WhatsApp Marketing Rules in Bahrain (2026): Consent, Opt-Outs and What the Law Actually Says

Short answer: under Bahrain's Personal Data Protection Law (Law No. 30 of 2018), consent must be written, explicit, clear and specific, and customers can withdraw it at any time. Anyone can object to direct marketing free of charge, and you must stop within 10 working days and tell them so. The regulator can impose daily penalties of up to BD 1,000 and fines of up to BD 20,000. The TRA's bulk messaging rules (09:00–20:00, one message a day, opt-out details) are written for SMS and MMS through licensed operators, not WhatsApp, but they are a sensible benchmark. Meta adds its own rule: opt-in first, and honour every opt-out. This is a practical guide, not legal advice.

The law that applies: PDPL, Law No. 30 of 2018

Bahrain's Personal Data Protection Law is enforced by the Personal Data Protection Authority (PDP Authority). The official English translation, published by the Legislation and Legal Opinion Commission, defines direct marketing as "communication, by whatever means, of any marketing material or advertisement which is directed to a particular person". A WhatsApp broadcast to a customer is squarely inside that definition. A campaign is not exempt because it went through WhatsApp instead of SMS or email.

When you can process personal data at all (Article 4)

Processing is prohibited without the person's consent unless it is necessary for one of the listed purposes: performing a contract the person is party to, taking steps they asked for before a contract, a legal obligation, their vital interests, or your legitimate interests where these do not override their fundamental rights and freedoms. In practice:

• Order and delivery updates to a customer who bought from you sit comfortably under "performance of a contract".
• Promotions are a different purpose. Relying on legitimate interests for marketing is a judgement call that a regulator may not share, so most Bahraini businesses should get consent for marketing and keep a record of it.

What valid consent looks like (Article 24)

The law says consent must be given by a person with full legal capacity, be "written, explicit, clear, and specific to the processing of certain data", and be freely given after the person has been told the purpose. The person can withdraw it at any time. For WhatsApp, that rules out the shortcuts businesses commonly take:

• A pre-ticked box on your website checkout.
• Adding every number that ever called your shop to a broadcast list.
• A business card dropped in a bowl at the Autumn Fair stand.
• A bought list, or a list "shared" by a partner company.

Telling people about direct marketing (Articles 17 and 19)

When you collect data, the law requires you to say whether it will be used for direct marketing. Where you expect to use it for direct marketing, you must tell the person that they have the right to object, free of charge. A short line on your sign-up form or in the first WhatsApp message covers both.

The right to object (Article 20)

This is the article that matters most for broadcasts. When a person asks you not to use their data for direct marketing, you must not start, or must stop, within 10 working days, and within the same 10 working days you must tell them, free of charge, whether the request was approved, partly approved with reasons, or refused with reasons. If they are not satisfied, or you do not answer in time, they can complain to the Authority.

Sending data abroad (Articles 12 and 13)

The PDPL restricts transfers of personal data outside Bahrain to countries on the Authority's adequacy list, or under listed exceptions such as the person's consent or a transfer necessary to perform a contract with them, or with the Authority's authorisation. WhatsApp and most messaging platforms process data outside the Kingdom, so mention this in your privacy notice and get proper legal advice on which basis you rely on.

What the PDP Authority said in October 2026

On 20 October 2026 the News of Bahrain reported that the Personal Data Protection Authority had warned businesses that they need clear and specific consent before using personal information for advertising or direct marketing. Lawyer Jassim Al Essa, commenting on the warning, put the practical points plainly:

Getting someone's phone number or email address does not mean you have the right to use it for every purpose. Giving consent once does not mean giving it forever.

He added that opt-out requests must be taken seriously and answered with reasons, and that removing someone from a list is not enough if their details are later added back without a lawful basis. That last point is the one WhatsApp teams trip over: an opted-out customer is re-imported next month from the POS export or a CRM sync, and receives the Eid campaign anyway. Your system needs a suppression list that survives re-imports.

Penalties under the PDPL

The criminal list in Article 58 does not name marketing without consent as such, but the administrative measures in Article 55 apply to any violation of the law. In real life the first cost is usually commercial: complaints, blocks and reports, which damage your WhatsApp quality rating long before a regulator writes to you.

