PDPL for clinics that use WhatsApp
A practical guide for Saudi clinics: what the Personal Data Protection Law expects when you talk to patients on WhatsApp, and what to change in your clinic today.
Most clinics in Saudi Arabia talk to patients on WhatsApp: price questions, bookings, reminders, and sometimes photos and reports. All of that is personal data, some of it is health data, and the Personal Data Protection Law (PDPL) sets clear rules for it.
What the law is, and who enforces it
The PDPL was issued by Royal Decree in 2021, amended in 2023, and came into force in September 2023, with a one-year grace period that ended in September 2024. It is overseen by the Saudi Data & AI Authority (SDAIA).
The law treats health data as sensitive data, which means stricter expectations for clinics than for most businesses.
Your clinic is responsible
The clinic is the controller of its patients' data. Any company that processes that data for you, such as your booking system or an AI front desk, is a processor, and you need a contract with it that sets out what it may do with the data.
Welcome to Palm Smile Clinic. We use your details only to book your appointments and contact you. To stop messages at any time, reply STOP.
9:41 pmHi, how much is teeth whitening?
9:41 pmWhat to change on WhatsApp
- Tell patients in the first conversation why you collect their data and how you use it, briefly and plainly.
- Don't ask for more in the chat than a booking needs. Name, number, treatment and a preferred time are usually enough.
- Keep patient chats off staff members' personal phones. Use the clinic's number and an account whose access the clinic controls.
- Marketing messages and offers need the patient's consent and an easy way to stop them.
- When a patient asks to see, correct or delete their data, you must be able to do it within the legal time limit.
Consent log
- +966 5• ••• 4127
- Agreed · 9:41 pm
- +966 5• ••• 0388
- Agreed · 8:02 pm
- +966 5• ••• 7715
- Stopped messages · 6:15 pm
- +966 5• ••• 2290
- Agreed · 4:47 pm
- +966 5• ••• 9051
- Agreed · 1:20 pm
Where is the data stored?
The PDPL restricts transferring personal data outside the Kingdom and sets conditions for it. The simplest path for a clinic is to choose providers that host data inside Saudi Arabia, and to ask them to confirm it in writing.
Remember that WhatsApp messages themselves travel through Meta's platform whichever provider you use. So focus on what your provider stores (conversations, patient details, bookings) and where it stores them.
Clinic settings
- Data region
- Saudi Arabia
- Backups
- In the Kingdom
- Consent message
- On
- Medical questions
- Hand to staff
- Audit log
- On
If there's a breach
The implementing regulations require you to notify SDAIA of a data breach within 72 hours of becoming aware of it, and to tell affected patients if it could harm them. Prepare now: who is responsible at the clinic, and who you call at each provider.
I had a tooth out yesterday and there's swelling. Is that normal?
9:13 pmSorry to hear that. I'm passing your question to Dr. Noura now; she'll reply herself within minutes.
9:14 pmHanded to Dr. Noura · 9:14 pm
A short checklist
- A welcome message that explains how data is used and how to stop messages.
- One clinic number instead of staff phones.
- A data processing agreement with every provider that handles patient data.
- Providers that host data inside the Kingdom.
- One person responsible for patient requests and for reporting any breach.
This guide is for general awareness, not legal advice. Check the official text of the law and its regulations on SDAIA's website, or ask a lawyer about your specific case.