Saudi PDPL and UAE PDPL for B2B marketers: consent, lists and retargeting

We are a marketing agency, not a law firm. This article summarizes published legal analysis so marketing teams can ask better questions and build compliant systems. Confirm your position with qualified counsel in each country, especially for sensitive sectors, cross-border transfers and anything involving government entities.

The table compares the points that matter most for B2B marketing teams.

Two other regimes often appear in the same programs. The DIFC and ADGM financial free zones in the UAE have their own data protection laws, so an entity or contact inside them follows different rules. Qatar has had a personal data privacy law since 2016, Law No. 13 of 2016, which prohibits unsolicited electronic direct marketing, with fines reported of up to QR1 million.

The most common risk we see is imported lists: event badge scans, purchased databases, a partner's contacts or a salesperson's address book loaded into the marketing platform and emailed. Under consent-based rules, those contacts usually cannot be added to marketing emails without their consent.

• Do not email bought lists. Use them, if at all, for account research and for one-to-one sales outreach that your counsel has approved.
• Event scans: show a clear consent statement at the scan or on the badge registration, and record it with the event name and date.
• Partner leads: get the partner to collect consent for your company by name, and keep the evidence.
• Existing customers: confirm the basis for marketing to them; in Saudi Arabia the October 2026 draft would require controllers to verify valid consent where a prior relationship is relied on.

Every form that feeds marketing should carry a clear consent statement and an unticked checkbox for marketing, separate from any request for a meeting or a document. The same applies to LinkedIn lead gen forms and to forms behind click-to-WhatsApp conversations. Sync the consent value, source and date to the CRM in real time, not by monthly import.

WhatsApp deserves its own rule. If sales or marketing sends promotional messages on WhatsApp, treat it as direct marketing, record consent, and run it through a business account connected to the CRM rather than personal phones. Our guide to measuring pipeline when GCC deals close on WhatsApp covers the setup.

Retargeting and matched audiences use personal data, either through cookies and pixels or through uploaded contact lists. Chambers notes that the UAE has no specific cookie law but that existing data protection law applies to cookies, and that consent should be obtained before cookies are used with clear options to opt out. In Saudi Arabia, the October 2026 draft would extend the marketing rules from direct messages to all processing of personal data for marketing, and require that data generated from that processing be destroyed when consent is withdrawn.

Our recommendations for GCC sites: a consent banner that blocks marketing tags until accepted, server-side tagging where possible, hashed identifiers for audience uploads, uploads limited to contacts with marketing consent, and a process to remove withdrawn contacts from every platform audience. Company list targeting on LinkedIn, which uses company names rather than personal data, is a lower-risk way to reach accounts.

These are the fields our RevOps team adds before any GCC campaign launches.

1. Country of residence and country of the account, so the right regime applies.
2. Legal entity and free zone flag (for example DIFC or ADGM) where it changes the rules.
3. Marketing consent status, source, date and the exact wording shown.
4. Opt-out date and channel, synced to every email, messaging and ad platform.
5. Lawful basis for non-marketing processing, recorded by your legal team.
6. Data location and transfer route for each system that stores contacts outside the country.

Saudi Arabia: the October 2026 draft amendments to the Implementing Regulations, summarized by Clyde & Co, would tighten consent evidence for marketing, require local storage of personal data while still allowing transfers under the law, make controller registration mandatory where data is transferred abroad, and apply the 72-hour breach notice to all breaches. The consultation ran from October 6 to November 5, 2026; if adopted, the changes would take effect 60 days after publication.

UAE: watch for the executive regulations and for the Data Office becoming fully operational, which would likely bring more active enforcement. Build to the law as written now rather than waiting.

We work with clients across the GCC from Montreal and build consent-ready CRM and campaign setups with your legal team.

See our RevOps service for the full scope.

Our page on RevOps in Saudi Arabia covers the local consent and country fields.

For a review of your forms, lists and audiences, talk to our team.