ImplementingRegulationPersonalDataProtectionLaw

for which it was collected 1- When the Controller Processes Personal Data for a purpose other than the one for which it was initially collected as provided in Article 10 of the Law, it shall do the following: a) Define clearly and specifically the Processing purposes. b) Document the procedures to fix scope of data to be processed in accordance with specific purposes, including the use of data maps that indicate the need for each processed data and link it to each Processing purpose. c) Take necessary measures to ensure that the Personal Data is collected while respecting data minimization principle to achieve the purposes as set in paragraph (b) above. 2- Except for cases stated in paragraph (3) of Article 10 of the Law, when the Controller Processes Personal Data for a purpose other than the one for which it was initially collected as provided in paragraphs (1), (2), (4), (5), and (6) of Article 10 of the Law, the Controller shall comply with the following: a) Define clearly and accurately the purpose of the Processing and refer to it in the records of Personal Data Processing activities. b) Limit the Collection and Processing of the Personal Data to the minimum amount necessary to achieve the purpose. c) Identify the type of Personal Data to be processed and the necessary measures to ensure that such data is processed appropriately. Public