Data protection for marketers: lawful basis, consent and rights, from the GDPR to the Gulf

This piece is general information, not legal advice. It informs the decision every campaign that touches a customer list makes: may we use this person's data for this purpose, on what basis, in this market?

• Basis before data The EU's GDPR allows processing only on one of six lawful bases; for marketing the realistic two are consent and legitimate interests¹.
• Objection always wins A person can object at any time to the use of their data for direct marketing, and the processing must then stop¹.
• The UK now names direct marketing in law as a purpose that may be a legitimate interest, but still expects a balancing test³.
• California works on opt-out rights, and new regulations in force since 1 January 2026 add risk assessments for selling or sharing data for targeted advertising^6, 7.
• The Gulf and Egypt Saudi Arabia requires consent for direct marketing and has enforced its law since September 2024^8, 9; Egypt issued its executive regulations in November 2025¹²; the UAE's were still awaited in June 2026¹¹.

Electronic messages also have their own consent rules, covered in consent for email, SMS and messaging.

The GDPR applies to organisations in the EU and also to those outside it that offer goods or services to people in the EU or monitor their behaviour¹. A brand in Riyadh, Cairo or Dubai that targets shoppers in France is in scope.

Article 6 lists six lawful bases: consent, contract, legal obligation, vital interests, public task and legitimate interests¹. Three matter in marketing:

• Contract covers what is needed to deliver what the person bought or asked for: the order confirmation, the delivery text. It does not cover the newsletter¹.
• Consent must be freely given, specific, informed and unambiguous, by a clear affirmative act; you must be able to show it, and withdrawing it must be as easy as giving it¹.
• Legitimate interests cover processing that is necessary for an interest of yours, provided the person's interests and rights do not override it. The GDPR's recitals say direct marketing may be regarded as such an interest¹.

Two further rules shape marketing. A child's consent online counts only from 16, or a lower age down to 13 where a member state sets one¹. And fines for breaching the core principles reach €20 million or 4% of worldwide annual turnover, whichever is higher¹.

Cookies and tracking sit under the ePrivacy rules, not only the GDPR: storing or reading anything on a device needs consent unless it is strictly necessary (ePrivacy, cookie). The European Commission has proposed, in its digital package, to move these rules into the GDPR where personal data is involved, with a one-click refusal, a duty to respect a choice for at least six months and preferences set once, for example in the browser¹⁴. It is a proposal, not law; until it is adopted the current rules apply¹⁴.

Most marketing teams lose time arguing about the basis after the campaign is built. Decide it first, per purpose, and write it down.

The right to object. Where data is used for direct marketing, including profiling related to it, the person may object at any time and the data may no longer be used for that purpose¹. The right must be brought to their attention explicitly, at the latest at the first communication¹. In practice this means a suppression list that every channel reads: email, SMS, paid-media audience uploads, call centres.

The other rights. People can ask to see their data, correct it, erase it, take it elsewhere and not be subject to certain solely automated decisions¹. A marketing team should know where its data lives so that it can answer within the deadline.

Data you share with ad platforms. Uploading a customer list to build a lookalike audience or for retargeting is processing like any other: it needs a basis, it must be in the privacy notice, and objections must reach it.

The UK keeps its own version of the GDPR, amended by the Data (Use and Access) Act 2025. The Act lists direct marketing among the purposes that may be regarded as legitimate interests³. That is not the Act's new "recognised legitimate interests" basis, which needs no balancing: for direct marketing the ICO still expects a legitimate interests assessment, and its updated guidance, revised on 23 March 2026, says organisations already relying on legitimate interests need not change basis³. Some advisers still regard consent as best practice for direct marketing to consumers⁵.

Electronic marketing in the UK also falls under the Privacy and Electronic Communications Regulations (PECR), which apply alongside the UK GDPR². The 2025 Act raised PECR fines to the UK GDPR level⁴. The practical rule: the UK GDPR decides whether you may use the data, and PECR decides whether you may send the email or text.

There is no general federal privacy law for marketing in the US. California's law, the CCPA as amended by the CPRA, gives consumers rights to know, delete and correct their data, and to opt out of its sale or sharing for cross-context behavioural advertising⁷. It is an opt-out model: you may often use data until the person says stop, but you must make stopping easy, including honouring browser opt-out signals such as Global Privacy Control⁷.

