PDPL Consent Management: What Every Saudi Merchant Must Have in Place by 2027

The grace period is over. SDAIA enforcement has begun. In 2025, 48 formal decisions were issued against organizations that handled consent incorrectly.

If your business collects a customer's name, phone number, or purchase history — and most merchants do — you fall under the consent requirements of the Personal Data Protection Law (PDPL), Articles 5 through 7. Here is what valid consent actually requires, and where the gaps usually appear.

What Articles 5 to 7 Require

Three conditions. All three have to be satisfied.

Article 5 — Lawful basis. Processing personal data requires either explicit consent or a recognized lawful basis: performance of a contract, compliance with a legal obligation, protection of vital interests, or legitimate interest, interpreted narrowly. Most merchant data collection — loyalty databases, CRM records, customer contact lists — relies on consent as its primary basis.

Article 6 — Consent conditions. For consent to be valid under PDPL, it must be:

• Freely given, with no service or benefit conditioned on it

• Specific to each stated purpose, not bundled into a single approval

• Informed, so the customer knows what is collected and why

• Documented, in a form that can be produced later

A loyalty enrollment form stating "by signing up you agree to receive offers" does not meet that standard. Neither does verbal agreement at the register with no record kept.

Article 7 — Withdrawal. Customers must be able to withdraw consent at any time, and withdrawal must be as simple as giving it. Once consent is withdrawn, processing stops. There is no exemption for "existing relationship management."

The Enforcement Reality

PDPL became enforceable in September 2024, and the penalty framework is active. Non-compliance can lead to warnings, corrective orders, and financial penalties, with heavier consequences for the most serious breaches.

SDAIA is now licensing accredited PDPL auditors. Merchants should expect structured audits rather than occasional paperwork checks.

What Merchants Get Wrong

The same gaps keep surfacing across Saudi retail.

No consent records. Verbal agreements at the register, unsigned loyalty forms, WhatsApp opt-ins with no saved confirmation. None of these produce an auditable record.

Blanket consent language. "We may use your data for marketing purposes" is not purpose-specific. PDPL requires disclosure per purpose, not a catch-all clause.

No withdrawal mechanism. If a customer cannot easily opt out of processing, the consent was never valid under Article 7 to begin with.

Retention after the purpose expires. Holding customer data after the stated purpose ends, or after consent has been withdrawn, is a violation.

How Wateer Handles Consent Automatically

No personal data on paper. Thermal receipts print personal details onto a physical document that can end up anywhere. Wateer delivers receipts digitally, to the customer's own device, by WhatsApp or SMS.

Consent at the delivery layer. The first time a customer receives a Wateer receipt, the consent flow is built into the channel itself. The record is timestamped and stored.

Audit-ready by default. If SDAIA asks for documentation of how consent was collected, Wateer merchants can produce a timestamped digital record rather than a drawer of signed forms.

What to Do Next

Review how your business currently captures consent, and check three things: whether each purpose is disclosed separately, whether every approval leaves a record you could show an auditor, and whether a customer can withdraw as easily as they agreed. Then check how long you keep the data and what happens when the purpose ends.

Merchants who have moved to digital receipts have already closed a PDPL exposure that many of their competitors have not yet recognized.

Sources & References

• SDAIA — PDPL Implementing Regulations: Explicit Consent Capture & Lifecycle Standards (PDF)
• National Data Governance Platform — Data Controller Registration & Assessment Framework