- The PDPL grace period ended on 14 September 2024. Enforcement is live.
- Explicit consent is required for marketing. There is no legitimate-interest fallback as under the GDPR.
- By early 2026, SDAIA had issued 48 enforcement decisions, including for marketing without consent.
- Administrative penalties reach SAR 5 million.
- The law is extraterritorial. Sending from Paris or London to a Saudi resident puts you in scope.
The trap for European companies
A great many B2B outreach programmes in Europe rely on legitimate interest as their lawful basis. Under the Saudi PDPL that route does not exist. Explicit consent is required in all cases and no alternative basis may be substituted.
A purchased list is therefore not a lawful basis. A scraped list is worse. Neither becomes acceptable because the messages are relevant or because the recipient is a business.
What compliant actually looks like
- Consent recorded per contact, with the source, the date and the channel it came from.
- A working opt-out in your messages, honoured across every campaign and every sending number.
- An audit trail of what was sent to whom and on what basis.
- A documented answer on data location and any transfer outside the Kingdom.
How you build a Saudi list legitimately
Click-to-WhatsApp ads, a widget on your site, QR codes at point of sale or at a showroom, event registration, and consent captured at checkout. Each entry arrives with its origin attached.
It is slower than buying a file. It is also the reason your open rates stay high and your number does not get reported, so the commercial argument and the legal one point the same way.
Why this is an opportunity, not an obstacle
Most of your competitors have not built this. A clean, documented, opt-in Saudi list is a durable asset that a rival cannot copy by buying the same file you did. Compliance here is not a cost centre, it is the moat.
Frequently asked questions
Does the PDPL apply if my company is based in Europe?
Yes. The law has extraterritorial reach: it applies to controllers outside the Kingdom that process the personal data of individuals inside it. Being registered elsewhere does not remove you from its scope.
Is B2B outreach exempt?
No. The PDPL protects personal data, and a named person at a company with a mobile number is personal data. There is no B2B carve-out equivalent to the one people assume under other regimes.
What happens in practice if we get it wrong?
Administrative penalties reach SAR 5 million. Before that, the practical damage is faster: complaints push your WhatsApp quality rating down and Meta restricts your sending number, regardless of what any regulator does.