New regulations from the California Privacy Protection Agency, now branded CalPrivacy, took effect on 1 January 2026⁶. They require risk assessments for, among other things, selling or sharing personal information for targeted advertising and processing sensitive information^6, 7. Rules on automated decision-making technology apply from 1 January 2027, and only to significant decisions such as credit, housing, jobs or healthcare; behavioural advertising was dropped as a trigger in the final text⁶. If you market across the US, check whether the other states where your customers live have their own privacy law.

Saudi Arabia. The Personal Data Protection Law came into force on 14 September 2023, with a one-year grace period that ended on 14 September 2024; the Saudi Data and AI Authority (SDAIA) is the regulator⁸. The implementing regulations require consent to process personal data for advertising and direct marketing, and an easy way to stop receiving marketing at any time⁹. SDAIA consulted on draft amendments to the implementing regulations from 6 October to 5 November 2026¹⁰: check the final text.

United Arab Emirates. The federal law is Federal Decree-Law No. 45 of 2021. As of June 2026 its executive regulations had still not been issued, and a new federal authority for artificial intelligence and data had been created, leaving open how oversight will be divided¹¹. The financial free zones, DIFC and ADGM, run their own data protection regimes¹¹. Until the regulations arrive, build to the standard of your strictest market.

Egypt. The Personal Data Protection Law, Law No. 151 of 2020, gained its executive regulations by Ministerial Decree No. 816 of 2025, issued on 1 November 2025¹². They set up licensing of controllers and processors by the Personal Data Protection Center, with fees tiered by the number of records, require breach notification within 72 hours, and cover direct electronic marketing¹². Issuing the regulations started a one-year compliance grace period, and the Center has published guidelines, including on electronic direct marketing¹³.

An illustrative case, not a real company. An online retailer based in Dubai sells to customers in the UAE, Saudi Arabia, France and California. It wants to use purchase history to send personalised offers by email and to upload its customer list to a social platform for a lookalike audience.

1. Map the purposes Order emails (contract); personalised offers (marketing); list upload (marketing and profiling).
2. France The GDPR applies because the retailer targets people in the EU¹. Marketing email to individuals needs consent under the ePrivacy rules, unless an existing-customer exception applies; the list upload needs a basis, a mention in the notice and a route for objections¹.
3. Saudi Arabia Consent is required for direct marketing⁹; the retailer collects it at checkout, unticked, with a separate choice per channel.
4. California Sharing the list with a platform for targeted advertising is an opt-out right, and a risk assessment is now required^6, 7.
5. One standard Rather than four flows, the retailer applies the strictest rule (separate, recorded consent for marketing) everywhere, and one suppression list feeds every channel.

• Choosing the basis after the campaign is built Decide it per purpose, and record it¹.
• Bundling consent into the terms and conditions. Consent must be specific and freely given¹.
• Treating legitimate interests as a loophole It needs a written balancing test, and objection overrides it^1, 3.
• Forgetting the audience uploads An objection that stops the email but not the ad platform is not honoured¹.
• Assuming a law without regulations is a law without teeth The UAE law is in force¹¹; Saudi Arabia enforces⁸.
• Ignoring dark patterns in consent screens. Refusing must be as easy as accepting.

A checklist to run with your data and legal partners this week:

1. Data map what you hold, where it came from, where it lives, which tools and partners receive it. A customer data platform or CRM is usually the starting point.
2. Purpose register one row per marketing purpose, with its lawful basis, the markets it covers and the evidence.
3. Consent records who, when, where, what wording, which channels; a consent management tool for cookies and preferences.
4. One suppression list for objections and withdrawals, read by email, SMS, call centres and audience uploads.
5. Notices in every language you market in, naming ad-platform uploads and profiling.
6. Market check for each country in the plan, with the dates above, and the launch checklist holding the sign-off.
7. Breach plan Egypt expects notification within 72 hours¹²; rehearse it with the crisis communications checklist.

Related reading: the CRM and loyalty primer, first-party data, and the marketing operations hub.

• The law: the GDPR on EUR-Lex¹; the Commission's digital package¹⁴.
• The UK: the ICO's guidance on electronic marketing² and on PECR after the 2025 Act⁴; the DMA on the updated legitimate interests guidance³; Mayer Brown on the Act⁵.
• California: Skadden on the final regulations⁶ and the Future of Privacy Forum's issue brief⁷.
• The Gulf and Egypt: Latham & Watkins⁸ and Clyde & Co^9, 10 on Saudi Arabia; Morgan Lewis on the UAE¹¹; Al Tamimi¹² and CMS¹³ on Egypt.
• Next in this track: influencer and endorsement disclosure, consent for email, SMS and messaging.