- Bahrain: Personal Data Protection Law No. 30 of 2018, in force since August 2019, overseen by the Personal Data Protection Authority.
- Oman: Personal Data Protection Law issued by Royal Decree 6/2022, in force since February 2023, with executive regulations published in 2024.
- Kuwait: no standalone data protection law; CITRA’s Data Privacy Protection Regulation applies to communications and IT service providers, first issued in 2021 and revised since.
- In all three: get clear consent for marketing, honour opt-outs immediately, and follow Meta’s WhatsApp Business policy, which applies everywhere.
This guide gives you a practical overview, not legal advice. Laws and regulations change, and enforcement practice matters as much as the text. For a significant campaign, check with local counsel.
Country by country
| Bahrain | Oman | Kuwait | |
|---|---|---|---|
| Main text | Law No. 30 of 2018 (PDPL) | Royal Decree 6/2022 (PDPL) | CITRA Data Privacy Protection Regulation |
| In force | August 2019 | February 2023, regulations 2024 | 2021, revised since |
| Regulator | Personal Data Protection Authority | Ministry of Transport, Communications and IT | CITRA |
| Marketing | Consent-based; right to object to direct marketing | Consent required, with specific rules for marketing | Consent-based for covered providers |
| Practical takeaway | Opt-in and an easy opt-out | Explicit opt-in, keep records | Opt-in as best practice for all businesses |
Bahrain
Bahrain was the first GCC country with a comprehensive data protection law. It requires a lawful basis for processing, gives individuals the right to object to processing for direct marketing, and is overseen by the Personal Data Protection Authority. In practice: record how and when each contact agreed to receive WhatsApp marketing, and stop immediately when they object.
Oman
Oman’s PDPL came into force in February 2023 and its executive regulations were issued in 2024. It is administered by the Ministry of Transport, Communications and Information Technology. It is generally read as stricter than GDPR on consent, with specific requirements for marketing messages. Explicit opt-in, kept on record, is the safe approach.
Kuwait
Kuwait does not yet have a single comprehensive data protection law. CITRA, the communications regulator, issued a Data Privacy Protection Regulation that applies to service providers in its scope. For a business running WhatsApp campaigns, the safest reading is to behave as if consent rules applied: opt-in, clear identity, easy opt-out.
The rules that apply everywhere: Meta’s policy
Whatever the country, the WhatsApp Business Messaging Policy applies: businesses may only message people who have given their phone number and agreed to be contacted on WhatsApp, and must respect opt-out requests. Low-quality campaigns reduce your sending limits or get your number restricted, whatever the local law says.
A five-point checklist
- Collect opt-in on a form, at checkout or in a first conversation, with a sentence that names WhatsApp.
- Keep the record: date, source, wording shown.
- Identify yourself in every marketing message.
- Offer an opt-out in every marketing message and honour it at once.
- Send at local hours: Sunday to Thursday working week in Kuwait, Bahrain and Oman, Friday prayer respected. See the best time to send in the Gulf.
For the Saudi rules, which are stricter, read is WhatsApp marketing legal in Saudi Arabia. Country pages: Kuwait, Bahrain, Oman.
Sources: Bahrain Personal Data Protection Authority · Oman Ministry of Transport, Communications and IT · CITRA, Kuwait · WhatsApp Business Messaging Policy
Frequently asked questions
Is WhatsApp marketing legal in Kuwait?
Yes, with consent. Kuwait has no single data protection law yet, but CITRA’s regulation applies to providers in its scope, and Meta’s policy requires opt-in everywhere. Treat opt-in as mandatory.
Does Bahrain have a data protection law?
Yes: Law No. 30 of 2018, in force since August 2019, enforced by the Personal Data Protection Authority. People can object to direct marketing at any time.
What does Oman’s PDPL require for marketing?
Consent, with specific rules for marketing messages set by the law and its 2024 executive regulations. Explicit, recorded opt-in is the safe approach.
Do these laws apply to foreign companies?
They can, when you process data of people in these countries. Check with local counsel for your exact situation.