Summary in 3 points:
- Saudi Arabia’s Personal Data Protection Law requires customer consent before you send marketing messages, plus an easy way to stop them at any time.
- Collect as little data as possible, use it only for the purpose you collected it for, and set a clear retention period.
- Customers have the right to access, correct and request deletion of their data, and health data is sensitive and needs extra care in clinics.
“I have thousands of numbers from store orders. Am I allowed to send them offers on WhatsApp directly?” We get this question a lot from store, salon and clinic owners. The short answer: having the number isn’t enough. What matters is the customer’s consent to marketing messages, and how you use their data afterward.
In this guide we explain the key points of the Personal Data Protection Law for WhatsApp marketing, in practical terms, with a checklist you can apply in your store today.
Note: This article is general information for awareness, not legal advice. For specific cases, consult your legal advisor or the law’s official sources.
What is the Personal Data Protection Law and who enforces it?
The Personal Data Protection Law (PDPL) is a Saudi law that governs how personal data is collected, used, stored and shared. The authority responsible for it is the Saudi Data and AI Authority (SDAIA). The law came into force in September 2023, and compliance has been required since September 2024.
A customer’s name, mobile number, address, order history and chats are all personal data. So if your store, salon or clinic keeps this data and messages customers on WhatsApp, the law applies to you.
Do I need customer consent before sending marketing messages?
Yes. Article 25 of the law, based on our review of its published text, states that a customer’s personal contact channels may not be used to send advertising or marketing material without their consent, and that a mechanism must be provided to let them stop these messages. A mobile number and WhatsApp are among the clearest of these channels.
WhatsApp’s own business policy also requires customer opt-in before you message them, and bans messaging numbers that haven’t agreed. So compliance protects you on two fronts: Saudi law, and your account quality with Meta.
In practice, separate two types of messages:
- Service and operational messages: order confirmation, shipping, appointment reminders. These are part of the service the customer asked for.
- Marketing messages: offers, discounts and new products. These need separate, explicit consent.
How do I get customer consent the right way?
Good consent is clear, specific and provable. These steps are enough for most stores:
- Add a separate option on the checkout or sign-up page with clear text, such as “I agree to receive offers on WhatsApp”.
- Leave the option unticked by default. The customer is the one who chooses it.
- Save the date and source of consent, such as the checkout page, a specific ad or a message from the customer.
- Put a stop button in every marketing message, such as “Stop offers”.
- When a customer taps the stop button, stop offers to them across all your campaigns, not just one.
- Review your list regularly, and remove numbers that withdrew their consent or are no longer active.
Remember that marketing message templates go through Meta review before sending. We explain how to write them in our WhatsApp message templates guide. To send campaigns the official way, read our guide to official WhatsApp bulk messaging.
What data can I collect and how long can I keep it?
One of the law’s principles is to collect the minimum data needed for the purpose, and to use it only for that purpose. So if you took a customer’s number to deliver their order, using it later for offers requires their consent to marketing.
Don’t ask for what you don’t need. Date of birth, for example, isn’t needed unless you plan to send a greeting or an offer for the occasion, with the customer’s consent.
The same goes for retention: don’t keep chats and data forever. Set a clear period, and delete what has served its purpose or convert it into a form that doesn’t reveal who it belongs to.
This table sums up the principles and how they apply to WhatsApp:
| Principle | In short | Applying it on WhatsApp |
|---|---|---|
| Consent | No marketing without explicit consent | A separate opt-in for offers, with its date saved |
| Easy opt-out | Customers stop messages whenever they want | A “Stop offers” button in every marketing message |
| Purpose limitation | Data is used for the purpose it was collected for | A delivery number doesn’t join the offers list automatically |
| Data minimization | Collect only what you need | Don’t ask for extra data in the chat without a reason |
| Retention period | Don’t keep data forever | A set period for chats, and deletion of what has served its purpose |
| Access security | Each employee sees only what concerns them | A shared inbox with permissions instead of a shared phone |
What rights do customers have over their data?
