WhatsApp Marketing Rules in Qatar: What the Data Privacy Law, the Regulators and Meta Actually Require

Short answer: Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016) says you may not send direct electronic marketing to an individual without their prior consent, and every marketing message must identify you and give the person a way to stop the messages or withdraw consent (Article 22). The law is administered by the National Cyber Security Agency (NCSA), which in August 2026 told the public that organisations should obtain explicit consent before sending promotional messages. Meta's own WhatsApp policy adds the same two duties: opt-in before you message, and honour every opt-out. This guide explains both. It is general information, not legal advice; for a specific campaign, ask a Qatar-qualified lawyer.

Three sets of rules, and which ones cover WhatsApp

Businesses in Qatar often hear about "the spam rules" without knowing which ones apply to a WhatsApp campaign. There are three layers, and they cover different things.

The data privacy law in brief

Law No. 13 of 2016 on the Protection of Personal Data Privacy was published in the Official Gazette on 29 December 2016. It applies to personal data that is processed electronically, or collected for electronic processing, and does not cover purely private or family use. A customer's name and mobile number in your CRM or WhatsApp platform are personal data under it.

Several of its provisions matter for anyone running WhatsApp campaigns:

• Consent and its withdrawal. Individuals have the right to withdraw their prior consent to processing and to object to processing that is unnecessary or excessive.
• Direct marketing (Article 22). It is prohibited to make direct electronic communication with an individual for marketing without first securing their consent.
• Sender identification and opt-out. A marketing communication must identify the sender and give contact details through which the individual can ask for the communications to stop or withdraw consent.

DLA Piper's summary of the law adds two practical points: consent should be clearly given, not implied through pre-ticked boxes, and the message should make clear that it is for direct marketing.

What Article 22 means on WhatsApp

Transactional messages a customer expects, such as a delivery update for an order they placed, are not marketing in the ordinary sense. But the moment a utility message carries an offer, it becomes marketing both for Meta's pricing and for the consent question.

The common grey areas

• "They gave us their number at the till." A number given for an order or a booking is not the same as consent to receive promotions. Ask separately.
• Bought or shared lists. A list from a property portal, an event organiser or a sister company does not carry consent to your marketing. Do not upload it.
• Old WhatsApp Business app contacts. Years of chats with a customer do not, on their own, prove consent to a broadcast. A short re-permission message ("Would you like to receive our offers on WhatsApp?") is the clean way to convert them.
• Click-to-WhatsApp ads. A customer who taps your ad and writes first has started the conversation, so replying is fine. Adding them to future broadcasts still needs their opt-in.

Who enforces it, and what happens on a complaint

The PDPPL is administered within the National Cyber Security Agency (NCSA). Sources name the office differently: DLA Piper refers to the National Cyber Governance and Assurance Affairs of the NCSA, and an August 2026 NCSA statement reported by The Peninsula refers to the Personal Data Privacy Protection Department.

That statement, published on 24 August 2026, is the clearest recent signal of how the regulator sees promotional messages. The NCSA reminded the public that people can withdraw their consent at any time and that organisations "should obtain your explicit consent before sending electronic direct marketing messages" by email, SMS or calls. The process it described is two-step: the person first contacts the sender and asks them to stop; if the sender does not respond or keeps sending, the person fills in a complaint form and sends it to the department for review and action.

For a business, the lesson is simple: a working opt-out is your first line of defence, because the regulator expects the complaint to come to you before it comes to them.

Penalties

When the law was issued, Qatar Tribune reported that fines under it range between QR1 million and QR5 million, and DLA Piper also puts the maximum at 5 million. We have not been able to check the exact penalty article for direct marketing against the official text, so treat these as reported maximums rather than a schedule.

The telecom spam rules: useful, but not a WhatsApp rule

Qatar's Communications Regulatory Authority (CRA) issued a Spam Regulation in 2016 (CRA President Decision No. 11 of 2016) and consulted on amendments in 2017 to align it with the data privacy law. In October 2024 the CRA issued a Communications Consumer Protection Policy and Regulation that addresses unsolicited direct marketing, spam and personal data, and lists the 2016 Spam Regulation among the instruments to be repealed after a transition period.

These rules are written for licensed telecom service providers and the messages they carry, mainly SMS. WhatsApp is not an SMS route, so they are not the legal test for a WhatsApp campaign. Their principles, though (consent, an easy way to opt out, respect for the customer's time), are exactly what Meta's quality systems reward.

Is there a legal sending-hours rule?

