Want to Send Offers to Your Customers by WhatsApp, SMS or Email? What Does the Personal Data Protection Law Require Before You Market to Your Customer List, and What Must Your Privacy Policy Say?

When does sending offers need the customer's consent?

The rule in the Personal Data Protection Law, issued by Royal Decree M/19 and its amendments, is that a business does not use a data subject's personal contact details, including postal and email addresses, to send promotional or awareness material except on two conditions: the intended recipient's consent to receiving the material is obtained, and the sender provides a clear mechanism allowing the recipient to ask it to stop whenever they wish. The Law adds that personal data may be processed for marketing purposes if it was collected directly from the data subject and they consented to that, with sensitive data excluded entirely. Consent is the starting point, and stopping is a permanent right of the customer.

The Implementing Regulation of the Law provides that, before sending promotional or awareness material, the controller must obtain the intended recipient's consent where there is no prior dealing between the controller and the intended recipient. That is what the text says, and it should not be read more widely. The text does not define prior dealing, it does not exempt the sender from the other obligations the same Regulation sets for every message (naming the sender clearly, an easy and free opt-out mechanism, stopping upon request, and keeping proof of consent), and it does not remove the Law's requirement of the data subject's consent to processing their data for marketing purposes. So do not treat this case as a general exemption for everyone who has ever bought from you.

If you are an online store there is an additional layer: the E-Commerce Law Implementing Regulation requires the service provider to keep the consumer's personal data only to fulfil its obligations, and prohibits using it for any other purposes, such as advertising or marketing, without obtaining the consumer's explicit prior consent. This is why the safe practical route for any store or social media seller is to collect explicit, documented consent from everyone it will send offers to, whether a new or a returning customer. This guide does not present legitimate interest as a substitute for consent in marketing, as that question needs specific legal advice before anyone relies on it.

What does valid consent to marketing messages look like?

The Implementing Regulation allows consent to be obtained in any appropriate form or means, written, oral or electronic, but it sets conditions for it to be valid. Consent that does not meet these conditions will not protect you if a complaint is made, however many customers pressed a button.

• Free: given of the customer's own will without any misleading methods, so no pre-ticked box and no wording suggesting that refusing cancels the order.
• Not a condition of the service: consent may not be made a condition of providing a service or benefit unrelated to the processing requested, so completing an order cannot depend on accepting offer messages.
• Specific per purpose: a separate consent for each purpose, so consent to shipment tracking messages is not consent to offers, and the customer can tailor their choices, such as picking the channel they want.
• Clear before it is asked: the purpose is explained to the customer at or before the request for consent, in plain language.
• Documented: by means that allow it to be verified later, with a record showing the time and the means of the consent.
• Withdrawable at any time: and the withdrawal steps are the same as, or easier than, the steps for giving it.

What must every offer message respect?

The Implementing Regulation sets obligations that apply to every promotional message sent to the customer's personal contact details, without prejudice to the Telecommunications and Information Technology Law and other relevant laws. Apply these steps to every campaign, whether you send it yourself or through a messaging platform or a marketing agency.

1. Name the sender clearly without hiding its identity in any way, so the customer knows from the first line that the message is from your store.
2. Include an easy and simple opt-out in the message, such as replying with the word stop or an unsubscribe link, and make it the same as, or easier than, the sign-up steps.
3. Make the opt-out free, so the customer bears no financial cost to stop receiving messages.
4. Stop sending as soon as you receive the opt-out request, and remove the number or email from every campaign list on every platform you use.
5. Keep proof of the recipient's consent to receiving the messages, and proof of the date they opted out if they did.

The Communications, Space and Technology Commission may have its own requirements for promotional text messages, such as sender name registration or sending times. We verify these at the official source before stating them, so review them with the messaging provider you use.

How do you collect consent at checkout, in direct messages and on your bio link?

Most small stores sell through three touchpoints: the checkout page in the store, the WhatsApp or Instagram chat in which the order is confirmed, and the bio link that gathers the accounts. Collect consent at each of them in the same way: a separate option, not pre-selected, with the privacy policy link and a record of the time and the means.

