Short answer. Owning a contact is not permission to market to them. In the UAE a reactivation campaign meets three separate requirements: the TDRA needs prior explicit consent you can produce on request, the data protection law gives the contact a standing right to object, and WhatsApp requires its own opt-in. Sort the list by who said yes, not by who went quiet.
Every CRM has a graveyard. Enquiries that arrived, got a reply or did not, and then went quiet. Someone will offer to wake it up for you, and the offer is always framed the same way: this list is already paid for, so the revenue is free.
The offer is real. The campaign shape being sold with it was designed somewhere else, and the part that does not travel is the part nobody mentions.
What is actually being sold as database reactivation?
An automated sequence of text messages and emails, fired at every dormant contact in a CRM, with the interested ones routed to a calendar.
Read the pages that rank for the term and they all describe the same thing. One calls it an automated SMS-and-email sequence that wakes up old form fills, no-shows and cold enquiries. Another asks you to upload a dormant list, promises to clean it, and books the interested ones onto your calendar without spending anything on ads. Nobody argues about the channel. It is SMS, because whoever wrote these pages was writing for a market where a business still opens a conversation by text.
A figure travels with them. Several of them say a reactivation campaign recovers between 5 and 15 percent of dormant leads, one of them twice on one page, both times with "on average" in front of it. No study, sample, method or date appears anywhere alongside it. That does not make it false. It does mean nobody quoting it can tell you where it came from, and you should treat it as an industry belief of unknown origin rather than as a number you can plan around.
The mechanism underneath is sound and worth having. A contact who once spoke to you is warmer than a stranger from an advertisement, and reaching them costs a fraction of buying a new lead. That part survives the trip; the delivery model does not.
Does having their contact numbers make them a marketing list?
No. The TDRA wants the person to say yes explicitly before you send them marketing. A number they left so you could deliver an order, invoice them or answer a support question does not say that.
The relevant document is the TDRA Regulatory Policy on Unsolicited Electronic Communications, the cellular phone spam policy issued on 13 June 2022. It defines a marketing text message broadly, covering messages that advertise goods, services or business opportunities, or that solicit donations.
Four requirements in it change how a campaign has to be built.
Consent comes first, before any message is delivered, and the subscriber has to initiate the opt-in. Consent has to be recorded in a form that can be stored and produced to the TDRA, with the date, the time, the wording that indicated consent, the identity of the recipient and the telephone number. Every marketing message has to carry a free and effective way to opt out, and nothing may be sent after an unsubscribe or block. Sending is permitted between 07:00 and 21:00 UAE time.
Read that list against the campaign in the previous section. An imported list of old enquiries is not an opt-in list, and it does not become one because the contacts are yours. If you cannot produce the consent record for a given number, the honest answer is that you do not have consent for that number.
What does the data protection law add on top?
The contact can object to direct marketing whenever they like, and you have to tell them first if anyone else touches their data or uses it on your behalf.
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data came into force on 2 January 2022. It establishes consent as the general basis for processing personal data, subject to defined exceptions, and it gives the individual the right to object to processing for direct marketing, including the profiling that supports it. Where personal data is disclosed to a third party, or used on a third party's behalf for direct marketing, the individual has to be told beforehand and expressly offered the right to object.
This sits alongside the TDRA rules rather than replacing them. Satisfying one does not satisfy the other, and the second one has a long tail: an objection registered today has to keep holding next quarter, when a different campaign runs from a different list export.
That last point is the one that quietly breaks in practice. Consent and objection are treated as facts about a campaign, when they are facts about a person, and they outlive whichever spreadsheet was current when the objection arrived.
Does WhatsApp change the answer?
It adds a third gate rather than a way around the first two.
The WhatsApp Business Messaging Policy allows a business to contact someone only where it holds both their mobile number and an opt-in confirming that they want to receive messages. A company's own database does not satisfy this on its own. Meta's guidance is that the opt-in should cover the categories of message the business intends to send.
People read the 24-hour window as a loophole. It is not one. The customer opens that window when they message you, and for 24 hours after their last message you can reply freely, without a template. Once it closes, anything you start needs an approved message template. Approval is not consent: send a promotional template to somebody who never opted in, and you breach the policy, however carefully the template was worded.
| Requirement | What the source says | What it means for a blast campaign |
|---|---|---|
| TDRA prior consent | Explicit consent before sending, recorded so it can be produced to the regulator, with a free opt-out in every message and sending only between 07:00 and 21:00 UAE time. Cellular phone spam policy, 13 June 2022 | The list has to be filtered by consent evidence before a single message is queued |
| Right to object | Standing right to object to direct marketing at any time, plus prior notice and an express right to object where data is used by or for a third party. Federal Decree-Law No. 45 of 2021, in force 2 January 2022 | Objections have to persist across campaigns and across list exports, not inside one of them |
| WhatsApp opt-in | Number plus opt-in both required; the 24-hour window is reply-only; business-initiated messages outside it need an approved template. WhatsApp Business Messaging Policy | Moving the campaign to WhatsApp removes nothing and adds a platform rule of its own |
None of this is legal advice, and this article is not a substitute for it. Confirm your own position with your telecom provider and your counsel, because the operator that carries your messages has its own registration and consent requirements on top of the policy.
So how do you actually run reactivation here?
Segment on consent rather than on dormancy, and hold consent as data in the CRM instead of as an assumption about the list.
That single change reorganises the whole campaign, and most of the work is unglamorous.
- Store consent status as a field, with its source and its date. Where the contact opted in, what wording they saw, and when. A contact with no record is not a contact you may market to, however warm they feel.
- Suppress a number before the message goes out, not after the complaint. Opt-outs and blocks belong in one list that every campaign reads, and it has to survive the next export.
- Let the system hold the sending window. 07:00 to 21:00 UAE time is a rule about when a message may arrive, not about when somebody happened to press send.
- For contacts with no marketing consent, use the channel they opened. If they messaged you, you have a customer service window and a real conversation to continue. If they have not, earn the opt-in rather than assume it.
What you end up with is smaller than the list you started with and worth considerably more per message. It is also the version that can survive being asked to show its consent records, which the blast version cannot.
We built our own reactivation system around this. It respects the contact hours, pauses and stop conditions the client sets, and it does not fire blast campaigns, because the campaign that ignores all this is the one that lands a company in trouble over a list it already owned.
We went through the speed evidence in [an earlier piece](/insights/lead- response-time-evidence): answering fast buys you the conversation and does not close the sale. Reactivation runs the other way round. Here permission buys the conversation, and no amount of clever sequencing will buy it for you.
Danil Ivanov
Founder, KAIVIX
Builds AI systems for companies in the UAE and beyond.