We found no official Qatari rule that sets hours for WhatsApp marketing. Some SMS vendors publish a Qatar sending window of 8 AM to 9 PM, but we could not find it in any CRA text, so we do not present it as law. As a matter of good practice, Doha businesses typically keep promotions to daytime and early evening, avoid Friday midday prayer time, and move sends later during Ramadan, when the day runs around fasting, iftar and taraweeh. QuickWA lets you set a sending window in Settings; scheduled broadcasts wait until it reopens.

Meta's own rules

Whatever Qatari law says, Meta enforces its own policy on every WhatsApp Business Account, and it acts faster than any regulator.

• Opt-in first. You may contact people only if they gave you their number and you received opt-in permission confirming they want to receive messages from you. Meta recommends explaining the value of what they will get, and separate opt-ins for different kinds of message.
• Honour every opt-out. You must respect all requests, on or off WhatsApp, to block, discontinue or opt out, and remove that person from your contacts list for those messages.
• Use the right template category. Offers are marketing. Utility must be non-promotional, and only authentication templates may carry one-time passcodes. Meta can move a misused utility template to marketing, with a day's notice, or instantly for businesses already warned.
• Feedback counts. Blocks and reports lower your quality rating, which can cap how many messages you send.

Meta's enforcement ladder

Severe harm, such as scams, can lead to immediate offboarding without the earlier steps. Appeals go through Business Support Home and typically take 24 to 48 hours.

Getting it right for a multilingual audience

Most people living in Qatar are not Qatari (National Planning Council figures for May 2024, reported by Marhaba, put Qataris at about 350,000 of 3.08 million residents), and a large share read Hindi, Malayalam, Urdu, Filipino or Nepali more comfortably than Arabic or English. Consent is only meaningful if the person understood what they agreed to. Two habits help:

• Show the opt-in wording in Arabic and English at minimum, and in the customer's own language where you serve a community directly, such as a remittance counter, a grocery chain or a clinic with Malayalam-speaking staff.
• Recognise opt-out words in every language you send in, not only "STOP": إيقاف, "band karo", "unsubscribe" and plain "no more" should all be treated as a request to stop.

A practical compliance checklist

1. Map your sources. Write down where every contact came from: website form, in-store sign-up, booking system, Click-to-WhatsApp ad.
2. Collect clear opt-in. Unticked box or explicit reply; specific wording; your business name in it.
3. Store the evidence. Date, time, source, wording and language for each consent. QuickWA's contacts keep consent tracking alongside each record.
4. Separate marketing from service. Order and appointment updates in utility templates; offers only in marketing templates, only to opted-in contacts.
5. Identify yourself in every promotion, by display name and in the message body.
6. Put an opt-out in every marketing template and make it work automatically. QuickWA processes STOP replies automatically so the contact is excluded from later broadcasts.
7. Re-permission old lists before you broadcast to them for the first time.
8. Keep sends to sensible hours and adjust for Fridays and Ramadan.
9. Watch your quality rating after every campaign and slow down if it drops.
10. Answer complaints quickly. Under the NCSA process the complaint comes to you first.
11. Review data handling with your adviser: who in your team can export contacts, how long you keep them, and where they are processed.

Tools help, but they do not make a campaign lawful on their own: what matters is how you collect consent and what you send. For the platform side, see the QuickWA Qatar page, and for timing ideas the Qatar campaign calendar.

Sources

• The Peninsula, "Public can withdraw consent to unwanted promotional messages: NCSA", 24 August 2026: thepeninsulaqatar.com (checked 23 Oct 2026)
• DLA Piper, Data Protection Laws of the World: Qatar (regulator, electronic marketing, penalties): dlapiperdataprotection.com (checked 23 Oct 2026)
• Qatar Tribune, "New law on personal data protection" (Article 22 and fines, at enactment): qatar-tribune.com (checked 23 Oct 2026)
• Gulf Times, CRA Communications Consumer Protection Policy and Regulation, 20 October 2024: gulf-times.com (checked 23 Oct 2026)
• Lexis Middle East, CRA consultation on amendments to the 2016 Spam Regulation: lexis.ae (checked 23 Oct 2026)
• Population by nationality (NPC, May 2024), as reported by Marhaba: marhaba.qa (checked 23 Oct 2026)
• WhatsApp Business Messaging Policy: whatsappbusiness.com (checked 23 Oct 2026)
• Meta, policy enforcement and template category guidelines: policy enforcement, template guidelines (checked 23 Oct 2026)