AI calls in Saudi Arabia: the PDPL and CST rules on consent, calling hours and recording

Two regulators set the rules for AI calls in Saudi Arabia

Saudi Arabia has regulated unwanted calls and messages for more than a decade, and an AI agent inherits those rules rather than a new set. The first rulebook comes from the Communications, Space and Technology Commission (CST), the telecom regulator. Its Regulations for Curbing SPAM Messages and Calls are now in their third version, after versions in 2010 and 2018. The current one was approved on 17 October 2022 under decision 493/1444 and took effect 90 days later, about 15 January 2023 by our count.

The rules rest on the Telecommunications and Information Technology Law, which lists protecting users and keeping communications confidential among its aims and treats misuse of telecom services as a violation (articles 2(5) and 26(5), as quoted by CST). They were issued under the regulator's earlier name, CITC, and they bind operators, SMS providers and the businesses that send messages and make calls.

The second rulebook is the Personal Data Protection Law (PDPL), Royal Decree M/19 of 9/2/1443H as amended by Royal Decree M/148 of 5/9/1444H. The Saudi Data and AI Authority (SDAIA) publishes it with its Implementing Regulation. The PDPL governs the phone number you dial, the consent you hold and the recording you keep. It also reaches companies abroad: it covers processing in the Kingdom and processing of data about people living there by a party outside it (art. 2(1)), so a UAE or Indian company calling Saudi residents is inside it.

Consent and opt-out rules for promotional calls

Promotional calls need express consent, and the caller carries the burden of proving it. CST requires the caller to give the person a real choice to agree or not, and says consent contained in privacy policies and service contracts does not count (para 5-2-1-1). A pre-ticked box or a clause in your terms of service is therefore not enough.

Stopping must be just as easy. The person can ask to stop at any time, through traditional and electronic channels. You must stop calling within 24 hours of the request and send a notification confirming it (paras 5-2-1-2 to 5-2-1-4). In practice that means an opt-out the AI agent can take on the call itself, written straight to a suppression list your dialler checks before every call.

The PDPL adds its own layer. A controller may not use a person's means of communication to send advertising without their prior consent and a clear way to stop (PDPL art. 25). Personal data may be used for marketing only if you collected it directly from the person, with their consent, and never if it is sensitive data (art. 26). Bought or scraped lists fail that test, because you did not collect the data yourself.

The Implementing Regulation fills in the details. Consent must be free and not obtained by misleading methods, given for each purpose separately and documented so it can be checked later (art. 11). Advertising must name the sender, and stopping it must be free, immediate and as easy as signing up (art. 28). The regulation lets you skip consent for advertising where you have a "prior interaction" with the person (art. 28(1)), but CST's express-consent rule for promotional calls has no such exception. The safe reading for calls is to hold express consent every time.

Calling hours, Ramadan and the first words of the call

Promotional and awareness calls are banned from 10:00 pm to 9:00 am every day, Saudi time (UTC+3). During Ramadan the banned period moves to 1:00 am to 12:00 pm (para 5-2-4). Service calls, such as delivery or appointment updates, are not covered by the hours rule.

The window is set in Saudi time, wherever your servers or contact centre sit. Saudi Arabia does not use daylight saving, so one setting works all year apart from Ramadan, whose dates move with the Hijri calendar. Load the Ramadan dates into the dialler each year rather than relying on a fixed range. On Sonex, for example, each outbound calling campaign carries its own calling window, time zone and retry limit, so a Ramadan campaign can run on its own hours. The calling rules by country tool lists the Saudi window next to other markets.

When the person answers, CST fixes what the caller says first. At the start of any awareness, promotional or service call, the caller must disclose the reason for the call, the entity it represents and whether the person wants to continue (para 5-2-2). The same paragraph requires calls to come from the official contact numbers shown on your website or another official channel. An AI agent's number should therefore appear on your website as one of your official numbers.

No national do-not-call register: opt-outs, 330330 and suspended numbers

Unlike the UAE, which runs a national Do Not Call Register, Saudi Arabia has no national register for voice calls in the CST rules. Instead, each person opts out with each caller, and the network acts on complaints. That does not mean fewer restrictions. It puts the whole burden on your own records, because your consent log and suppression list are the only proof that a call was allowed.

