WhatsApp automation for Saudi Arabia, done to PDPL standard
The largest market in the Gulf, the strictest data rulebook, and an audience that expects to be spoken to in Arabic. We build conversational selling that respects all three.
- Saudi PDPL enforcement is live. The grace period ended 14 September 2024 and SDAIA had issued 48 enforcement decisions by early 2026.
- Marketing requires explicit consent. Unlike the GDPR there is no legitimate-interest route, and penalties reach SAR 5 million.
- It is extraterritorial. Sending from Paris or London to a Saudi resident puts you inside the law.
- The working week is Sunday to Thursday and the clock is UTC+3. Half of European campaign schedules land on the Saudi weekend.
- Arabic-first with English fallback is the setup that performs, not English with an Arabic translation bolted on.
Saudi Arabia is the market where compliance is the strategy
In most countries you can be sloppy with consent for a while. In the Kingdom that window has closed.
The PDPL compliance grace period expired on 14 September 2024. Since then every organisation processing the personal data of people in Saudi Arabia is required to comply, public or private, domestic or foreign. By early 2026 SDAIA had issued 48 enforcement decisions, and the violations reviewed explicitly include sending advertising and marketing messages without consent.
The detail that catches European companies out is the absence of a legitimate-interest basis. Under the GDPR a great many B2B outbound programmes lean on it. Under the PDPL, explicit consent is required in all cases and no alternative lawful basis may be substituted. A purchased list is not a lawful basis. A scraped list is worse.
This is not a reason to avoid the market. It is a reason to build the consent layer first, which is exactly what most of your competitors have not done. A clean, documented, opt-in Saudi list is a durable commercial asset and a genuine moat.
Build the opt-in, do not buy the list
Click-to-WhatsApp ads, QR at point of sale, website widget, checkout consent. Every entry arrives with its source and timestamp attached.
Consent that survives an audit
Per contact, per purpose, exportable. If SDAIA asks how you obtained a number, the answer is a query rather than a panic.
Opt-out that actually sticks
Withdrawal applies workspace-wide and cannot be undone by a later CSV import. That single rule prevents most complaints.
Data residency and transfers
We map where the data sits and what leaves the Kingdom, and document it, because cross-border transfer is a live PDPL question.
Arabic-first, and it has to be real Arabic
A machine-translated Arabic template is instantly recognisable and it costs you the reply. Modern Standard Arabic reads as formal and slightly official, which suits a bank and kills a retail promotion. Gulf dialect reads as human. Getting that register right matters more than any other single content decision in this market.
Our agents are trained on your own transcripts, so they learn how your team actually writes to Saudi customers. Right-to-left rendering, Arabic numerals, correct name and title handling, and the option to switch to English the moment the contact does.
We do not machine-translate your playbook and call it localisation. If you have no Arabic conversation history to train on, we say so at the diagnostic stage and we build the first version with a native speaker on the call.
What kills a European playbook here
Most Gulf deployments fail on operational detail, not on strategy.
- The week is not yours. Sunday to Thursday in Saudi Arabia and Qatar. A Friday send lands on their weekend.
- Two time zones. UAE is UTC+4, Saudi Arabia and Qatar UTC+3. One window is wrong for two markets out of three.
- Ramadan flips the day. Hours are cut, attention moves to the evening. It is also the strongest retail month of the year.
- Nobody writes in one language. Riyadh in Arabic. Dubai in English, Arabic, Hindi, Urdu and Russian, often the same day.
- Prayer times. A twenty-minute reply is not a cold lead. European follow-up timers re-fire far too early.
All of it is configuration. It just has to be set by someone who knows it exists.
What you are actually allowed to send
Outbound WhatsApp in the Gulf is legal. The way most agencies do it is not.
- Saudi Arabia. PDPL enforced since September 2024, 48 SDAIA decisions by early 2026. Explicit consent required, no legitimate-interest fallback, up to SAR 5 million. It applies even if you send from Europe.
- UAE. Federal Decree-Law 45/2021, implementing rules in Cabinet Decision 33/2024. Consent and a working opt-out on every send.
- Qatar. Law 13/2016, the first data law in the GCC. Same logic.
Consent per contact
Source, date and channel, stored and exportable. It survives a change of CRM.
One opt-out, everywhere
Applies across every campaign and line. No later import can undo it.
Local send windows
Your hours, local time. Nothing on the local weekend or a public holiday.
Audit trail
Who received what, from which line, on which legal basis.
Sectors we run in the Kingdom
Saudi Arabia is also where the Vision 2030 programmes generate an unusual amount of B2B lead flow: contractors, fit-out, facilities management, staffing and professional services all now run first contact through WhatsApp.
How we actually work
Three steps. You can stop after any of them.
Diagnostic
We read your real conversations, your portal leads and your current follow-up. You get a written audit: where the leads die, what a reply is worth to you, and what is realistically recoverable.
Activation
We set up the WhatsApp lines, write the conversation playbook with your team, and train an AI agent on your own transcripts so it sounds like your best closer rather than a chatbot.
Run
A monthly subscription: we keep the agent trained, run the campaigns, watch the numbers and adjust. Your team keeps selling instead of managing a tool.
Frequently asked questions
Is WhatsApp marketing legal in Saudi Arabia?
Yes, with explicit consent. The PDPL requires consent for marketing communications and offers no legitimate-interest alternative. Sending to a purchased or scraped list is a violation and SDAIA has issued enforcement decisions covering exactly that. With a documented opt-in and a functioning opt-out, WhatsApp is one of the most effective legal channels in the Kingdom.
Does the Saudi PDPL apply to my company if we are based in Europe?
Yes. The PDPL has extraterritorial reach: it applies to controllers outside the Kingdom that process the personal data of individuals inside it. Being registered in France or the UK does not put you outside its scope when you message a Saudi resident.
What are the penalties for non-compliant marketing?
Administrative penalties reach SAR 5 million, and there are criminal sanctions for intentional disclosure of sensitive data. Beyond the fine, the practical risk is reputational and operational: complaints drive WhatsApp quality ratings down and get your sending numbers restricted by Meta regardless of what a regulator does.
Do you write the Arabic, or do we?
We write it with you. The agent is trained on your existing Arabic conversations wherever they exist, because that is what produces a register your customers recognise. Where you have none, we build the first version alongside a native speaker and iterate on real replies rather than guessing.
When should we avoid sending in Saudi Arabia?
Friday and Saturday, the local weekend. Around prayer times. And during Ramadan daytime, when working hours are reduced and attention shifts to the evening. Ramadan evenings, on the other hand, are among the strongest engagement windows of the year for retail and hospitality. We set the windows per campaign in local time.
Can we use a +966 number?
Yes, and you should. A local sender materially improves reply rates and reduces the chance of being reported as spam. We handle the WhatsApp Business API registration and the display-name verification with Meta.
Start with the diagnostic
A 30 minute call, in English. We look at your current conversations and tell you plainly whether there is anything worth automating. If there is not, we will say so.
Book a 30 minute call