Marketing Messages in a CRM: Customer Consent First

Before you send a customer an offer or an invitation to buy on their mobile or email, Article 25 of the Personal Data Protection Law requires you to obtain their consent and give them a clear way to stop those messages. In a CRM that requirement becomes 3 things: a consent field in every customer record with its date and source, an opt-out that works from any channel, and send lists that include only people who agreed. In part five every complaint became a ticket that closes only on the customer's confirmation. This sixth part of the 7-part Digitizing CRM series turns to what you say to customers when they are not complaining, with an exercise on your current broadcast list.

What the law actually says

Article 25 of the Personal Data Protection Law, published on the website of the Saudi Data and AI Authority (SDAIA), states (our translation of the Arabic text) that, apart from awareness material sent by public entities, a controller may not use a data subject's personal means of contact, including postal and email addresses, to send advertising or awareness material except under two conditions:

• Consent: the consent of the intended recipient to receive this material must be obtained.
• A way to stop: the sender must provide a clear mechanism, as the regulations specify, that lets the intended recipient express their wish to stop receiving it whenever they want.

The controller here is your business: the party that decides why it keeps a customer's data and how it uses it. Personal means of contact include the mobile number the customer messages you from on WhatsApp, their email and their address.

Article 26 adds a limit on where the data comes from: except for sensitive data, personal data may be processed for marketing purposes if it was collected directly from its owner and they consented, in line with the law. In practice, a list of numbers you bought, copied from a group, or that an employee gathered from somewhere else is not material for your marketing messages. Then paragraph 2 of Article 5 gives the data subject the right to withdraw consent at any time. Consent is not a box you tick once; it is a status that may change tomorrow.

What the implementing regulation adds: recorded consent, a clear sender name, an easy opt-out

The implementing regulation of the law, also published on the SDAIA website, details these conditions in 4 articles. Here is what matters for a customer system:

• Article 11, consent: consent may be written, oral or electronic, provided it is freely given without misleading methods, the purposes are clear, specific and explained at or before the request, it is documented in a way that can be verified later, including records of the time and means of consent, and there is separate consent for each purpose.
• Article 12, withdrawing consent: the withdrawal procedure must be the same as, or easier than, the procedure for giving consent, and the controller must stop processing without undue delay.
• Article 28, advertising or awareness material: consent must be obtained before sending where there is no prior dealing between the recipient and the controller, and it must be documented. When using personal means of contact, the sender's name must be stated clearly, the opt-out must be easy, simple and free of charge, sending must stop as soon as an opt-out request arrives, and proof of consent must be kept.
• Article 29, direct marketing: requires the data subject's consent under Article 11, an easy opt-out, a clearly stated sender name, and stopping without undue delay if they withdraw consent.

Note that Article 28 ties prior consent for advertising material to the absence of prior dealing, while Article 29 requires consent for direct marketing. Where your existing customers fall between the two articles, and what counts as direct marketing, is a legal question this article does not settle, so confirm it with SDAIA or a lawyer. The safe system design is the same either way: a record for each customer that proves consent, and an opt-out that takes effect at once. For the wider picture of what applies to customer conversations in general, see your customer conversations and the Personal Data Protection Law.

Consent is a field in the customer record: status, date, source, purpose and channel

In part two we built one record per customer that everyone knows. Consent belongs in that record, not in a side spreadsheet or a salesperson's memory. Each consent has 5 fields that match what the regulation asks for:

• Status: agreed, declined, not yet asked, or withdrew consent. The last status is never deleted, because it is what stops a new employee from adding the customer back to a list.
• Date and time: when they agreed or withdrew, because Article 11 of the regulation names the time of consent explicitly.
• Source and means: a website form, a written reply on WhatsApp, a signature at the branch, or a call the employee logged under their own name. Oral consent is accepted by the regulation, but it needs a record that proves it.
• Purpose: offers and discounts, maintenance reminders, or an awareness newsletter. The regulation requires separate consent for each purpose, so a customer who agreed to maintenance reminders has not agreed to offers.
• Channel: WhatsApp, SMS or email, since a customer may accept email and refuse WhatsApp.

