Saudi Arabia's PDPL for B2B sales and marketing
Tadas Jurelevicius, Co-founder & CEO, b2n.ai · · العربية
Saudi Arabia's Personal Data Protection Law (PDPL) was issued by Royal Decree M/19 of 9/2/1443H and amended by Royal Decree M/148 of 5/9/1444H. Unlike the UAE's law, it allows processing for legitimate interests. But it requires consent before sending promotional or marketing material to someone's personal contact details. This guide sets out the articles that matter for B2B sales and marketing.
Summary, not legal advice. For your own situation, ask a Saudi-qualified lawyer.
Quick answers
- Is consent the default? Yes. Personal data may not be processed, or used for a new purpose, without the owner's consent, except where the Law provides otherwise (Law, Article 5). Consent can be withdrawn at any time.
- Is there a legitimate-interests basis? Yes. Consent isn't needed where processing is necessary for the controller's legitimate interests, provided it doesn't harm the person's rights or interests and the data isn't sensitive (Law, Article 6(4)).
- Can I send promotional messages without consent? The Law says no. Apart from awareness material from public bodies, a controller may not use a person's personal contact details, including postal and email addresses, to send promotional or awareness material, unless the recipient has consented and there's a clear way to opt out (Law, Article 25).
- Does a named person's work email count as personal contact details? The texts don't say whether a named person's work email counts as 'personal contact details'. For your situation, ask a Saudi-qualified lawyer.
- When does consent apply under the Regulations? Consent is needed before sending promotional or awareness material where there has been no prior dealing between the controller and the recipient (Regulations, Article 28(1)).
- What must every promotional message do? Under Regulations, Article 28(3): name the sender clearly; offer an easy way to stop the messages, at no cost; stop immediately when asked; keep proof of consent.
- And direct marketing? Under Regulations, Article 29: consent under Article 11 of the Regulations; an easy way to stop receiving it; a clearly named sender; stopping without undue delay if consent is withdrawn.
Consent and its exceptions (Law, Articles 5 and 6)
Article 5 makes consent the rule, and the owner can withdraw it at any time. Article 6 lists the cases where consent isn't needed:
- processing in the person's actual interest, where contacting them is impossible or difficult;
- processing under another law, or to perform a prior agreement the person is party to;
- public bodies, for security or judicial purposes;
- the controller's legitimate interests, unless that harms the person's rights or interests, and never for sensitive data.
Promotional and marketing messages (Law, Articles 25 and 26; Regulations, Articles 28 and 29)
- Law, Article 25: no use of personal contact details, including postal and email addresses, for promotional or awareness material without the recipient's consent and a clear opt-out mechanism.
- Law, Article 26: apart from sensitive data, personal data may be processed for marketing if it was collected directly from the person and they consented.
Regulations, Article 28 (promotional or awareness material):
- consent where there's no prior dealing;
- consent must be freely given, without misleading methods;
- the recipient can choose which material they agree to;
- consent is documented so it can be verified later;
- the sender is named;
- opting out is easy, at least as easy as opting in, and at no cost;
- messages stop immediately when asked;
- proof of consent is kept.
Regulations, Article 29 (direct marketing):
- consent under Article 11 of the Regulations;
- an easy way to stop receiving marketing;
- a clearly named sender;
- stopping without undue delay if consent is withdrawn.
Saudi PDPL vs UAE PDPL vs GDPR: what matters for B2B outreach
| Saudi PDPL | UAE PDPL | EU GDPR | |
|---|---|---|---|
| Legitimate interests as a basis | Yes, not for sensitive data (Law, Art. 6(4)) | No (Art. 4) | Yes (Art. 6(1)(f)) |
| Promotional messages to personal contact details | Consent plus an opt-out (Law, Art. 25), where there's no prior dealing (Regs, Art. 28) | No specific article. The general consent rule applies (Art. 4), plus the right to object (Art. 17) | Set by the ePrivacy rules in each EU country |
| Opt-out | Easy, at no cost, immediate (Regs, Art. 28) | Right to object to direct marketing (Art. 17) | Absolute right to object (Art. 21) |
How b2n.ai works with these rules
- Every email says who it's from and has an unsubscribe link. The unsubscribe page explains where the contact details came from and links to our privacy policy.
- An opt-out or objection stops that client's outreach to the person straight away. Spam complaints and hard bounces are blocked across b2n.ai.
- Before our agents work in a market, we agree with the client how outreach runs there. The client is the sender, and decides with its own legal advice.