The GCC gap that isn't the UAE
The UAE has good documentation. India has extensive playbooks. Saudi Arabia — the Gulf's largest economy, with over 20 million active WhatsApp users — has almost nothing practical written for operators.
That gap matters. Saudi Arabia has distinct registration requirements, a specific Arabic-first cultural expectation, its own data protection framework (PDPL), and a payment stack that differs meaningfully from both India and the UAE. A generic Middle East playbook fails in at least four places when applied to KSA.
Phone number registration in Saudi Arabia
WhatsApp Business API in Saudi Arabia runs on Meta's Cloud API, same as everywhere. KSA-specific points:
- Country code: Saudi numbers use the +966 prefix. The registered number must receive an SMS or voice OTP for verification. Saudi VoIP numbers frequently fail verification — use a physical STC, Mobily, or Zain SIM for primary registration. STC is the most reliable for OTP delivery.
- Display name approval: Meta matches your display name against your Commercial Registration (السجل التجاري, CR) certificate. Saudi businesses with both Arabic and English names on their CR should submit the English version unless the brand presents Arabic-first publicly. Names in Arabic script take longer to approve — submit at least 96 hours before any campaign launch.
- Template approval timelines: Arabic-language templates average 72–96 hours for Meta review in KSA — longer than English templates globally. Plan Arabic template submissions well ahead of campaign dates. Ramadan templates in particular should be submitted two weeks in advance given seasonal review backlogs.
- Iqama-registered numbers: Businesses employing non-Saudi staff who manage WhatsApp operations should register the primary number to the business CR, not to an individual's Iqama. Numbers registered to individuals create operational risk if that employee leaves.
Arabic-first vs Arabic-fallback: the KSA localization decision
This is the most consequential design choice for Saudi Arabia, and it's where most platforms get it wrong.
Arabic-fallback defaults to English and switches to Arabic only after the customer writes in Arabic. This feels natural to teams building in English. In Saudi Arabia, it reads as a foreign, low-effort brand experience to Saudi-national customers — and for government, healthcare, and financial services brands, it can raise compliance flags around accessibility.
Arabic-first means the first message from the business arrives in Arabic when the incoming number has a +966 country code. English becomes the fallback for non-Arabic speakers (expats, international visitors).
The KSA nuance the UAE guide doesn't cover: Saudi Arabia has a substantial expat workforce (~38% of population) who are often more comfortable in English, Urdu, Tagalog, or Bengali. The right implementation isn't simply "Arabic-first for all KSA numbers." It's:
- +966 numbers with no stated language preference: Open in Arabic
- Customers who write in English, Urdu, or another language: Switch immediately and maintain that language
- High-end retail, hospitality, and tourism brands: Consider English-first with Arabic as an equal-priority option, since international visitors make up a significant customer segment
The routing logic is a product decision, not a translation question. Building it correctly on day one is significantly easier than retrofitting it after launch.
Modern Standard Arabic vs Gulf Arabic (Khaleeji): the dialect question
Unlike the UAE where Modern Standard Arabic (MSA) reads as appropriately formal for business, Saudi customers — particularly in retail and consumer contexts — respond better to Gulf Arabic (Khaleeji) in casual interactions.
Practical guidance:
- Formal / transactional messages (appointment confirmations, order updates, payment receipts): MSA is appropriate and expected
- Marketing and promotional templates: Gulf Arabic phrasing outperforms MSA in engagement, particularly for younger demographics
- Customer service AI responses: Train on Gulf Arabic customer service examples, not just MSA, to avoid responses that feel stiff or overly formal
Most LLM-powered AI agents default to MSA. If your primary audience is Saudi nationals in consumer categories, test Gulf Arabic phrasing for marketing templates specifically.
Saudi PDPL: the data compliance framework
Saudi Arabia's Personal Data Protection Law (PDPL), enacted under Royal Decree M/19, came into full enforcement in 2023 and was updated in 2024. It shares structural similarities with GDPR but has Saudi-specific requirements:
Consent for marketing
PDPL requires explicit, informed consent before sending marketing messages. Consent obtained through:
- A pre-ticked checkbox ✗
- Terms of service buried in an app ✗
- Implied from a purchase or enquiry ✗
...does not qualify. You need a clear, separate opt-in statement — in Arabic — with a timestamped record.
