Because Gulf consent rules have no business-to-business exemption, so a European soft opt-in list is non-compliant from the first send, and because enterprise and government buyers are reached through supplier registers rather than inboxes. UAE federal registration takes 30 working days. A tender stays open for 10. The work has to be done before the opportunity exists.

That is the short version. The longer version is more useful, because the reasons cold outreach underperforms in the Gulf are published, dated and numbered, which means you can plan around them instead of guessing at them.

Nobody has a Gulf cold outreach benchmark, so ignore anyone who quotes you one

There is no response-rate benchmark for Gulf outbound published by a statistical authority, a regulator or a trade body. Searching for one returns sales-tool marketing content, none of it disclosing a sample, a date range or a methodology, and none of it segmented by GCC country. If an agency quotes you a Gulf reply rate, they either invented it or lifted it from a global dataset that had no Gulf cohort in it.

What the Gulf does publish is its own rules. Those are harder than a benchmark and considerably more useful, because a benchmark tells you what happened to somebody else and a statutory deadline tells you what will happen to you.

There is no business-to-business exemption, and that is the part European senders get wrong

European outbound practice leans on a distinction that the Gulf regimes do not make. In the EU, corporate subscribers are often treated more permissively than individuals, and a lot of Polish sales teams run on legitimate interest plus a soft opt-in against role-based addresses. Three Gulf laws are written around the individual recipient with no corporate carve-out at all.

Saudi Arabia. The Personal Data Protection Law, issued by Royal Decree No. M/19 of 9/2/1443H, corresponding to 16 September 2021, amended by Royal Decree No. M/148 of 5/9/1444H, corresponding to 27 March 2023, took effect on 14 September 2023 with a twelve-month grace period that ended on 14 September 2024. Article 25 reads:

With the exception of the awareness-raising materials sent by Public Entities, Controller may not use personal means of communication, including the post and email, of the Data Subject to send advertising or awareness-raising materials, unless: 1- Obtaining the prior consent of the targeted recipient for such materials. 2- The sender of the material shall provide a clear mechanism, as set out in the Regulations, that enables the targeted recipient to request stopping receiving such materials if they desire so.

Note what is and is not there. The only exception is awareness material from public entities. There is no exception for a named person at a company, and no distinction drawn between a work address and a private one. Article 28 of the Implementing Regulations, which took effect alongside the law on 14 September 2023, goes further. On Bird & Bird's reading of the current wording, it requires consent in the case where there has been no prior interaction between the controller and the data subject. A cold email is, by definition, the case where there has been no prior interaction. That is not an edge case the regulation might reach. It is the case the regulation was drafted for.

Administrative penalties run to SAR 5 million, doubled for repeat violations. Disclosing or publishing sensitive personal data with intent to cause damage or gain a benefit carries up to two years' imprisonment and a fine of up to SAR 3 million.

Qatar. Article 22 of Law No. 13 of 2016 on Personal Data Privacy Protection requires three things at once. No electronic communication may be sent for direct marketing purposes to an individual "save after obtaining such Individual's prior consent". Every message must carry "the identity of the creator thereof, in addition to an explicit notice that the service is meant for direct marketing". And every message must include "a valid verifiable easy-accessible address" through which the recipient can stop the messages or withdraw consent. Article 23 makes an Article 22 breach punishable by up to QAR 1,000,000, and Article 25 adds up to QAR 1,000,000 against the legal person where the offence is committed in the company's name.

So the standard Gulf-adapted sequence, three touches, no unsubscribe, a sender alias that is not the company, fails Article 22 three separate ways before anyone reads it.

What actually binds a Polish sender in the UAE, and what does not

The UAE is the market most European vendors ask about first, and here the honest answer is that the position is looser than the compliance content suggests. It is worth being precise about where the rules bite, because overestimating the risk costs you the market and underestimating it costs you the database.

The UAE has no general electronic marketing statute. What it has is four instruments pointing at the problem from different angles.

The TDRA policy binds the operators, not you. The Regulatory Policy on Unsolicited Electronic Communications, version 1.0 issued 30 December 2009, defines Spam as marketing electronic communications sent without the recipient's consent, and applies to any communication with a "UAE Link", which covers messages originating outside the UAE and messages merely accessed on a device inside it. It contains no business-to-business exemption, and the one exemption it does carry, at Article 7, is for government entities. But the obligations run against Licensees, meaning the telecom operators, who must take practical measures to minimise spam on their networks and must act once they are aware of it. The practical consequence for a Warsaw sender is not a fine. It is that your deliverability into the UAE is somebody else's compliance obligation, and they will discharge it at your expense.

