CertificatesControllersProcessorsAuditingInspectionPersonalDataProcessingActivities

1. The Licensee shall continuously train and develop its personnel involved in personal data protection in accordance with the provisions of the Law and the Regulations, and support them in obtaining professional certifications in this field to ensure the enhancement of their competence. عام Document Classification: Public 2. The Licensee shall monitor and comply with any regulations, instructions, or similar publications related to personal data protection issued by the Competent Authority. 3. The Licensee shall conduct a semi-annual assessment of the administrative, technical, regulatory, and operational measures and procedures related to the issuance of accreditation certificates or the conduct of audit or inspection activities, to ensure the continued fulfillment of the license conditions and requirements specified in Articles (3) and (4) of these Rules, in accordance with the mechanism and standards set by the Competent Authority. 4. The Licensee shall maintain the confidentiality of the findings related to the issuance of accreditation certificates or the conduct of audit or inspection activities concerning assessed entities, and shall not publish, share, or disclose such findings without the prior written approval of the Competent Authority. 5. The Licensee shall disclose any material change after obtaining the license that may result in a conflict of interest with any Controller or Processor when performing its duties under the license. 6. The Licensee authorized to issue accreditation certificates shall prepare a plan and procedures for the periodic review of the work of entities that have been issued accreditation certificates. 7. Obtain the approval of the Competent Authority when the Licensee wishes to acquire or merge with another Licensee. 8. Data related to the conduct of these activities shall be retained and stored within the Kingdom.