Executive Regulation of the Personal Data Protection Law — Article 22

Before sending advertising, marketing or commercial material, the Controller must obtain written consent, tell the Data Subject how it will be sent, provide a free opt-out mechanism, and stop sending immediately upon an opt-out request.

Interpretation and application must be checked against the official Arabic text and the current version.