Saudi PDPL and WhatsApp marketing for online stores

What is the Saudi PDPL and who enforces it?

The Personal Data Protection Law (PDPL) was issued by Royal Decree M/19 of 9 Safar 1443 AH and amended by Royal Decree M/148 of 5 Ramadan 1444 AH. Its Article 43 made it effective 720 days after publication in the Official Gazette, which is 14 September 2023, and a one-year transition period followed that ended in September 2024. It applies to processing personal data of individuals in the Kingdom, including by organisations outside the Kingdom that process data of residents (Article 2).

The Saudi Data and AI Authority (SDAIA) oversees it. In January 2026 the Saudi Press Agency reported that SDAIA's violation committees issued 48 decisions in 2025 under Article 36, and that the violations included sending advertising and marketing messages to people without their consent. Article 36 allows a warning or a fine of up to SAR 5 million for violations by private-sector entities, and a repeat violation can double the fine.

• SDAIA National Data Governance Platform: the PDPL text (Arabic)
• Saudi Press Agency: PDPL committees impose penalties on confirmed violations

Is a WhatsApp promotion direct marketing under the PDPL?

The Implementing Regulations define Direct Marketing as communicating with the data subject by any direct physical or electronic means in order to direct marketing material, including advertisements and promotions. In plain terms, a sale announcement, a discount code or an abandoned-checkout reminder with an offer, sent to a customer's WhatsApp number, fits that wording.

The Law adds two rules. Under Article 25, a controller may not use a person's personal communication channels to send advertising unless the person consented and the sender gives a clear way to stop. Under Article 26, non-sensitive personal data may be processed for marketing if it was collected directly from the person and they consented.

• SDAIA: Implementing Regulations of the PDPL (English PDF)

What does valid marketing consent look like?

Article 11 of the Implementing Regulations sets the conditions listed below. For a Shopify store, that points to a separate, unticked checkbox for WhatsApp offers, worded apart from order updates, plus your own record of when and where each customer opted in. A purchase alone is not marketing consent, and neither are numbers imported from other channels. Shopify keeps marketing preferences per channel on each customer, including Accepts WhatsApp marketing.

• Consent is given freely and not obtained through misleading methods.
• The purposes are clear and specific, and explained before or when you ask.
• It is given by a person with full legal capacity.
• It is documented in a way that allows later verification, for example a register recording the time and the means of consent.
• A separate consent is obtained for each processing purpose.

• Shopify Help Center: Managing customers (marketing preferences)

How must the opt-out work?

Article 29 of the Implementing Regulations sets the rules for direct marketing, and Article 12 covers withdrawal of consent. WhatsApp's own Business Messaging Policy points the same way: it requires opt-in permission and respect for any request to opt out, on or off WhatsApp. Checkbox wording you can copy: Send me offers and new arrivals from {store} on WhatsApp. I can opt out anytime by replying STOP. Footer for every promotion: Reply STOP to opt out.

• Give a way to stop receiving marketing material whenever the customer wants, at least as simple as giving consent. Replying STOP is one message.
• Disclose the sender clearly: put your store name in the first line.
• When a customer withdraws consent, stop sending marketing material without undue delay, and do the same for withdrawals made another way, such as telling your support team.
• Set up the withdrawal process before you ask for consent, as Article 12 requires.

• WhatsApp Business Messaging Policy

Do order confirmations and tracking messages need marketing consent?

A confirmation or shipping notice about an order the customer placed is not direct marketing, and Article 6 of the Law lists processing under an agreement the person is party to among the cases where consent is not required. Treat these as transactional and keep promotions out of them, because an order message with a discount code becomes marketing.

WhatsApp Pilot follows the same split. Order Confirmation, Order Fulfillment and Order Cancellation do not need marketing consent. Abandoned Cart Recovery and Repeat Purchase follow Shopify's WhatsApp marketing consent and skip opt-outs and STOP replies.

What should a Shopify store do to follow the rules?

1. Publish a privacy policy where you collect data. Article 12 of the Law asks for one covering the purpose, the data collected, how it is stored, processed and destroyed, and the person's rights.
2. Tell customers at collection who you are, why you collect their number, whether giving it is mandatory or optional, who receives it and whether it goes outside the Kingdom (Article 13).
3. Add a separate, unticked WhatsApp offers checkbox at checkout and on sign-up forms.
4. Record when, where and how each customer opted in.
5. Add your store name and an opt-out line to every promotion, and honour STOP the same day.
6. Review Message History in WhatsApp Pilot, which logs each send, skip and failure with the reason, including skips for missing consent.
7. Check the current text on SDAIA's platform, since regulations can change, and ask a Saudi lawyer about your case.

• Shopify Help Center: Adding store policies
• Shopify Help Center: Privacy