Everything worth knowing, nothing that isn't.
Who enforces it
SDAIA (Saudi Data and AI Authority) is the regulator. Penalties: up to SAR 5 million per violation, with criminal liability for officers of the controller in egregious cases. SDAIA's enforcement posture in the first 18 months has been corrective rather than punitive (warnings, mandatory remediation), but the law allows for class-action complaints and SDAIA has explicitly said large-scale messaging violations are a priority.
Data residency
Personal data of KSA individuals must be processed inside KSA unless one of three exceptions applies: adequacy decision (SDAIA hasn't issued any yet), explicit and informed consent for the specific cross-border use, or SDAIA permit. For messaging, this means the SMSC, the campaign-management UI, and the DLR store must be in-kingdom. BroadNet operates a Riyadh DC specifically to keep customer data resident for KSA accounts.
Consent requirements
Consent must be informed, specific, freely given, and provably recorded. For SMS marketing, that means an opt-in record (timestamp, source, exact consent text shown to the user) retained for 5 years. STOP keyword must be honoured within 24 hours and recorded. CST coordinates with SDAIA on sender-ID approval for marketing-classified messages — a sender ID without provable consent records gets revoked.
What buyers should ask their aggregator
Three questions. Where is my SMSC physically located when I send to KSA numbers? Where are my DLRs and message bodies stored? What is the consent-record format and retention? Any answer involving Frankfurt, Dublin, or London is a non-starter for PDPL-compliant deployments.