Customers have the right to know what data you hold about them and why you collected it, to ask to see it or get a copy, to ask for it to be corrected if it’s wrong, to ask for it to be deleted when it’s no longer needed, and to withdraw their consent to marketing.
Set up a clear way to receive these requests, such as a dedicated email address or a keyword the customer sends on WhatsApp, and assign an employee to respond within a reasonable time.
Where are WhatsApp messages stored, and what about transfers outside Saudi Arabia?
The law regulates the transfer of personal data outside the Kingdom under specific controls. Here you need to know how the service works: WhatsApp messages themselves pass through Meta and are processed under its terms and policies, because WhatsApp is a service run by Meta. That’s why we don’t promise to keep WhatsApp message content inside Saudi Arabia.
The Watsio app and its database, however, are hosted in Saudi Arabia. We suggest stating in your store’s privacy policy that you communicate with customers via WhatsApp, and reviewing the transfer rules that apply to your business with your legal advisor.
When you choose any service provider, ask: Where is my customers’ data stored? Who processes it? How do I delete it when needed?
I run a clinic. What’s different?
Health data is sensitive data under the law and needs a higher level of protection. Don’t send diagnoses or test results in marketing messages, and don’t build offers on a patient’s health condition without a clear legal basis.
Keep WhatsApp to appointments and administrative matters, and limit access to patient chats to the team members who need it. More details in our WhatsApp for clinics guide.
Quick checklist for your store
- A separate consent option for offers, unticked by default.
- A record that saves the date and source of consent.
- A stop button in every marketing message that stops all campaigns.
- A privacy policy published on your website that names WhatsApp as a contact channel.
- A set retention period for chats and data.
- A clear way to handle access, correction and deletion requests.
- Permissions for each employee, immediate removal of leavers’ accounts, and no sharing of customer files in internal groups.
Compliance also lowers your costs. Sending a marketing campaign to a thousand customers who opted in costs about SAR 220 (1,000 × 0.22) under Meta’s current tariff, instead of sending it to a full list where most people aren’t interested. You can calculate your cost with the WhatsApp cost calculator.
How does Watsio help?
Watsio runs on Meta’s official WhatsApp, and its app and database are hosted in Saudi Arabia. Your team replies from the Watsio web dashboard with permissions for each employee instead of a shared phone, and the AI assistant hands chats over to staff when needed. Plans start from Lite at SAR 79 per month before VAT, and Salla, Zid, Shopify and WooCommerce integrations come from Starter at SAR 199 before VAT. See Watsio for online stores.
Related articles: How to reduce the risk of your number being banned in campaigns and The WhatsApp team inbox. You can also check Watsio plan prices and try it free for 14 days, no card needed.
Frequently asked questions
If a customer bought from me, can I send them offers on WhatsApp?
A purchase lets you send service messages about their order, such as confirmation and shipping. Marketing offers need separate, explicit consent to marketing, with a stop button in every message.
What should I do if a customer taps the stop-offers button?
Stop marketing messages to them across all your campaigns immediately, and save the opt-out date. You can keep sending service messages about their existing orders.
Are WhatsApp messages stored inside Saudi Arabia?
WhatsApp messages themselves pass through Meta and are processed under its terms, so we don’t promise to keep their content in Saudi Arabia. The Watsio app and its database, however, are hosted in Saudi Arabia.
Does this article replace a legal advisor?
No. This article is general information for awareness, not legal advice. For specific cases, especially health data or transfers outside Saudi Arabia, consult a legal advisor and SDAIA’s official sources.
Read next
- Protect Your Business WhatsApp from Hacks and Scams (2026)
- “Your account is restricted right now”: why and how to fix it
- WhatsApp Status Ads and Promoted Channels: A Business Guide
Sources
- SDAIA Data Governance Platform: Personal Data Protection Law
- Saudi Data and AI Authority (SDAIA)
- WhatsApp Business Policy
Last updated: November 2026 · Watsio team.