The telemarketing regulations are not about you. Cabinet Resolution No. 56 of 2024 on regulating marketing via telephone calls and Cabinet Resolution No. 57 of 2024 on violations and administrative penalties were published on 28 June 2024 and took effect sixty days later. They require companies licensed in the UAE, free zones included, to obtain prior approval from the competent authority before carrying out telemarketing, restrict calls to between 9am and 6pm, and oblige firms to respect a Do Not Call Register. Resolution 57 sets AED 75,000 for a first offence of telemarketing without prior approval, AED 100,000 for a second, and AED 10,000 rising to AED 50,000 for failing to train marketers properly. A company licensed in Poland, calling a Dubai CIO from Kraków, is not the addressee of Resolution 56. If you have been told you need a UAE telemarketing permit to make that call, you have been told something that is not in the instrument.

The UAE data protection law is in force but not yet operational. Federal Decree-Law No. 45 of 2021 gives data subjects a right to stop processing carried out for marketing purposes, including profiling linked to direct marketing. The law has been in force since 2 January 2022. Its executive regulations were still unissued through 2026, and the Data Office that will administer it is not fully operational. The obligation exists. The detail and the enforcement machinery do not yet. That gap will close, and it will close in the direction of more obligation rather than less.

The real UAE exposure is on the list, not the send. This is the finding worth taking away. Federal Decree-Law No. 34 of 2021 on Countering Rumours and Cybercrimes, issued 20 September 2021 and in force since 2 January 2022, has no anti-spam article at all. What it has is Article 13, which punishes anyone who uses information technology to collect, save or process the personal data of UAE nationals and residents in violation of UAE legislation, with imprisonment and a fine of not less than AED 50,000 and up to AED 500,000. Article 6(1) separately covers acquiring, possessing, modifying, disclosing, deleting, copying or disseminating personal electronic data without permission, carrying at least six months' imprisonment and a fine of AED 20,000 to AED 100,000.

A scraped prospect database is collection and storage. The email is the visible act. The database behind it is the one with a criminal provision attached. Most vendors worry about the sequence and ignore the spreadsheet, which is exactly the wrong way round.

For completeness, Federal Decree-Law No. 14 of 2023 on Trade via Modern Technological Means also gives consumers, at Article 6, the choice of whether to receive marketing by phone, email or social media.

Saudi Arabia is tightening this right now, and the consultation is open

On 6 October 2026 SDAIA opened a public consultation on draft amendments to the PDPL Implementing Regulations, running until 5 November 2026 on the Istitlaa platform. If adopted, the amendments take effect sixty days after publication in the Official Gazette. An earlier round of draft amendments went to consultation between 27 April and 27 May 2025.

Two of the proposed changes matter for anyone running outbound into the Kingdom. On Clyde & Co's reading, draft Article 28 would require a controller relying on a prior relationship with the recipient to verify that valid consent actually exists and to keep evidence of it. Draft Article 29 would extend beyond the act of sending marketing messages to cover all processing of personal data for marketing purposes, and would require a controller, on withdrawal of consent, to stop both the marketing and the underlying processing and to destroy personal data generated by that processing without undue delay.

Read those together and the direction of travel is clear. The prior-relationship escape route narrows, and the obligation attaches to the CRM rather than to the send button. A Gulf prospect database assembled on the assumption that the rules only govern outbound messages is a database that may need deleting rather than suppressing.

What replaces it: the buying side is gated, and the gates are slower than the windows

Here is the structural reason cold outreach cannot work the way it works in Poland, and it has nothing to do with culture.

Gulf enterprise and government buying is register-gated and time-boxed. The gate is slow, the window is short, and the window is shorter than the gate.

The gate. UAE federal procurement runs on Federal Law No. 11 of 2023 on Procurement in the Federal Government and its executive regulations, Cabinet Resolution No. 122 of 2024. Article 7(1) is unambiguous: suppliers "shall register in the supplier registry via self-registration (electronically)" and "No supplier shall be allowed to participate in any tender unless he is registered and accepted." The Ministry of Finance's own service page for registration in the Federal Supplier Register gives a service duration of 30 working days and "No Fees". Among the six eligible categories is Foreign Supplier, defined on the page as "Companies located outside UAE, and without a local branch in UAE", requiring a trade licence, a tax registration certificate and a passport copy of the company owner. A Polish company's KRS extract and tax certificate satisfy that list. You do not need a UAE entity to get through this gate.

The window. The UAE's own commitments in Annex 11-A of its CEPA government procurement schedule, Section F, set the minimum tendering periods: a Request for Proposals must stay open at least 10 working days where the estimated contract value is AED 300,000 to AED 2 million, and at least 15 working days above AED 2 million. Requests for Information get 6 and 10 working days on the same split. Proposals, once submitted, must remain open for at least 90 calendar days.

Now do the arithmetic, which nobody writing about Gulf sales culture ever does. Registration: 30 working days. Response window once the tender is published: 10 working days. If you begin the process when you see the opportunity, you are roughly four working weeks late before you write the first line of your proposal. No amount of relationship-building, follow-up cadence or localised subject line closes a gap that is structural and published.

