What does PDPL actually require when you message customers?

This is not legal advice, and you should take some. But the shape of the obligation is not complicated, and a lot of businesses are non-compliant for reasons that would take an afternoon to fix.

What the laws are

The UAE has Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. Saudi Arabia has its Personal Data Protection Law, administered by SDAIA. Both are broadly in the same family as the European GDPR: they give individuals rights over data about them, and they put obligations on whoever decides how that data is used.

If you run a business that stores customer phone numbers and messages them, that is you. You are the one deciding what happens to that data — which makes you the controller, and makes the obligations yours rather than your software vendor's.

Consent is a state, not a vibe

The most common failure is not malice, it is bookkeeping. A business has three thousand numbers in a spreadsheet accumulated over five years, and no record of which of them agreed to anything. When it comes time to send a promotion, the honest answer to "do these people want this?" is "we have no idea."

Fix that first, and the rest gets easier. In practice it means keeping, per contact:

• A consent state you can actually query — opted in, opted out, or unknown. Treat unknown as a no for anything proactive.
• When and how consent was given, so you can evidence it if asked.
• A record of opt-outs that is permanent, and that no future import can quietly overwrite.

Service messages and marketing are different

Replying to a customer who has just contacted you is not the same act as sending a promotion to someone who went quiet six months ago, and it is worth being clear in your own head which one you are doing. Booking confirmations, delivery updates and appointment reminders sit in a different category from offers, and are generally on much firmer ground.

A useful test: would the recipient be surprised to receive this? Surprise is a decent proxy for the legal question, and it is also a decent proxy for whether they will report you to WhatsApp.

Rights you have to be able to honour

Individuals can ask what you hold about them, ask you to correct it, ask you to delete it, and object to marketing. You need to be able to actually do those things — which in practice means your data needs to be findable by person, not scattered across three inboxes and a notebook.

Deletion is the one that catches people out, because it has to include the copies. If a contact exists in your messaging tool, your CRM and your accounting software, a deletion request covers all three.

Where your software should help

The things worth demanding from any tool you use for customer messaging: a consent status that is enforced rather than advisory, an export you can run yourself, a deletion that actually deletes, and a log of what was sent to whom. If you cannot answer a regulator's question from the product without emailing support, that is a gap.

And ask where the data physically lives. It is a fair question, the answer should be published rather than provided on request, and "we'll get back to you" is itself an answer of a kind.