PDPL Marketing Consent vs UK GDPR: Rules in the UAE, Saudi Arabia, Qatar and the UK

PDPL marketing consent is the permission the UAE and Saudi personal data protection laws (both known as the PDPL) expect before you send someone marketing, and Qatar's Law No. 13 of 2016 is similar. For email, SMS and WhatsApp, plan on opt-in consent and an easy opt-out in every message. The UK adds a "soft opt-in" for existing customers.

This article is general information, not legal advice. It reflects laws and regulator guidance published as of April 2026.

Which law covers your marketing data in each market?

Four regimes matter, plus two UAE financial free zones with their own rules.

• UAE: Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, in force since 2 January 2022 and supervised by the UAE Data Office.
• DIFC and ADGM: the federal law excludes free-zone companies that have their own data protection legislation (Article 2), such as firms under the DIFC's Data Protection Law (DIFC Law No. 5 of 2020) and ADGM's Data Protection Regulations 2021. Both let people object to direct marketing at any time (DIFC Article 34, ADGM section 19), and ADGM fines can reach USD 28 million (section 55).
• Saudi Arabia: the Personal Data Protection Law, issued by Royal Decree M/19 (9/2/1443H) and amended by Royal Decree M/148 (5/9/1444H). SDAIA, the Saudi Data and AI Authority, publishes the law, its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom.
• Qatar: Law No. 13 of 2016 on Protecting Personal Data Privacy, published in English by the National Cyber Security Agency (NCSA).
• UK: the UK GDPR and the Privacy and Electronic Communications Regulations (PECR), enforced by the Information Commissioner's Office (ICO).

What does the UAE PDPL require for marketing consent?

Consent is your working legal basis. Article 4 prohibits processing personal data without the owner's consent, and its list of exceptions includes no general "legitimate interests" ground.

• Valid consent: a "clear positive statement or action" that you can prove, requested in a clear, simple and easily accessible way, with an easy right to withdraw (Article 6 and the law's definition of consent).
• Objection: people can stop processing for direct marketing, including related profiling (Article 17).
• Transfers: allowed to countries with adequate data protection laws, as approved by the Data Office (Article 22), or through listed routes such as a binding contract or explicit consent (Article 23).

SMS, WhatsApp and calls in the UAE

Cabinet Resolution No. 56 of 2024, in force since 27 August 2024, defines telemarketing to include marketing text messages and marketing messages through social media applications. It covers companies licensed in the UAE, including those in financial free zones such as the DIFC and ADGM. Companies need prior approval from their licensing authority, must use local numbers registered to their commercial license, must not call numbers on the Do Not Call Register (DNCR) and may make marketing calls only between 9:00 am and 6:00 pm.

Executive regulations and penalties

The executive regulations were due within six months of the law (Article 28), but as of April 2026 they had not been published on the UAE legislation portal. Controllers get six months to comply once they are issued (Article 29), and the Cabinet will set penalties by decision (Article 26). There is no PDPL fine schedule yet.

What are the PDPL marketing consent rules in Saudi Arabia?

Saudi Arabia's PDPL bans using someone's "personal means of communication, including the post and email" to send advertising without their prior consent, and requires a clear way to stop receiving it (Article 25).

• Collected directly: Article 26 allows marketing use only of data collected directly from the person, with their consent, and never of sensitive data. A bought or scraped list fails that test.
• Documented consent: the Implementing Regulation requires consent that is freely given for clear purposes, recorded with its time and method, and separate for each processing purpose (Article 11).
• Every message: name the sender, offer a free opt-out at least as easy as opting in, stop as soon as someone asks and keep evidence of consent (Articles 28 and 29).
• Telecom rules: both articles apply "without prejudice to the Telecommunication and Information Technology Act", so check telecom rules for SMS too. Treat WhatsApp like any other personal means of communication.

Transfers and penalties in Saudi Arabia

Transfers abroad are allowed for set purposes, including central processing and serving the person. If the destination is not on SDAIA's adequacy list, defined cases can rely on SDAIA's standard contractual clauses, binding common rules or an accreditation certificate, after a risk assessment.

Breaches bring a warning or a fine of up to SAR 5 million, which can be doubled for a repeat violation, to a maximum of SAR 10 million (Article 36). Disclosing or publishing sensitive data to harm someone or for personal benefit can mean up to two years in prison, a fine of up to SAR 3 million, or both (Article 35).

How does Qatar's law treat direct marketing?

Qatar's Law No. 13 of 2016 forbids sending any electronic communication for direct marketing without the person's prior consent (Article 22).

• Every message must identify the sender, say it is for direct marketing and include a valid address where the person can ask you to stop or withdraw consent.
• Special data: data on children, health, ethnic origin, religious creeds and some other categories needs permission from the competent department before processing (Article 16).
• Transfers: Article 15 stops controllers from limiting cross-border data flows unless the processing breaches the law or could cause serious damage. The law sets no data residency rule.
• Penalties: breaching Article 22 can bring a fine of up to QAR 1,000,000 (Article 23). Security, special-data and children's-website breaches carry up to QAR 5,000,000 (Article 24).

