Saudi PDPL and WhatsApp Marketing: A Compliance Guide for Businesses
What Saudi Arabia's Personal Data Protection Law requires of WhatsApp campaigns: prior consent, opt-out, retention, cross-border transfers and penalties, with a practical checklist.
In this article
- Key takeaways
- What is the PDPL and why does it matter for WhatsApp marketing?
- Consent and opt-out: how to apply them in practice
- What data can you keep, and for how long?
- Penalties under the law's text
- Approved templates and compliant campaigns
- Checklist: PDPL compliance for WhatsApp marketing
- How Watily helps
- Frequently Asked Questions
Saudi Arabia's Personal Data Protection Law (PDPL) treats a customer's mobile number as personal data and does not allow it to be used for promotional WhatsApp messages without the recipient's consent, together with a clear way to stop them. The Saudi Data and AI Authority (SDAIA) supervises the law, and fines for general violations reach 5 million SAR and may be doubled for repeat offences. In practice, compliance means recorded consent, approved templates, immediate opt-out and keeping only the data you need.
Key takeaways
- Prior consent for promotional messages is a legal requirement, and WhatsApp's business policy requires it too.
- Every marketing message needs a clear opt-out, and opt-out requests are honoured immediately.
- Collect only what you need, and delete data once its purpose ends unless another law requires you to keep it.
- Transfers outside the Kingdom are restricted; know where your providers store customer data.
- Per the law's text: a warning or a fine of up to 5 million SAR for general violations, which may be doubled on repetition.
What is the PDPL and why does it matter for WhatsApp marketing?
The PDPL is Saudi Arabia's comprehensive framework for processing personal data. It applies to any business that collects or uses data about individuals in the Kingdom, whatever its size. It entered into force in September 2023, the compliance grace period ended in September 2024, and the official text is published on SDAIA's personal data protection portal.
When you store a customer's number, name and order history and then send them an offer on WhatsApp, you are a "controller" processing their data. The rules on consent, purpose, destruction and disclosure apply, whether you send manually or through a platform.
Articles most relevant to WhatsApp marketing
| Article | In brief | What it means for you |
|---|---|---|
| Article 4 | Data subject rights: to know the legal basis and purpose, access, correction and destruction | Have a way to answer a customer asking about or deleting their data |
| Article 5 | Processing requires the data subject's consent except in specified cases, and consent can be withdrawn | Withdrawal stops messages from that moment |
| Article 18 | Destroy data once the purpose ends, except where law or judicial proceedings require retention | Do not keep old lists without reason |
| Article 20 | Notify the competent authority of a breach, and the individual if harm results | Have a clear breach plan |
| Article 25 | Personal contact details may not be used to send promotional material without the recipient's consent, with a clear opt-out mechanism | The core of WhatsApp campaign compliance |
| Article 26 | Marketing processing is allowed if data was collected directly from the individual with consent | Never use bought or copied numbers |
| Article 29 | Transfers outside the Kingdom are subject to controls and adequate protection | Ask your provider about storage locations and safeguards |
This summary is for awareness, not legal advice; check the official text or a lawyer for specific cases.
Consent and opt-out: how to apply them in practice
What valid consent looks like
- Explicit: an unticked box, or a message the customer sends asking for offers.
- Specific: it names WhatsApp and the message type, such as offers or appointment reminders.
- Separate: marketing consent is not a condition of the order and is not buried in general terms.
- Recorded: date, source (store, branch, ad) and the consent text as shown to the customer.
Suggested consent wording
☐ I agree to receive offers and discounts from [store name] on WhatsApp at this number, and I can stop them at any time by replying "STOP".
Keep the wording exactly as shown to the customer; any later change needs a new recorded version.
Where to collect consent
- A checkbox at checkout or signup in your store.
- A button inside the WhatsApp chat: "Would you like our offers here?" with Yes and No. We explain this in our guide to WhatsApp forms and interactive buttons.
- A QR code in-branch that opens a chat with a ready message asking to subscribe.
- Click-to-WhatsApp ads, when the customer starts the chat and then opts in; see our guide to Click-to-WhatsApp ads.
Opt-out
Include a clear opt-out in every marketing message, such as a "Stop offers" button or a keyword. Honour it immediately and automatically, and move the number to a suppression list excluded from future campaigns. Opting out of marketing does not stop utility messages tied to an active order, such as shipping confirmation.
What data can you keep, and for how long?
- Keep what you actually need: name, number, consent status, message preferences and what fulfilment requires.
- Beware of sensitive data: the law gives health data and other sensitive data stronger protection. Clinics in particular should never mention diagnosis or treatment in promotional messages and should keep appointment messages minimal.