Cross-border data transfers
PDPL restricts transferring Saudi personal data to countries that don't provide adequate protection. The Saudi Data and AI Authority (SDAIA) maintains an approved-country list that is narrower than the EU's. Verify your platform vendor's data residency options before launch. Platforms without a KSA or GCC data residency option may require a Data Transfer Impact Assessment.
Retention periods
PDPL requires documented retention policies. Unlike GDPR, it doesn't specify exact windows — but SDAIA guidance suggests:
- Active customers: 24 months from last interaction
- Inactive contacts: 12 months from last interaction, then deletion or anonymisation
The CITC dimension
The Communications, Space, and Technology Commission (CITC) regulates electronic communications in Saudi Arabia, including commercial messaging. For businesses running high-volume outbound campaigns, CITC registration as a bulk messaging provider may be required. Consult your BSP — NimbleBiz can advise on whether your use case requires CITC registration.
Ramadan and Saudi peak campaign windows
Saudi Arabia's WhatsApp engagement follows the Gulf seasonal pattern but with some KSA-specific characteristics:
- Ramadan evenings (post-Iftar, 9pm–midnight AST / +03:00): Engagement runs 50–70% above the non-Ramadan baseline — the single highest-value campaign window in the Saudi calendar. Consumers shop actively post-Iftar and pre-Suhoor.
- National Day (September 23): Saudi National Day is a major retail campaign window — electronics, fashion, and F&B all spike. Second only to Ramadan in WhatsApp campaign ROI for consumer brands.
- Eid al-Fitr and Eid al-Adha: Short, intense gifting and hospitality windows. Marketing templates should be submitted 2 weeks prior.
- Friday afternoons: Lower engagement across Saudi demographics; avoid for outbound marketing sends.
- Prayer times: Saudi consumers check notifications less frequently during Dhuhr (midday) and Asr (afternoon) prayers. Schedule sends to arrive in the 30-minute windows between prayer times for time-sensitive campaigns.
Default sending windows: 9am–10pm AST for standard campaigns. During Ramadan: extend to midnight AST.
Payment rails that close in Saudi Arabia
| Payment method | KSA prevalence | Note |
|---|---|---|
| mada | Dominant | Saudi Arabia's national debit network — non-negotiable for any checkout |
| Apple Pay | High on iOS | ~45% iPhone penetration among Saudi nationals; Apple Pay widely used |
| STC Pay | Growing | Saudi Telecom's digital wallet, strong with younger demographics |
| Visa / Mastercard | Standard | International cards widely accepted, especially for expat customers |
| Cash on delivery | Category-specific | Common in some e-commerce verticals; declining in urban areas |
Unlike the UAE (where Apple Pay dominates) or India (where UPI is universal), Saudi Arabia requires mada as the primary checkout option — it's the national network and the default payment method for Saudi-national customers. Any checkout flow that doesn't surface mada as a top option will leak conversion at the payment step.
STC Pay is worth adding as a secondary option if you're targeting younger Saudis (18–35), where it has meaningful adoption alongside mada.
Putting it together: the KSA-ready WhatsApp setup checklist
- Registered +966 SIM (STC, Mobily, or Zain) for API number verification
- Display name submitted with English CR name; Arabic templates submitted 96h+ before launch
- Arabic-first routing logic configured for +966 inbound numbers
- Gulf Arabic tested for marketing templates; MSA used for transactional messages
- PDPL-compliant opt-in capture in Arabic, with timestamped audit log
- Data residency confirmed for KSA PDPL compliance
- mada and Apple Pay integrated as primary checkout options
- Ramadan campaign calendar set — templates submitted 2 weeks before Iftar window
- Sending windows configured: 9am–10pm AST standard; midnight extension for Ramadan
Saudi Arabia is more complex than the UAE to set up correctly — but the market size justifies the investment. WhatsApp penetration among Saudi smartphone users exceeds 90%, and consumer spend via messaging commerce is growing faster in KSA than any other GCC market.