Regional terms: UAE, Saudi Arabia, Qatar, Bahrain, Oman and Kuwait

Version 2026-10-05 · Last updated October 5, 2026

In short: Across the Gulf, marketing email needs prior opt-in consent and an easy opt-out. Qatar requires the message to say it is direct marketing. Data protection laws are in force or developing in every state.

How these terms work

These terms apply if you are in a GCC country or email people there. PostaraMail applies the strict opt-in rule to GCC recipients: people added only after a notice are not included when you send to strict regions. Where your country's law requires Arabic documents for filings or contracts, you are responsible for any translation.

United Arab Emirates

The federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) has been in force since 2022 and applies to processing of personal data of people in the UAE; its executive regulations may continue to develop, so we follow a GDPR-style standard. Using personal data for direct marketing needs freely given, specific, informed, unambiguous consent (pre-ticked or bundled consent is not valid), people have the right to object and stop direct marketing, and you must offer an easy opt-out such as an unsubscribe link. The consumer protection law and the telecom regulator's spam rules also apply, and the free zones DIFC and ADGM have their own data protection laws.

Saudi Arabia

The Personal Data Protection Law (Royal Decree M/19) has been fully enforceable since 14 September 2024 and applies to processing of data about people in the Kingdom wherever you are based. Direct marketing requires the person's explicit, documented opt-in consent, and there must be a simple way to opt out and to withdraw consent. The regulator (SDAIA) has been issuing penalty decisions, including for marketing without consent. Rules on transfers of personal data outside the Kingdom apply, and controllers may need to register with SDAIA: these are your responsibility as the controller. We will cooperate with the transfer assessments the rules require.

Qatar

Law No. 13 of 2016 on Personal Data Privacy Protection bans electronic direct marketing without the person's prior, explicit consent; implied consent is not recognised. The message must identify its sender and state that it is sent for direct marketing, and give a way to opt out. PostaraMail adds a "direct marketing" notice to emails sent to contacts whose country is Qatar. The Qatar Financial Centre has its own data protection regulations.

Bahrain

The Personal Data Protection Law (Law No. 30 of 2018) requires you to tell people when their data may be used for direct marketing and about their free right to object, and to stop within 10 working days of a request. PostaraMail stops sending to a contact immediately when they unsubscribe.

Oman

The Personal Data Protection Law (Royal Decree 6/2022) requires written consent before sending advertising or marketing material and that you can prove it. Keep the consent wording and time (PostaraMail records them for each contact) and do not rely on a notice alone. The ministry's implementing regulations continue to apply the law in phases.

Kuwait

Kuwait has no single general data protection law covering all businesses; the communications regulator's data privacy regulation mainly binds telecom and internet service providers. We apply the strict opt-in rule to Kuwait as good practice.

What PostaraMail does for you

How PostaraMail helps: when you send a campaign you choose the regions to include; strict regions only include contacts with a clear opt-in; every contact stores the consent wording, time, source and country; double opt-in is available; unsubscribes take effect immediately; and you can export a consent record for any contact.

General information

This addendum is general information about the main rules for sending email and handling personal data. It is not legal advice and may not be complete. You remain responsible for complying with the law that applies to you and your recipients.

More: Legal centre · Trust and security · What changed · Privacy request