PDPL and WhatsApp marketing: UAE and Saudi rules

The short answer: The UAE and Saudi Arabia each have a Personal Data Protection Law (PDPL). For WhatsApp marketing, both expect consent you can prove and an easy way to stop, and the Saudi PDPL names direct marketing outright. Meta's opt-in rules apply on top.

This guide is general information, not legal advice.

The two laws at a glance

UAE: Federal Decree-Law No. 45 of 2021

• Consent first. Processing needs consent unless a listed exception applies, such as performing a contract (Art. 4).
• Provable consent. It must be specific, clear and unambiguous, and say it can be withdrawn easily (Art. 6).
• Marketing stops on request. A customer can object to direct marketing, including profiling for it (Art. 17).
• Free zones. A free-zone company under its own data protection law follows that law instead (Art. 2).

The executive regulation was not on the UAE legislation portal on 7 October 2026. Once issued, businesses get up to six months to comply, extendable once (Art. 29).

Marketing messages on social media apps also fall under the 2024 telemarketing rules, which our UAE guide summarizes.

Saudi Arabia: the PDPL and its Implementing Regulation

• Prior consent. No advertising to a person's contact details without prior consent and a clear way to stop (Art. 25).
• Consent per purpose. It must be free, documented and separate for each purpose (Reg. Art. 11).
• Direct marketing. Name the sender, make the opt-out as easy as the opt-in, and stop without delay (Reg. Art. 29).
• Registration. SDAIA's register applies to some businesses, such as those whose main activity is processing personal data.

The one-year grace period ended on 14 September 2024. Fines reach SAR 5 million, doubled for a repeat violation (Art. 36), and unlawfully disclosing sensitive data can bring up to two years in prison (Art. 35).

Meta's rules on top

Meta's Business Messaging Policy requires opt-in before you message someone first, asks you to honor every opt-out, and makes your business responsible for complying with local law. Our opt-in guide covers what counts and what to record.

A checklist for WhatsApp marketing

• Record each consent with its purpose, channel, wording, source and time.
• Keep marketing consent separate from order and booking updates.
• Name your business in every marketing message.
• Make stopping as easy as opting in, and suppress the number before the next send.
• Have a breach plan that can notify SDAIA within 72 hours.
• Check whether your business must register with SDAIA.

Where Otobiz fits

Otobiz Consent and Opt-outs records each grant and withdrawal per channel and purpose, with its source and wording, and checks it before every marketing send. How customer data is separated and encrypted is on our Security page.

Sources