Legal and compliance
Contact rules for outbound messages and calls
The rules on marketing calls and messages in the UAE and Saudi Arabia, WhatsApp's opt-in rules, and the checks the agent makes before it contacts anyone.
On this page
Reminders, updates and offers are some of the most useful conversations a business has, and some of the most regulated. The UAE has specific, enforced rules on marketing calls and messages: who may make them, from which numbers, at what times, and what must happen when a person says no. Saudi Arabia regulates marketing messages and requires consent for direct marketing. The agent applies your contact rules before every outbound call or message, so the rules are checked every time rather than remembered by whoever is making the call.
This page is general information about the law, not legal advice. These rules change, and different regulators apply them to different sectors. Your organisation is responsible for its own compliance and should take its own legal advice on which rules apply to each outbound workflow. We will walk your legal team through exactly how the product applies them.
The UAE rules for marketing calls and messages
The UAE Cabinet's telemarketing regulations apply to companies licensed in the UAE, including those in free zones, that market products or services by phone to individuals. They cover marketing calls, marketing text messages and marketing messages sent through social media and messaging applications. The main obligations, in plain terms:
| Obligation | What it means in practice |
|---|---|
| Approval to telemarket | The company needs prior approval for telemarketing from the authority that licenses or regulates it |
| Registered local numbers | Marketing calls come from local numbers registered under the company's own commercial licence, never personal numbers |
| The Do Not Call Registry | Numbers on the national Do Not Call Registry (DNCR), run by the Telecommunications and Digital Government Regulatory Authority, must not receive marketing calls |
| Permitted hours | Marketing calls are made only within the daytime hours the regulations set |
| Say who you are and why | The company and the purpose of the call are given at the start, and the person is asked whether they want to continue before any marketing begins |
| No means no | A person who rejects the offer on the first call is not called back about it |
| Limited retries | If a call is unanswered or ended, repeat calls are limited to the number per day and per week the regulations set |
| Record and keep records | Marketing calls are recorded, with the person told at the start, and a record of calls is kept and reported as the authority requires |
| No pressure | No pressurising, deceptive or confusing sales methods |
Which authority applies depends on your sector. The Central Bank oversees marketing calls by banks, insurers and other financial institutions it licenses, the Securities and Commodities Authority oversees securities marketing, and local authorities in each emirate oversee other businesses. Each can add its own controls, so check the rules of your own regulator as well.
Saudi Arabia
Saudi Arabia regulates marketing through its personal data law and its communications rules. Under the Personal Data Protection Law's implementing regulations, direct marketing needs the person's consent, the sender must be clearly identified, and there must be an easy way to stop receiving marketing, which is honoured once requested. The communications regulator's rules on unwanted messages add requirements for promotional messages, including how they are sent and how recipients unsubscribe. Your legal team should confirm which rules apply to each outbound workflow.
WhatsApp's own rules
Meta requires a business to have a customer's opt-in before messaging them on WhatsApp. The opt-in must make clear that the customer is agreeing to receive messages, and from which business. Businesses must also tell customers how to opt out and honour those requests, including for particular kinds of message.
These rules sit alongside the law, not in place of it. See WhatsApp: opt-in, opt-out and consent.
Service and marketing are different
Most of these rules are aimed at marketing. A claim update, an instalment reminder or a flight change is a service message: it concerns something the customer already has or has asked for. The difference matters, and it depends on content: a service message that adds a promotion becomes marketing.
With your legal team, we classify each outbound workflow as service or marketing during implementation, and the agent applies the checks for that type. Meta applies the same distinction to WhatsApp templates, sorting them into utility and marketing categories. See WhatsApp: message templates and outbound messages.
The checks the agent makes before contacting anyone
| Check | What the agent does |
|---|---|
| Calling hours | Places marketing calls only within the permitted window, and holds anything outside it. You can set narrower hours for any workflow |
| Do-not-contact list | Holds a suppression list of customers who have asked not to be contacted, and checks it before every outbound call or message, on the channels and message types you define |
| Do Not Call Registry screening | Configured during implementation: numbers are checked against the registry lists before a marketing call is placed |
| Opt-in on record | Checks that the customer's consent to be contacted on that channel is on record before any outbound message |
| Opt-outs | Records an opt-out against the customer when it is given, and applies it to every further contact of the types you define |
| Retries | Retry rules are configured during implementation, so an unanswered customer is tried again within the limits your rules set, not repeatedly |
| Your own numbers | Calls are placed from your own numbers, through your own carrier. See Voice: connecting your telephony over SIP |
| Opening and recording | For marketing calls, the agent gives your company name and the purpose of the call, asks whether the person wants to continue, and handles recording as set out in Call recording and consent |
Every outbound call and message, the checks it passed and the outcome are logged, so you can show what was sent, to whom, when and why.
In practice
A hotel group in Dubai runs a stay offer to past guests, by call and WhatsApp.
- Its legal team confirms the group's approval for telemarketing, and that the offer is marketing.
- The WhatsApp message goes only to past guests whose opt-in to marketing messages is on record, using an approved marketing template.
- For calls, the list is screened against the Do Not Call Registry and the group's own do-not-contact list. Numbers on either list are removed.
- Calls start when the permitted hours begin. Each call opens with the hotel group's name and the reason for calling, and asks whether the guest is happy to continue.
- Lina says she is not interested. The refusal is recorded against her, and she is not called about the offer again.
- Shortly before the permitted hours end, the agent stops placing new calls and holds the rest of the list for the next day.
What your team controls
- Which outbound workflows are service and which are marketing, decided with your legal team.
- The hours for each workflow, within the permitted window.
- Your do-not-contact list, and which channels and message types an opt-out covers.
- Retry limits for unanswered customers.
- The opening wording for marketing calls and messages.
Related
- WhatsApp: opt-in, opt-out and consentChannels
- WhatsApp: message templates and outbound messagesChannels
- Voice: inbound and outbound callsChannels
- Call recording and consentLegal and compliance
- Data protection in the UAE and Saudi ArabiaLegal and compliance
Product names and logos are trademarks of their owners. Their mention shows systems Telonic connects to and does not imply partnership or endorsement.