Saudi Arabia’s Personal Data Protection Law: what marketing teams need to change

Why the law matters for marketing

Marketing runs on personal data: names, phone numbers, email addresses, browsing behaviour, purchase history, location and preferences. In Saudi Arabia, where messaging, social media and mobile commerce are central to consumer marketing, that data flows through many systems and suppliers.

The Personal Data Protection Law came into force in September 2023, with enforcement beginning in September 2024 after a transition period. The Saudi Data and AI Authority, known as SDAIA, supervises its application and has issued implementing regulations and guidance. The law applies to processing of personal data in the Kingdom and to processing of data about residents of Saudi Arabia by entities outside the Kingdom.

Consent and marketing messages

Consent plays a central role in the Saudi framework, and marketing communications require particular care. Organisations sending advertising or awareness messages should have an appropriate basis, usually the recipient’s consent, and must provide a clear and easy way for recipients to stop receiving them.

In practice, marketing teams should record when and how consent was obtained, which channels it covers and what the person was told. A customer who agreed to SMS order updates has not necessarily agreed to promotional WhatsApp messages. Opt-outs must be honoured across every system, not only the tool that received the request.

Record consent

Store when, where and how consent was given, and for which channels.

Separate purposes

Keep service messages and marketing permissions distinct.

Honour opt-outs everywhere

Synchronise opt-outs across CRM, messaging, email and advertising tools.

Sensitive data and profiling

The law gives special protection to sensitive data, including health, genetic, credit and certain other categories. Marketing that uses such data for targeting, such as health conditions inferred from purchases or financial status used for segmentation, needs careful legal review and may not be appropriate at all.

Profiling and personalisation should also be proportionate and transparent. Customers should understand, through clear privacy notices, what data is collected and how it is used. Collecting data just because a tool makes it possible increases risk without necessarily improving results.

Data transfers outside Saudi Arabia

Many marketing tools used in Saudi Arabia are hosted abroad: CRMs, email platforms, analytics, customer data platforms and advertising services. The law and its transfer regulations set conditions for transferring personal data outside the Kingdom, including ensuring an adequate level of protection and meeting defined conditions for transfers.

Marketing teams should inventory where data goes, which suppliers process it, where they host it and what contractual and technical safeguards apply. Transfer questions are easier to solve during tool selection than after years of data have accumulated abroad.

Records, rights and breaches

Organisations need records of processing activities that describe what personal data they process, why, where it is stored, who receives it and how long it is kept. Marketing data should be part of those records, including lead forms, event registrations, loyalty programmes and advertising audiences.

Individuals have rights, including access to their data, correction and destruction in defined circumstances. Requests should be routed to people who can find data across all systems. Personal data breaches must be reported to SDAIA within the prescribed period, generally within 72 hours of becoming aware of the breach, and affected individuals notified in certain cases.

A practical marketing checklist

Map every marketing data source and tool. Review consent collection on forms, apps, WhatsApp and events. Separate service and marketing permissions. Test opt-outs across systems. Identify sensitive data used in segmentation. Check supplier hosting and transfer safeguards. Update privacy notices. Define retention periods for leads and inactive contacts. Prepare a breach response process that includes marketing systems.

Compliance can also improve marketing performance. Clean, consented contact lists produce better engagement, fewer complaints and more reliable reporting than large lists of uncertain origin.

This article is a general overview for planning marketing systems. Organisations should confirm their obligations with legal advisers familiar with Saudi data protection law.

Where this sits in what we do

This article covers one decision inside a wider engagement. The solution page sets out how that engagement runs, what it includes and what it costs to find out.

• Marketing Automation — CRM, lead capture and automated follow-up built as one system — so nothing arrives in an inbox and nothing depends on someone remembering.
• The EU AI Act: what actually applies from 2 August 2026
• Belgium's B2B e-invoicing mandate: the January 2026 big bang
• Search Console page indexing statuses: what “discovered” and “crawled – currently not indexed” actually tell you
• SEPA instant payments and Verification of Payee: what the Instant Payments Regulation changes for businesses
• All insight articles