The short answer

The general rule in Saudi Arabia is that an organisation that wants to send you its offers and adverts needs your consent first. Every message must clearly name the sender and let you stop the messages free of charge, by a process at least as easy as the one for giving consent. You can withdraw your consent at any time, and the messages must then stop without undue delay. If they don't, you can complain to the Saudi Data and AI Authority (SDAIA).

This page is general information drawn from the official texts, not legal advice.

Which law covers this?

The Personal Data Protection Law, issued by Royal Decree No. (M/19) dated 9/2/1443H and amended by Royal Decree No. (M/148) dated 5/9/1444H, together with its Implementing Regulation (SDAIA, law text). The law came into force on 14 September 2023, and organisations had a one-year grace period to comply, which ended on 14 September 2024 (SDAIA guide). The Implementing Regulation applies from the date the law came into force (Regulation Article 38) (SDAIA, Implementing Regulation). SDAIA is the authority that enforces it.

The Arabic texts are the official ones. Quotations below use SDAIA's English translation (law; regulation).

What counts as direct marketing?

The Implementing Regulation defines it as communicating with the data subject "by any direct physical or electronic means with the aim of directing marketing material; this includes but is not limited to advertisements or promotions" (Regulation Article 1). So the definition does not depend on the channel, whether it is a text message, an email or something else.

As a general rule, yes. Three articles deal with this:

  • Law Article 25. An organisation that controls your data (the "controller", which decides why and how your data is processed) may not use your personal means of communication, including your postal and email addresses, to send advertising or awareness materials unless it has your consent and gives you a clear way to stop them. Awareness materials sent by public bodies are exempt.
  • Law Article 26. Personal data may be processed for marketing purposes if it was collected directly from you and you consented. This does not extend to sensitive data.
  • Regulation Article 29. Before processing your data for direct marketing, the controller must obtain your consent under Article 11 of the Regulation.

What makes consent valid? Regulation Article 11 requires consent to be given freely and not through misleading methods. The purposes must be clear and specific and explained to you before or when consent is requested. Consent must be documented so that it can be verified later, and there must be separate consent for each purpose. Consent may not be made a condition of providing a service or benefit, unless the service or benefit is related to the processing consented to (Law Article 7). So agreeing to the terms for opening an account, for example, is not a substitute for separate consent to marketing messages.

What if I am already a customer? There is a detail worth knowing here. Regulation Article 28, on advertising and awareness materials, requires prior consent "in case of the absence of a prior interaction between the Controller and the targeted recipient". Regulation Article 29, on direct marketing, requires consent without that qualification. In both cases the other duties still apply: the sender must be named, there must be an easy, free way to stop, and the messages must stop when you ask.

The law lets you withdraw your consent at any time (Law Article 5). The Implementing Regulation adds:

  • The process for opting out must be "easy, straightforward, and at least as easy as" the process for giving consent to receive the messages (Regulation Articles 28 and 29), and stopping must be "free of charge" (Article 28).
  • Advertising messages must stop as soon as you ask (Article 28), and direct marketing must stop without undue delay once you withdraw consent (Article 29).
  • You can tell the organisation by any available means. It must then notify anyone it has disclosed your data to and ask them to destroy it (Regulation Article 12). Withdrawal does not affect processing done before it, or processing based on another legal ground (Article 12).

Practical steps:

  1. Use the opt-out in the message itself, such as an unsubscribe link in an email or a stop code in a text message.
  2. If that doesn't work, write to the organisation directly by email, through its app or any channel it offers (Regulation Article 10), and say that you withdraw your consent to marketing. Keep a copy of your request and its date.
  3. Take screenshots of any message that arrives afterwards, with the date, time and sender's name.

Where can I complain?

To SDAIA, about anything involving your personal data. You can complain to the competent authority (Law Article 34) within 90 days of the incident or of when you learned of it (Regulation Article 37). SDAIA's data governance platform has a service for "filing a complaint related to personal data" (SDAIA platform). The Regulation says a complaint should include the place and time of the violation; your name, identification, address and telephone number; details of the organisation complained about; and a clear, specific description of the violation with the evidence (Article 37). The law allows a warning or a fine of up to 5 million riyals for anyone who breaks the law or its regulations (Law Article 36).

To the Communications, Space and Technology Commission (CST), about text messages and nuisance calls. The Regulation's marketing rules apply "without prejudice to the Telecommunication and Information Technology Act" (Regulation Articles 28 and 29). CST has its own Regulations for Curbing SPAM Messages and Calls (Decision No. 493/1444, dated 17 October 2022). On its Spam Reports page, CST says:

  • Advertising messages carry the sender's name followed by "-AD", such as XXXX-AD, "while the source of most fraudulent messages is from unknown numbers".
  • Telecom providers offer subscribers a service to refuse text messages from some or all electronic addresses, with stop codes listed in CST's guide.
  • To report a number that repeatedly contacts you to disturb you, by calls or messages, use the reports service on CST's Mutasil platform after logging in through the national unified access service (Nafath), or call CST's call centre on 19966.

Scam messages are not marketing. A message that promises you a prize or asks for your bank details is a different matter. CST says fraud reports are outside its remit. You can forward the message free of charge to 330330, or report it to Public Security through the regional police or the Kollona Amn app.

Where does AI come in?

A lot of marketing is now automated: systems choose who gets an offer, draft the message and send it at the moment they predict will catch your attention. The law has no rules written specifically for AI-driven marketing, but its general rules apply to it:

  • The channel doesn't change the rule. The definition of direct marketing covers "any direct physical or electronic means", so a message drafted or sent by an automated system is subject to the same consent and opt-out rules.
  • No sensitive data in marketing. Sensitive data under the law includes health and genetic data, biometric data that identifies a person, and data about a person's racial or ethnic origin or religious, intellectual or political belief (Law Article 1). This data may not be processed for marketing even with your consent, as SDAIA's guide explains with reference to Law Article 26.
  • Data you gave them yourself. Law Article 26 permits marketing use of data that was collected directly from you, with your consent.
  • A written impact assessment. A controller must prepare a written, documented assessment of impacts and risks in cases that include collecting, comparing or linking two or more sets of personal data from different sources, processing personal data "using new technologies", and "making decisions based on automated Processing of Personal Data" (Regulation Article 25).
  • Your right to know. You have the right to be told the legal basis and purpose for collecting your data (Law Article 4), and the organisation must explain how you can withdraw your consent (Regulation Article 4).

For your rights when an AI system makes a decision about you, such as screening a job application or scoring a loan, see Your data rights when AI is involved.

Changes under discussion

In October 2026 SDAIA opened a public consultation on amendments to the Implementing Regulation (Clyde & Co, 8 Oct 2026; Al Tamimi & Co, 9 Oct 2026); a summary is on our data-rights page. Until any amendments are adopted, the articles cited here are the ones in force.

Sources