectly, such as name, mobile number, email address, ID numbers, location data or online identifiers. Sensitive data, such as health, genetic, credit or religious information, carries extra protections.
Key principles
- Lawful basis. Consent is a primary legal basis for processing, with other bases available in specific circumstances under the law.
- Purpose limitation. Collect personal data for a specific, clear and legitimate purpose, and do not use it for an incompatible purpose.
- Data minimisation. Collect only what is necessary.
- Transparency. Provide a privacy notice explaining who you are, what data you collect, why, how long you keep it, and how people can exercise their rights.
- Accuracy and retention. Keep data accurate and do not keep it longer than needed.
- Security. Protect data with appropriate organisational, administrative and technical measures, and notify breaches as required.
Direct marketing rules
The Implementing Regulation includes specific requirements for using personal data in direct marketing, including through phone calls, SMS, email and messaging apps. According to the regulation and SDAIA guidance, the key points are:
- Get consent before marketing. Obtain the person's consent before using their personal data to send direct marketing, unless an exception applies. Consent must be freely given, specific to the purpose, clear, and documented so it can be verified later.
- Separate consents for separate purposes. Consent to receive order updates is not consent to receive promotions.
- Identify yourself. Each marketing message should clearly identify the sender.
- Offer an easy, free opt-out. Provide a simple mechanism for recipients to stop receiving marketing, free of charge, and stop sending once they opt out.
- Keep records. Keep evidence of consent and opt-outs.
Advertising messages sent to people with no prior interaction with your business generally need prior consent, so purchased or rented lists are a high-risk source of contacts.
Rights of individuals
The PDPL gives individuals rights including:
- The right to be informed about how their data is processed
- The right to access their personal data
- The right to request correction of inaccurate data
- The right to request destruction of data that is no longer needed
- The right to withdraw consent at any time
Make sure you have a contact point for requests and a process to respond within the required timeframes.
International transfers
If your CRM, SMS platform, WhatsApp provider or marketing agency stores or accesses Saudi customer data outside the Kingdom, the PDPL's rules on transfers outside Saudi Arabia apply. SDAIA has issued regulations on personal data transfer that set conditions and safeguards. Ask your vendors where data is stored and processed, and document the basis for any transfers.
Penalties
The PDPL provides for penalties including warnings and fines of up to SAR 5 million for violations, which can be doubled for repeat violations, and more serious penalties, including imprisonment, for unlawful disclosure or publication of sensitive data with intent to harm. Courts may also order confiscation and publication of judgments. Reputation damage can be just as costly for consumer brands.
Channel-specific points
SMS
Marketing SMS in Saudi Arabia must be sent with registered sender names through licensed providers, under the Communications, Space and Technology Commission's rules. See our Saudi SMS sender ID guide. The PDPL adds consent, sender identification and opt-out requirements on top.
WhatsApp requires opt-in before you message customers, and its policies align well with the PDPL's consent approach. Record how and when customers opted in, and offer a clear way to stop marketing messages, such as a "Stop" button. Our WhatsApp Business API guide for Saudi Arabia covers setup.
Phone calls and voice broadcasts
Marketing calls should follow the same consent and opt-out principles, and any automated calls should identify the business at the start. See our guide to voice broadcast and IVR calls in Saudi Arabia.
Email and websites
Use clear sign-up forms with unticked marketing consent, explain your data use in an Arabic and English privacy notice, and include an unsubscribe link in every marketing email.
A Saudi PDPL marketing checklist
- Map all sources of Saudi customer data.
- Publish a clear privacy notice in Arabic and English.
- Collect separate, documented consent for marketing.
- Identify your business in every marketing message.
- Provide a free, easy opt-out on every channel and sync opt-outs across tools.
- Stop using purchased lists without provable consent.
- Review vendors and international transfers.
- Set up processes for data subject requests and breach response.
- Train sales and marketing staff.
Working with agencies and vendors
If an agency, call centre or messaging provider runs campaigns for you, you remain responsible for how your customers' data is used. Under the PDPL, a controller should use processors that provide sufficient guarantees for protecting personal data, and should monitor their compliance. In practice:
- Sign a written agreement setting out the purposes, security measures and confidentiality obligations
- Share only the data needed for each campaign, not your full customer database
- Ask where data is stored and whether any of it leaves Saudi Arabia
- Require prompt notice of any breach or incident
- Ensure opt-outs collected by the vendor are passed back to you and applied across all channels
- Delete or return data when the campaign or contract ends
Arabic and bilingual consent
Notices and consent requests should be clear to the people reading them. For most Saudi audiences, that means Arabic, with English as a second language where appropriate. Keep the Arabic and English versions equivalent in meaning, and record which version each person saw when they gave consent.
Retention and deletion
Do not keep marketing data forever. Set retention periods for leads and inactive customers, and delete or anonymise data you no longer need for the purpose it was collected for. Regular list cleaning also improves delivery and engagement.
How DND Teams helps
DND Teams supports businesses marketing in Riyadh, Jeddah, Dammam and across the Kingdom with compliant SMS, WhatsApp, voice and digital campaigns. We build bilingual consent forms, opt-in and opt-out flows, and work with licensed partners for sender name registration. See our pages for bulk SMS in Riyadh, WhatsApp marketing in Riyadh, digital marketing in Riyadh and our Saudi compliance guides. For complex data processing, consult a qualified Saudi legal adviser.
Get a custom quote
Working with clients in India, the US, UK, Canada, Australia and the UAE, DND Teams replies with a short written review and a clear quote, with no obligation. Get a custom quote for PDPL-friendly SMS, WhatsApp and email campaigns in Saudi Arabia, or message us on WhatsApp at +91 88274 09728.
Not ready for a full project? Start with our Ads pilot (1 month) for US$199 (one-time, paid in advance). Price covers our setup and 4-week management work only. Ad spend is paid separately (directly to Google or Meta). Need more? Get a custom quote. See how our pricing works for what affects your price.
Prices shown are indicative ranges in US dollars and exclude taxes and third-party charges (such as Meta or carrier fees, billed at cost) unless stated. Your price depends on your requirements; get a custom quote for an exact figure. This article is general information, not legal advice, and reflects our understanding as of October 2026.