What are the UK GDPR email marketing consent rules?

In the UK, PECR sits alongside the UK GDPR. According to the ICO's guidance on electronic mail marketing, you must not send marketing emails or texts to individuals without specific consent, such as an opt-in box, unless the soft opt-in applies.

• What counts: the ICO lists emails, texts, picture and video messages, voicemails and "direct messages via social media or any similar message that is stored electronically". Treat WhatsApp marketing the same way.
• Soft opt-in: you can email or text existing customers who bought, or negotiated to buy, a similar product or service from you, if you gave them a simple way to opt out when you collected their details and in every message.
• B2B: you can email or text corporate bodies, such as companies, LLPs and government bodies. Sole traders and some partnerships count as individuals.
• Every message: do not hide your identity, and give a valid contact address for opt-outs.

What changed in the UK in 2026?

Most of the remaining data protection provisions of the Data (Use and Access) Act 2025 came into force on 5 February 2026, the ICO said. The ICO can now issue PECR fines of up to £17.5 million or 4% of global turnover. Its PECR guidance is under review because of the Act.

PDPL vs UK GDPR: how do the marketing consent rules compare?

The biggest gap is the UK's soft opt-in and B2B exemption. None of the Gulf laws covered here sets out either.

• Email and SMS to individuals: UAE, Saudi Arabia and Qatar: prior consent vs UK: consent or the soft opt-in.
• Business contacts: Gulf laws: no corporate exemption in the texts vs UK: corporate bodies can be emailed without consent.
• Maximum fines: UAE PDPL: awaiting a Cabinet decision vs Saudi Arabia: SAR 5 million (SAR 10 million for repeats) vs Qatar: QAR 1,000,000 for marketing breaches vs UK: £17.5 million or 4% of global turnover under PECR.

Worked example: how many contacts can you email?

Example (illustrative numbers): a Dubai-based retailer plans a White Friday email to 40,000 contacts: 22,000 in the UAE, 12,000 in Saudi Arabia, 4,000 in Qatar and 2,000 in the UK.

1. The consent audit finds documented opt-ins (date, time, method and wording) for 13,200 UAE, 8,400 Saudi and 2,600 Qatari contacts.
2. In the UK, 900 contacts opted in, and 700 more are customers who bought a similar product and were offered an opt-out at checkout and in every email.
3. The sendable list is 13,200 + 8,400 + 2,600 + 900 + 700 = 25,800 contacts, or 64.5% of the database.
4. The other 14,200 stay out until you collect a fresh opt-in, for example on your site or in your app.

A checklist for campaigns across the UAE, Saudi Arabia, Qatar and the UK

1. Tag every contact with its regime: UAE federal, DIFC, ADGM, Saudi Arabia, Qatar or UK.
2. Store consent evidence: date, time, method, wording and channel. The UAE law puts the burden of proof on you.
3. Ask for a clear positive action, such as ticking an empty box, with a separate consent for each purpose.
4. Put your sender name and a free, working unsubscribe in every message, and sync opt-outs across your CRM, email, SMS and WhatsApp tools straight away.
5. In the UAE, confirm your telemarketing approval before SMS, WhatsApp or call campaigns, and screen call lists against the DNCR.
6. Don't use bought lists for Saudi campaigns, and record the transfer basis for each vendor that stores data abroad.
7. Add a sign-off step so legal or compliance approves new audiences and new uses of data before launch.

How Grower helps

Grower does not replace your consent platform or your lawyer. It makes campaign decisions reviewable. Enterprise controls in Streamline let you run separate organizations and departments, set permissions per campaign group and keep a full log of every user action, so you can show who changed what and when. Approval-first workflows route every creative and change to the right approver, the same approvals and audit logs described for regulated teams on our fintech page. Grower also integrates with HubSpot and Mailchimp as well as the major ad channels.

Frequently asked questions

Is the UAE PDPL in force without executive regulations?

Yes. Article 31 says the decree-law came into force on 2 January 2022. But Article 29 gives controllers six months to adjust once the executive regulations are issued, and Article 26 leaves penalties to a Cabinet decision. As of April 2026 the executive regulations had not been published.

Is there a soft opt-in in Saudi Arabia or the UAE?

Not in the UK sense. Neither law sets out a soft opt-in for existing customers. Saudi Arabia's Implementing Regulation mentions "prior interaction" in Article 28, but Article 25 of the law still requires the recipient's prior consent for advertising. The safest plan in both markets is documented opt-in consent and an opt-out in every message.

Does marketing consent apply to WhatsApp?

Treat it that way. Saudi Arabia's PDPL covers personal means of communication, the UAE telemarketing rules include marketing messages through social media applications, and the ICO counts direct messages via social media or similar stored messages as electronic mail. Get opt-in consent before you message customers on WhatsApp, and honor opt-outs straight away.

Running one campaign across four sets of rules? Book a demo to see how approvals, permissions and user logs work in Grower before your next Ramadan or White Friday send.