The TRA bulk messaging regulation: SMS, not WhatsApp

Bahrain's Telecommunications Regulatory Authority issued its Bulk Messaging Regulation in February 2011 (Resolution No. 1 of 2011). It is often quoted as if it governs all marketing messages. Read the text and its scope is narrower: it defines a bulk message as an SMS or MMS sent to 100 or more recipients over a licensed operator's mobile network, and it places its obligations on licensed operators. For solicited bulk messages it requires:

• Sending only to recipients who have expressly consented, with the consent kept on record.
• Sending only between 09:00 and 20:00 Bahrain time.
• One message a day per recipient per sender, unless the recipient agreed otherwise.
• The sender's identity and a valid phone number or email in each message.
• The opt-out procedure in each message, and the cost of responding or of the goods offered, where there is one.

Operators must also give subscribers a free opt-out from any bulk message. WhatsApp messages do not travel as SMS over an operator's network, so this regulation does not apply to them directly. We still recommend treating it as the local benchmark for good practice: a Bahraini customer who has learned that promotional SMS stops at 8 p.m. will not welcome a WhatsApp promotion at 11 p.m.

Meta's rules, which are enforced first

Whatever the law says, WhatsApp's Business Messaging Policy is enforced automatically and quickly:

• Opt-in. You must have the person's permission confirming they want to receive messages from you. Meta recommends an opt-in that covers the different kinds of messages you will send.
• Opt-out. You must respect every request, on or off WhatsApp, to stop, and remove that person from your list.
• Template categories. A utility template must be non-promotional and specific to, or requested by, the user. If you hide an offer inside a "utility" message, Meta reclassifies it as marketing.
• Enforcement. Blocks and reports lower your quality rating. Templates rated lowest are paused for 3 hours, then 6 hours, then disabled. Meta can also limit how many messages you send or remove your access to the platform entirely.

Consent wording that works in Bahrain

Ask for consent in the customer's language, say what you will send and how often, and how to stop. Two examples:

Record the answer with the date, the channel and the exact wording shown. That record is your proof if a customer complains to the PDP Authority or reports you to Meta.

A compliance checklist for Bahraini WhatsApp marketing

1. Separate transactional messages (orders, appointments, deliveries) from marketing in both your templates and your consent records.
2. Collect marketing consent with an unticked box or an explicit WhatsApp reply, in Arabic and English.
3. State in your privacy notice that data may be used for direct marketing, that the customer can object free of charge, and that messaging providers may process data outside Bahrain.
4. Store consent with date, source and wording; keep it up to date when people change their minds.
5. Honour STOP immediately and answer any written objection within 10 working days.
6. Keep a suppression list that blocks re-imports of opted-out numbers.
7. Send marketing in daytime and early evening; use 09:00–20:00 as your default window, the same as the TRA's SMS rule.
8. Do not buy, rent or share lists.
9. Watch your quality rating weekly and pause a campaign that draws blocks.
10. Have a Bahraini lawyer review your consent flow once, especially for sensitive sectors such as health clinics.

How QuickWA helps (and what it cannot do for you)

QuickWA records consent per contact and processes STOP opt-outs automatically, so an opted-out customer is excluded from later broadcasts. You can set a sending window in Settings, and scheduled broadcasts wait until it reopens. You can segment by tag or source so a broadcast goes only to the people who agreed to it, and the number quality view shows when feedback turns. What no software can do is make your consent valid for you: the wording you show, and whether people genuinely agreed, remain your responsibility. More on the QuickWA Bahrain page; costs per category are in our Bahrain pricing guide.

This article is general information, not legal advice. For decisions about your business, consult a lawyer qualified in Bahrain.

Sources

• Personal Data Protection Law, Law No. 30 of 2018, official English translation (Legislation and Legal Opinion Commission): lloc.gov.bh, Articles 1, 4, 12, 13, 17, 19, 20, 24, 55 and 58 (checked 23 Oct 2026)
• News of Bahrain, "Businesses warned over unwanted marketing messages", 20 Oct 2026: newsofbahrain.com (checked 23 Oct 2026)
• Telecommunications Regulatory Authority, Resolution No. 1 of 2011, Bulk Messaging Regulation (Ref. CCA/0810/230), copy hosted by CYRILLA: cyrilla.org (checked 23 Oct 2026)
• WhatsApp Business Messaging Policy: whatsappbusiness.com (checked 23 Oct 2026)
• Meta, template categories and template pausing: template guidelines, template pausing (checked 23 Oct 2026)