People report promotional calls made without their consent to 330330, the operators' protection channel, or through their operator's app or website (Appendix 6). If 10 or more reports from different numbers arrive within 60 days, and the operator confirms the reported number did call the people reporting it, a mobile number is suspended at once. Its owner then has 30 days to verify their identity, or the number is cancelled. Fixed and unified numbers are suspended in a similar way, and international numbers are blocked for 90 days.

For an AI calling programme, that turns complaints into an outage risk. Ten unhappy people can take a number off the network, and with it every campaign that uses it. Track complaints and opt-outs per number, and stop a campaign early if they rise. The UAE telemarketing rules show the other model, where a central register does the screening and fines fall on the company instead.

Recording calls and keeping voice data under the PDPL

A recording of a call is personal data under the PDPL, because it can identify the person speaking (art. 1(4)). So recording needs a legal basis, which is consent unless one of the exceptions in article 6 applies. One such exception is processing under a contract with the person; another is a legitimate interest that does not involve sensitive data.

The person must also be told what is happening. When you collect data directly, you must tell them, before or at collection, who you are, why you are collecting it, how long you will keep it and how to exercise their rights (PDPL art. 13; Implementing Regulation art. 4). On a call, that means a short recording notice at the start and a link or reference to your privacy policy, which must be available before collection (art. 12).

Two kinds of voice data need explicit consent. Biometric data used to identify a person is sensitive data (art. 1(11)), so a voiceprint used to verify callers needs explicit consent (Implementing Regulation art. 11(2)(a)). So does a decision made solely by automated processing (art. 11(2)(c)), such as an AI agent approving or refusing an application on the call.

We found no Saudi rule written specifically for recording a call you take part in. The closest general rule is the Anti-Cyber Crime Law, Royal Decree M/17 of 2007. Its article 3 punishes intercepting data sent over a network "without legitimate authorization" with up to one year in prison, a fine of up to SAR 500,000, or both. Whether that reaches a business recording its own call is not settled. Our reading is that telling the caller at the start removes the question, so treat the PDPL duties as the floor: tell the caller, have a legal basis and keep recordings only as long as you need them.

Breaking the PDPL can cost a warning or a fine of up to SAR 5 million per violation, doubled for a repeat (art. 36). Disclosing or publishing sensitive data to harm someone or for personal gain is a crime, with up to two years in prison or a fine of up to SAR 3 million (art. 35). The CST rules leave enforcement to CST's own regulations (para 6.4) and do not set fine amounts.

Saying it is an AI: SDAIA guidance, not yet a rule

No CST or PDPL provision makes an AI agent say it is an AI. The binding duty is the opening disclosure: reason, entity and whether to continue. SDAIA, which is also the national AI authority, goes further in guidance. Its Generative AI Guidelines for Public say developers and users should "clearly communicate" when generative AI is used in interactions with the public, and should offer a non-automated channel to people who prefer a human (section 4.3, version dated May 2025).

SDAIA's AI Ethics Principles, dated May 2025 and written to apply to everyone developing or using AI in the Kingdom, point the same way. Their self-assessment checklist asks whether the users of a chatbot or other communication system know they are interacting with a non-human correspondent. Neither document carries penalties, but both state what the authority expects.

Deception is a separate risk. The PDPL Implementing Regulation bars consent obtained through misleading methods (art. 11(1)(a)), and a caller who pretends to be a person to win a yes invites exactly that challenge. The low-cost course is to say it plainly in the first sentence, in Arabic and English, alongside the reason and the entity. A Najdi Arabic voice suits callers in Riyadh and central Saudi Arabia, and the AI disclosure scripts have more wording. Companies that also call Europe will need the statement anyway, because the EU AI Act's transparency rule for voice agents makes it a legal duty there. The lines below are examples we wrote, not official text.

• Arabic: "السلام عليكم، معك المساعد الذكي من [اسم الشركة]، وأنا نظام ذكاء اصطناعي ولست موظفاً. أتصل بك بخصوص [سبب الاتصال]. هل تحب نكمل؟"
• English: "Hello, this is the AI assistant for [Company]. I'm an automated system, not a person. I'm calling about [reason]. Would you like to continue?"
• If the person says no or asks to stop: end politely, log the opt-out with a timestamp and block the number for promotional calls within 24 hours.

Key dates