Marketing Messages and Consent Under the Saudi PDPL: SMS, Email and WhatsApp Rules

WaqiSec Compliance Team · Last reviewed: 2026-10-14

What the PDPL says about marketing messages

Article 25 of the PDPL says a controller may not use a person's personal contact channels, including postal and email addresses, to send promotional or awareness material unless two conditions are met: the recipient has consented, and the sender provides a clear way to stop receiving it. Awareness material sent by public bodies is exempt. Article 26 adds that personal data, other than sensitive data, may be processed for marketing if it was collected directly from the person and they consented.

The detail sits in the Implementing Regulations. Article 11 sets general consent conditions, Article 12 lets people withdraw consent at any time, and Articles 28 and 29 deal with promotional material and direct marketing. Law-firm commentary (Latham & Watkins) reads these provisions as making consent the only basis you can rely on for marketing, rather than legitimate interest.

Promotional material vs direct marketing

The Regulations define direct marketing as contacting a person by any direct physical or electronic means to send marketing material.

Can you message existing customers without fresh consent?

This is the most common question, and the answer is less clear than in UK or EU law. Article 28 relaxes the consent requirement for promotional material where you already have prior dealing with the recipient. Article 29, which covers direct marketing, has no such exception. Latham & Watkins flags this gap as a source of uncertainty.

The safer course: treat marketing to customers as direct marketing, collect a separate marketing consent at signup or checkout, and keep proof. The October 2026 draft points the same way, since it would require controllers relying on an existing relationship to check that valid consent exists (Clyde & Co).

How to collect and record valid marketing consent

1. Separate it. Article 11 requires separate consent for each purpose. A marketing tick box must be separate from accepting your terms or privacy notice, and must not be pre-ticked.
2. Let people choose. Article 28 expects recipients to be able to customize which promotional options they receive, for example offers vs newsletters, or SMS vs email.
3. Say who and what. Explain who will send messages, on which channels and about what.
4. Record it. Keep the date, channel, wording shown and the source of each consent, so you can prove it later.
5. Make withdrawal easy. Opting out must be free and at least as easy as opting in.
6. Reflect it in your privacy notice. Our privacy notice guide covers how to describe marketing processing.

Explicit consent under Article 11(2) is required for sensitive data, credit data and fully automated decisions. Marketing is not on that list, but a clear, active opt-in is still the practical standard, and SDAIA's June 2026 announcement described the violation as direct marketing without explicit consent.

What every marketing message must include

• The sender's name, clearly shown.
• A free way to opt out, as easy as signing up.
• Content that matches what the person agreed to receive.
• For SMS, a registered sender name with the advertising suffix.

Channel rules: SMS, email and WhatsApp

If your marketing platform stores or processes customer data outside Saudi Arabia, the transfer rules in our cross-border transfer guide also apply.

Enforcement so far

In January 2026 SDAIA's violation committees announced 48 decisions for the previous year. The listed violations included sending promotional and marketing messages to data subjects without their consent. In June 2026 a new batch of fines and warnings named processing personal data for direct marketing without explicit consent as the most prominent violation. No fine amounts were published. The maximum under Article 36 of the PDPL is SAR 5 million per violation, doubled for repeats. Our guide to PDPL penalties and enforcement explains the process.

What the October 2026 draft would change

SDAIA's draft amendments to the Implementing Regulations are open for comment until 5 November 2026. Based on Clyde & Co and Al Tamimi summaries, the draft would keep consent where there is no prior interaction, require controllers relying on an existing relationship to verify valid consent, consolidate sender identity, unsubscribe and record-keeping rules, and require marketing processing to stop, with the resulting data destroyed, after consent is withdrawn. These are proposals and are not yet in force.

PDPL marketing consent checklist

• We list every marketing channel we use: SMS, email, WhatsApp, calls, push.
• Marketing consent is a separate, unticked choice at every signup point.
• We store the date, channel, wording and source of each consent.
• Every message names us and offers a free, easy opt-out.
• Opt-outs are applied within 24 hours across all systems.
• SMS sender names are registered and promotional SMS respects quiet hours.
• WhatsApp campaigns use approved templates and opted-in numbers only.
• Our privacy notice and records of processing describe marketing processing.

Related guides

This guide is general information, not legal advice. Always check the official text from the relevant authority before making decisions.