Saudi Arabia is tighter still at the small end. Article 34(1) of the Executive Regulations of the Government Tenders and Procurement Law sets the interval between the e-portal announcement and the bid deadline at not less than fifteen days for works and procurements estimated at SAR 5 million and less, thirty days above SAR 5 million and below SAR 100 million, and sixty days at SAR 100 million and above. Article 34(2) lets the government authority shorten those periods with the Minister's approval where the nature of the work does not require the full period. Fifteen days to price a deal, and the smaller the deal the less time you get.

What the gate gives back. Qualification is not a one-off cost, it is an asset with a shelf life. Article 8(6) of Cabinet Resolution No. 122 of 2024 lets an agency that has prequalified a supplier treat that supplier "as prequalified for any similar procurements issued by that agency within one year from the date of the supplier's prequalification". The reuse is limited to the agency that granted it, which is the important detail: prequalification is per buyer, and it compounds per buyer for twelve months. Three prequalified agencies is a pipeline. Three hundred emails is a list.

Article 33(1) of the same resolution gives an unsuccessful supplier a statutory debrief: the agency must respond to an unsuccessful supplier's inquiry or clarification request "within no more than (10) ten business days". That is a free, mandated loss-review channel, and almost no foreign vendor uses it.

And from early January 2027, Saudi Arabia hands software vendors something specific. The new Government Tenders and Procurement Law was approved by the Council of Ministers in August 2026 and enters into force 120 days after its publication in Umm Al-Qura, which places it in early January 2027. It raises the direct purchase threshold tenfold, from SAR 100,000 to SAR 1 million, cuts the Ministry of Finance's pre-signature contract review from 15 working days to 4, merges the two bid committees into one, and raises the maximum contract variation from 10 to 20 percent. On Clyde & Co's reading of the reforms, direct purchasing will also extend to more categories, software licences and subscriptions among them.

That is a route, not a loophole. A subscription priced under SAR 1 million, inside a category now eligible for direct purchase, reaches a Saudi government buyer without a competitive tender and without the fifteen-day pricing scramble.

On the human side, the official advice is unglamorous and correct. The US government's Country Commercial Guide for the UAE, last published 26 August 2025, says relationships "take time to nurture" and that it is important to "establish a local presence or, at the very least, make frequent contacts and visits", describing face-to-face contact and local trade events as "essential". It also notes that the UAE's exhibition season runs from late September through May. That is seven months of buyer-dense calendar, and it is the one part of the year where permission can be collected rather than assumed.

What this means in practice

If you were about to spend a quarter's budget on a Gulf outbound sequence, spend it on five things instead.

Register before you have a reason to. Get into the UAE Federal Supplier Register now, while nothing is at stake. It is free, the Foreign Supplier category does not require a UAE entity, and the thirty working days will cost you nothing today and cost you a tender in March. Registration while idle is the single highest-return thing an unrepresented foreign vendor can do in the UAE, and it is the thing nobody does, because it generates no meetings this month.

Fix the list before you fix the copy. If your Gulf contacts came from a scraper or a bought file, the problem is not your subject line. In the UAE the criminal provision attaches to collecting and storing the data, not to emailing it. In Saudi Arabia the consent requirement attaches to the first advertising message, with no business carve-out to fall back on. Rebuild the list consent-first: stand sign-ups, webinar registrations, inbound from your own site, event badge scans with an explicit opt-in. A small permissioned list is worth more than a large unlawful one, and that is now a legal statement rather than a motivational one.

Count prequalifications, not contacts. Change the pipeline metric. Article 8(6) makes one prequalification good for a year of similar procurements with that agency, so the unit of progress is a buyer you are qualified with, not a person you have emailed. Target three to five named agencies or enterprises and get qualified with each. That is a measurable, defensible quarter.

Use the two exhibition windows as a consent-collection mechanism, not a lead-generation one. Between late September and May, pick two events and go with a single objective: documented permission to follow up, recorded with the date, the wording and the identity of the person who gave it. That record is what makes the subsequent sequence lawful in Riyadh and Doha, and it is the one thing an outbound tool cannot manufacture.

Build a Saudi SKU under SAR 1 million before January. If your product can be sold as a subscription priced below SAR 1 million, package it that way now. From early January 2027 that price point sits inside the direct purchase threshold under the new procurement law, in a category the reforms are expected to cover. It is the fastest legal route into a Saudi government buyer, and it did not exist six months ago.

None of this is faster than sending a thousand emails. All of it is faster than sending a thousand emails and waiting.

If you want help working out which of the five applies to your product and which register you should be in first, get in touch.

Sources

This article is commercial guidance, not legal or tax advice. Data protection, marketing and public procurement rules in the GCC change frequently, and several of the instruments described here are subject to amendments that were still in consultation when this was written. Verify the current position with a qualified adviser before acting on it.