1. At checkout: add a separate box, not pre-ticked, for receiving offers, with a choice of channel, make sure the order completes whether or not the customer ticks it, and that the store platform records the time of the choice.
2. In the order confirmation by direct message: after confirming the order, ask the customer a separate question, such as would you like to receive our offers on this number? Do not treat silence or payment as consent, and save the customer's explicit reply with its date in the consent register.
3. On the bio link: if you collect numbers or emails through a sign-up form, state the purpose and the channels clearly in it, place the privacy policy link next to it, and ask only for the data you need.
4. Set up a single consent register, even a simple spreadsheet, holding the customer's name, the contact detail, the channel they agreed to, the time and means of consent, and the date of withdrawal if any.
5. For existing customers for whom you hold no documented consent: do not send them an offers campaign directly, and ask for consent first at their next dealing with you or through the checkout and confirmation points.

Common mistakes to avoid before your first campaign

• Buying ready-made lists of numbers or emails, or scraping them from comments, groups and public accounts: the Law allows processing for marketing purposes where the data was collected directly from the data subject and they consented, and a bought or copied list meets neither condition.
• Using sensitive data in marketing: the Law excludes sensitive data from processing for marketing purposes, so do not target customers based on their health, their beliefs or the like, even if their purchases reveal it.
• Bundling consent to offers into acceptance of the terms and conditions, or into a single box with shipping messages.
• Sending messages from a personal number or under an unclear name from which the customer cannot tell who the sender is.
• A hard opt-out: such as requiring the customer to call customer service, log in or give a reason, when signing up took one tap.
• Handing the list to an agency or platform without a contract governing the processing, which is where you need a data processing agreement with every provider that sends messages on your behalf.

A customer's request to stop messages is, in essence, a withdrawal of consent, and it may come with a request to delete their data or get a copy of it. The DSR Response Pack I-06 helps you reply on the record, and the E-Ads Compliance Checklist D-08 helps you review the content of the campaign itself before launch.

What must the privacy policy say about marketing?

The Law requires the controller to adopt a privacy policy available to data subjects when their data is collected, stating the purpose of collection, the content of the data, how it is collected, how it is stored, how it is processed and destroyed, and the data subject's rights and how to exercise them. If you send offers, this must appear in the policy expressly, not be implied from a general phrase. The Saudi Data and AI Authority has circulated draft amendments to the Implementing Regulation on the Istitlaa platform; they remain a draft and are not applied, and this guide is based on the texts in force.

• The marketing purpose expressly: sending offers, reminders and newsletters, separate from the purposes of fulfilling the order.
• The data used for marketing: name, mobile number and email, and their source (directly from the customer).
• The channels used: WhatsApp, SMS, email, or any other you actually use.
• How consent is collected: at checkout, in the chat or in the sign-up form, and that it is not a condition of purchase.
• How the customer stops: replying with the word stop, an unsubscribe link, or contacting a named channel, free of charge and at any time.
• Who sends on your behalf: the categories of messaging providers or agencies to which data is disclosed for this purpose.

The final checklist before sending your first offer

1. Review the source of every number and email on your list, and remove anything not collected directly from the customer.
2. Make sure every contact has a documented marketing consent with its time, its means and the chosen channel.
3. Separate consent to offers from the terms and conditions and from shipping messages at checkout, in chats and on the bio link.
4. Write the store name clearly at the start of every message, and add an easy and free way to opt out.
5. Assign a responsible person who carries out opt-out requests immediately on all platforms and records their date.
6. Exclude any targeting based on sensitive data.
7. Update your privacy policy to state the marketing purpose, the channels and how to opt out, and publish it wherever you collect data.
8. Sign a data processing agreement with the messaging provider or agency, and check your SMS provider's requirements for promotional messages.

This checklist is a practical starting point, not a substitute for advice on a specific case. If you want a privacy policy that covers marketing, consent and opt-out in wording certified by a licensed Saudi lawyer and kept current with the law, template D-03 is ready in Arabic and English in minutes.

Frequently asked questions