The consent log is personal data too, so decide who can see it and who can change it: service staff record a consent or an opt-out, nobody can delete the history, and exporting lists is a permission for one or two people, not for everyone with an account.

An opt-out that works from every channel, and lists built only from consenting customers

The regulation requires the opt-out to be easy, the same as or easier than giving consent, free of charge, and effective as soon as it is requested. In the system that becomes 4 rules:

• Opt out from any channel, in any wording. A customer who writes stop sending me messages on WhatsApp, says it to a salesperson on a call, or clicks the unsubscribe link in an email has made one opt-out request that goes into their record at once, not a note waiting for someone to pass it on.
• The opt-out applies to every list. If the customer withdraws consent to offers, they leave every offers list in every branch, because the status lives in their record, not in the list.
• Sender name and opt-out in every message. The message template in the system adds your business name and the way to opt out automatically, so it does not depend on an employee remembering.
• Lists are built, not copied. A send list is a query on the records: every customer whose status is agreed for this purpose on this channel. Not the contacts on a salesperson's phone, and not a broadcast group gathered a year ago.

There is an operational benefit too: a list built from people who agreed is read by people who asked for it, so their replies become a real signal of what matters to your customers instead of getting lost among people who never wanted the message.

From the group message to the customer record: reminders, follow-up and repeat purchases

Consent does not reduce what you say to customers; it directs it. The customer record holds what they bought and when, the service tickets from part five and the channel they prefer. From it you build messages the customer expects because they are about them:

• A reminder tied to what they bought: a periodic maintenance date, a subscription renewal, or a consumable that usually runs out after a period you can see in their order history.
• Follow-up after service: a question after the ticket closes about how the repair is holding up. That is service follow-up, not advertising, so keep it out of the offers lists.
• An invitation to buy again: for a customer who agreed to offers, based on what they bought rather than one message for everyone.

The line between a service message and an advertising message is not always clear: a maintenance reminder that carries a discount has become advertising. Give every template in the system a specific purpose, link it to the consent that purpose needs, and show your lawyer the templates you are unsure about. If you run a points or rewards scheme, it belongs in the same record; we covered how to design one in customer loyalty programs. Campaign plans and advertising channels are outside this part: its subject is the structure that makes every contact with a customer rest on their record and their consent.

The Origami view

We treat consent as part of the customer record, not an add-on. When we build a customer relationship system, we put the consent status for each purpose and channel next to the customer's data, make every opt-out request from any channel change that status at once, and allow send lists to be built only from consenting records.

We link every message template to a specific purpose that adds the business name and the opt-out method automatically, and we keep an undeletable history of every consent and withdrawal, with permissions that set who can see lists and who can export them. Details of what we build are on our services page.

Exercise: how was consent recorded for your broadcast list?

This is an exercise you can run yourself in one session with whoever sends your group messages today:

• Gather every current send list: WhatsApp broadcast groups, SMS lists, email lists and any file of numbers held by salespeople.
• Take a sample of 20 numbers from each list, and ask for each number: do we know when its owner agreed, how, and for which purpose?
• Write down the source of each list: collected directly from customers, copied from somewhere else, or nobody knows.
• Test the opt-out yourself: ask a colleague to write stop sending me messages on one channel, then track how long it takes for the request to reach every list and who carries it out.

The number of entries where you know when and how the owner agreed, divided by the sample size, is your documented consent rate today. A list whose source nobody knows is the first thing to review with your lawyer before the next message, and the opt-out path you traced is what has to become a rule in the system.

In the next part

Every customer now has a consent record with its status, date, source, purpose and channel, an opt-out that works from any channel, and lists that include only those who agreed. Part 7, the last one, A 90-Day Plan to Roll Out CRM in Your Business, gathers the exercises of the six parts into 3 blocks of 30 days each: cleaning and merging customer records and setting permissions, then the single inbox and the lead pipeline, then service tickets and consent records before switching off the side lists.