- Set a written retention period: for example, remove long-inactive contacts from marketing lists, while respecting laws that require certain records, such as invoices, to be kept.
- Restrict access: a separate inbox account per employee instead of a shared phone, with role-based permissions.
- Do not export lists as loose files through groups or personal email.
How to handle customer data requests
Prepare a standard response naming the channel for such requests, the person responsible and your turnaround time. Log each request, and remove the number from marketing lists immediately.
Transfers outside the Kingdom
Messaging platforms and cloud services may process data outside Saudi Arabia. The law allows transfers under controls on protection level, safeguards and transferring only the minimum necessary. Before signing with any provider, ask in writing where data is processed and stored and what safeguards apply.
Penalties under the law's text
| Violation | Penalty |
|---|---|
| Disclosing or publishing sensitive data with intent to harm or for personal benefit (Article 35) | Up to two years' imprisonment and/or a fine of up to 3 million SAR |
| Any breach of the law or its regulations by a business (Article 36) | A warning or a fine of up to 5 million SAR, which may be doubled on repetition up to twice the maximum |
Source: the law's text on SDAIA's portal. Do not forget the non-financial impact: losing your number to reports and damage to your brand's reputation.
Approved templates and compliant campaigns
On the WhatsApp Business API a business can only start a conversation with a Meta-approved template, and approval can take up to 24 hours per Meta's template review guidelines. Templates fall into three categories: marketing for offers, utility for orders and appointments, and authentication for OTPs. Meta's review filters misleading content, but it does not check each recipient's consent; that is your responsibility.
Steps for a compliant campaign
- Pull a segment of customers who consented to marketing only, and exclude the suppression list.
- Write a marketing-category template that names your business, the reason for the message and a specific offer.
- Add an opt-out button or clear opt-out instructions.
- Submit the template at least a day before the campaign.
- Send to a small segment first and watch blocks, reports and quality rating.
- Scale gradually and process opt-outs in real time.
To avoid bans during large campaigns, see our guide to sending bulk WhatsApp messages without bans.
Checklist: PDPL compliance for WhatsApp marketing
| Item | Action | Evidence to keep |
|---|---|---|
| Number source | Numbers collected directly from customers only | Source of each contact |
| Consent | Explicit, specific, separate marketing consent | Date, text and channel |
| Transparency | A privacy notice covering purpose, retention and rights | Copy of the published notice |
| Opt-out | Clear mechanism in every marketing message, honoured immediately | Log of opt-outs and when they were processed |
| Templates | Approved, correctly categorised templates | Template list and status |
| Data minimisation | Collect the minimum; no sensitive data in messages | List of stored fields |
| Retention and deletion | A written period and periodic deletion | Retention policy and deletion log |
| Access | One account per employee, defined permissions | User list and roles |
| Providers | Known processing locations and safeguards | Contract or correspondence |
| Incidents | A plan to notify the authority and customers of breaches | Written plan and owner |
How Watily helps
Watily's WhatsApp Business API brings compliance and operations tools into one dashboard:
- An official, Meta-approved connection and an approved template library for marketing, utility and authentication.
- Interactive WhatsApp buttons and forms to collect consent inside the chat itself.
- Segmented campaigns that send only to the segment you choose.
- A team inbox with a separate account per employee, tags and notes instead of a shared phone.
- Watily Notify alerts for orders and shipping as utility messages, kept separate from marketing.
For the full picture from activation to cost, read the complete WhatsApp Business API guide for Saudi Arabia.
Build your campaigns on a foundation that protects your customers and your number. Explore Watily's WhatsApp Business API solution and talk to our team about setting up consent and templates.
Frequently Asked Questions
Can I send WhatsApp offers to customers who bought from me before?
A past purchase is not consent to promotional messages. The law requires the recipient's consent to promotional material, so ask for it explicitly in your next service interaction or at the next order.
Do order and shipping confirmations need marketing consent?
Utility messages tied to an active order are not promotional material, because they fulfil what the customer requested. Do not add promotions to them, or they become marketing messages.
What is the penalty for breaching the PDPL?
Under Article 36 a violating business faces a warning or a fine of up to 5 million SAR, which may be doubled on repetition. Disclosing sensitive data with intent to harm carries up to two years' imprisonment and a fine of up to 3 million SAR, or either, under Article 35.
Who supervises the Personal Data Protection Law?
The Saudi Data and AI Authority (SDAIA) supervises the law's implementation and publishes its text, regulations and guides on the personal data protection portal.
Is Meta's template approval enough to comply with the law?
No. Meta reviews template content but does not verify each recipient's consent. Recording consent and honouring opt-outs is the business's responsibility.
