Direct marketing and prior consent
The Personal Data Protection Law bars the use of personal means of contact to send promotional material without the recipient's consent and a clear way to stop it, and the regulations detail the conditions for consent and opting out.
Who it applies to
Any organisation sending promotional messages to individuals by phone, email or WhatsApp, including providers, property managers and associations.
What the source provides
Article 25 of the law bars a controller from using personal means of contact, including postal and electronic addresses, to send promotional or awareness material without the recipient's consent and a clear way to stop it. Article 28 of the regulations adds that consent is required before sending where there has been no prior dealing, that it must be freely given without misleading methods, that the recipient must be able to tailor their choices, and that consent must be documented. Article 1 of the regulations defines direct marketing as communicating with the data subject by any direct means in order to direct marketing material at them, including advertisements and promotional offers.
Conditions for sending and for stopping
When personal means of contact are used, Article 28 of the regulations requires naming the sender, an opt-out that is no harder than giving consent, stopping as soon as the request is made, no charge for opting out, and keeping evidence of consent. Article 29 of the regulations requires, before processing for this purpose, consent under Article 11 of the regulations, an equivalent or easier way to stop, a clear statement of the sender's name, and stopping without unjustified delay once consent is withdrawn.
When it matters and what to do
If you are a provider or manager sending offers to individuals, keep a record of consent with its date, wording and channel, include an opt-out link in every message, and stop as soon as asked. If your message goes to an organisation rather than an individual, a business's public details may fall outside the definition of personal data, but only where they carry no person's name and do not lead to identifying one, so check before relying on that. Nothing in the texts read makes publication of contact details in a public directory consent to receive marketing.
Thibrh's role, its limits and what you need from an official body and what this article does not cover
This article is a general explanation and does not rule on any particular message. Note that Article 28 of the law concerns copying identity documents, while Article 28 of the regulations concerns advertising and awareness, so do not confuse the two. This is general information from a published source, not legal advice; official decisions and procedures take place on the authority's platform.
Key points
- No promotional material through personal means of contact without the recipient's consent (Article 25 of the law).
- Consent precedes sending where there has been no prior dealing, and is freely given and documented (Article 28 of the regulations).
- Opting out is easy, free and takes effect on request, with the sender named.
- Keep evidence of consent.
Provisions referenced
- نظام حماية البيانات الشخصية، المادة 25
- اللائحة التنفيذية، المواد 1 و11 و28 و29