ImplementingRegulationPersonalDataProtectionLaw

1- Except Public Entities, a Controller may process Personal Data to achieve a Legitimate Interest provided that the following conditions are met: a) Purpose shall not violate any of the laws in the Kingdom. Public b) The rights and interests of the Data Subject and the Legitimate Interest of the Controller shall be balanced, so that the interests of the Controller do not affect the rights and interests of the Data Subject. c) Processing shall not include Sensitive Data. d) Processing shall be within the reasonable expectations of the Data Subject. 2- Legitimate interests include the Disclosure of fraud operations, the protection of network and information security, and other Legitimate Interests that meet the conditions outlined in paragraph (1) of this article. 3- According to the provisions of paragraph (4) of Article (6) of the Law, before Processing Personal Data for Legitimate Interests, the Controller shall conduct and document an assessment of the proposed Processing and its impact on the rights and interests of Data Subjects. The assessment shall include the following: a) Identification of the proposed Processing and its purposes, as well as the type of data and categories of Data Subjects. b) Evaluation of the purpose to ensure that it is legitimate and compliant with the laws in the Kingdom. c) Verification of the necessity to process Personal Data to achieve the legitimate purpose of the Controller. d) Evaluation of whether the proposed Processing will cause any potential harm to Data Subjects or their ability to exercise their legally established rights. e) Identification of any measures that shall be taken to avoid potential risks or harms, in accordance with the provisions of paragraph (2) of Article (25) of this Regulation. 4- If the assessment outlined in paragraph (3) of this article indicates that the proposed Processing will in any way violate any law, infringe on the rights and interests of Data Subjects, cause harm to them or any other party, the Controller shall modify the proposed Processing and conduct a new assessment, or consider relying on another legal basis. Public