Delta Medical Labs<\/a>, a Saudi medical lab, reached more than 1 million monthly organic visits during an engagement that began in March 2026. It also holds 1,186 keywords ranking #1 in Saudi Arabia. Organic visitors arrive by choice, with no list involved.<\/p>\nNone of this makes email, SMS or WhatsApp less useful. It makes them channels for people who already said yes.<\/p>\n
FAQ<\/h2>\nDo I need consent to email existing customers in Saudi Arabia?<\/h3>\n
Plan on yes. Article 28(1) of the Implementing Regulation, as published, ties the consent duty to recipients with no prior interaction. Article 25 of the Law, however, requires the recipient’s consent for advertising sent to personal addresses, with no exception for customers. Ask existing customers at checkout or in account settings, and log every answer.<\/p>\n
Can I buy a phone list for a Saudi SMS or WhatsApp campaign?<\/h3>\n
No safe version exists. Article 26 of the Law allows marketing use of personal data only when it was collected directly from the person, with consent, and never for sensitive data. The CST also bans numbers gathered by harvesting software, and WhatsApp’s own policy requires opt-in from every recipient you message.<\/p>\n
Does PDPL apply if our company is based outside Saudi Arabia?<\/h3>\n
Yes, when you process data about people living in the Kingdom. Article 2 of the Law covers processing carried out in Saudi Arabia and processing of residents’ data by any entity outside it. A Dubai or London team emailing Saudi residents is in scope, and its tools abroad also trigger the transfer rules.<\/p>\n
Someone asked us to stop messaging. How fast do we have to act?<\/h3>\n
Immediately. Article 28(3)(c) of the Implementing Regulation requires an immediate halt on request, and Article 12 says processing stops without undue delay once consent is withdrawn. For SMS, the CST sets an outer limit of 24 hours and requires a confirmation message. Automate suppression instead of relying on weekly manual exports.<\/p>\n
Will SDAIA publish the names of companies it fines?<\/h3>\n
It has not so far. The January 2026 announcement gave the count and violation types but no company names or amounts. Article 38 of the Law does allow a committee or court to order a summary of a final decision published in local newspapers at the violator’s expense, so public naming remains a live option.<\/p>\n
Where this leaves your next Saudi campaign<\/h2>\n
A narrower question matters more than the odds of a fine: can you show, for any number or address on your list, when and how that person said yes? The 48 decisions of 2025 tell you the committees ask exactly that question, and the Implementing Regulation tells you what an acceptable answer looks like.<\/p>\n
If you can export that proof today, spend the next sprint on the opt-out path, the -AD sender and the transfer clauses with your vendors, then keep sending. If you cannot, pause cold sends and fix the capture points first: forms, checkout, WhatsApp click-to-chat and store sign-ups. Every contact gathered from then on should carry its own consent record.<\/p>\n
Either way, the work is mostly plumbing. Consent logs, suppression lists and vendor clauses rarely appear in a campaign brief. They decide whether the campaign survives its first complaint.<\/p>\n
Want a pipeline that does not depend on lists at all? Help me grow a Saudi audience that comes to us first<\/a>.<\/p>\n