Programme overview
Technical depth: Practitioner · Practical mode: Case study
Introduction
Since the Saudi Personal Data Protection Law (PDPL) became enforceable, every email, SMS, WhatsApp message and audience upload that uses personal data must rest on a lawful basis, and direct marketing requires prior consent and a clear way to opt out. Many marketing teams still rely on legacy databases, purchased lists and undocumented consent. This coreconcept KSA course equips marketing, CRM and privacy managers to run campaigns that meet the PDPL, its Implementing Regulations and CST messaging rules, benchmarked against international privacy standards. Participants leave with a PDPL Direct Marketing Compliance Pack for their organisation.
Course Objectives
- Apply the Saudi PDPL and its Implementing Regulations to email, SMS, WhatsApp, social media and call-centre marketing
- Determine the lawful basis for each marketing activity and document it in a record of processing activities
- Design consent capture, consent records and opt-out mechanisms that satisfy PDPL Article 25 and ISO/IEC 29184 controls
- Align SMS and messaging campaigns with CST anti-spam requirements and sender name registration rules
- Assess high-risk practices, including purchased lists, profiling, audience uploads and cross-border martech, and set controls for each
- Produce a PDPL Direct Marketing Compliance Pack ready for review by the data protection officer
Target Audience
- Marketing and CRM managers responsible for campaigns that use customer personal data
- Digital marketing managers responsible for tracking, audiences and advertising platforms
- Data protection officers and privacy managers who approve marketing processing
- Customer experience and loyalty programme managers who run customer communications
- Compliance and legal managers advising commercial teams on marketing activity
- Agency account managers delivering campaigns for clients operating in Saudi Arabia
Course Outline
Day 1: PDPL Foundations for Marketing Teams in Saudi Arabia
- Saudi PDPL Scope, Key Definitions and the Supervisory Role of SDAIA
- Lawful Bases for Marketing Processing under the PDPL: Consent and Legitimate Interest
- Marketing Data Flow Mapping: Collection Points, CRM, Advertising Platforms and Agencies
- Record of Processing Activities for Marketing Purposes
- Current-State Marketing Privacy Gap Assessment
Day 2: Consent and Direct Marketing Rules and Standards
- PDPL Article 25 Direct Marketing Requirements: Prior Consent and Opt-Out Mechanism
- PDPL Implementing Regulations Provisions on Advertising, Awareness and Marketing Materials
- CST Regulations for Curbing Spam Messages and Calls and SMS Sender Name Registration
- ISO/IEC 29184 Online Privacy Notice and Consent Controls
- Comparative Benchmark: GDPR Article 21 Right to Object and ePrivacy Opt-In Rules
Day 3: Building Compliant Marketing Operations
- Consent Capture Design for Web Forms, Apps, Events and Call Centres
- Consent Record Schema: Timestamp, Channel, Purpose, Wording and Version
- Marketing Privacy Notice Drafting in Arabic and English
- Opt-Out and Preference Centre Workflow Across Email, SMS and WhatsApp
- Cookie Consent Banner and Google Consent Mode v2 Configuration Review
Day 4: High-Risk Marketing Scenarios and Controls
- Purchased and Third-Party Lists: Due Diligence and Rejection Criteria
- Profiling, Lookalike Audiences and Customer List Uploads: Risk Review
- Sensitive Data Exclusions and DPIA Screening for New Campaigns
- Agency and Martech Vendor Processing Agreements and Cross-Border Transfer Checks
- Complaint Handling, Breach Notification and SDAIA Enforcement Lessons for Marketers
Day 5: Case Work and the PDPL Direct Marketing Compliance Pack
- Retail Loyalty Programme Case: Re-Permissioning an Existing Database
- Healthcare Provider Case: Awareness Messages Versus Promotional Messages
- Consent Register and Preference Centre Design for an Own Organisation
- PDPL Direct Marketing Compliance Pack Drafting
- Compliance Review Panel and Remediation Priorities
Skills You Will Gain
- PDPL Marketing Compliance
- Consent Management
- Lawful Basis Assessment
- Privacy Notice Drafting
- Marketing Data Mapping
- Martech Vendor Due Diligence
- Marketing Privacy Risk Assessment
- Preference Centre Design
Why Attend This Course
- Return with a PDPL Direct Marketing Compliance Pack for your own organisation, reviewed by a peer panel
- Keep campaigns running while removing the practices most likely to draw complaints and regulatory attention
- Explain to marketing colleagues, agencies and vendors exactly what consent and opt-out records must show
- Compare approaches with marketing, CRM and privacy managers from retail, healthcare, banking and services
Conclusion
Privacy-compliant marketing is the condition for keeping a contactable customer base that trusts the organisation. This course moves from the scope of the Saudi PDPL and the lawful bases for marketing, through Article 25, the Implementing Regulations, CST messaging rules and international consent standards, to consent design, preference management and the high-risk practices that draw complaints. The final day turns this material into a PDPL Direct Marketing Compliance Pack that participants take back to their marketing and privacy teams.