ImplementingRegulationPersonalDataProtectionLaw

1- The Controller shall, upon receiving a request from the Data Subject regarding their rights as stipulated in the Law, do the following: a) Act on the request of the Data Subject for exercising their rights under the Law within a period not exceeding (30) days and without delay. This period may be extended in case the implementation requires disproportionate effort, or if the Controller receives multiple requests from the data subject, provided that the extension period does not exceed an additional (30) days and the Data Subject is notified in advance of the extension with the reasons for the delay. b) Take the necessary technical, administrative, and organizational measures to ensure a prompt response to requests related to exercising rights. c) Take appropriate measures to verify the identity of the requester before executing the request in accordance with relevant legal requirements. d) Take the necessary measures to document and keep record of all received requests including oral requests. 2- The Controller may refuse to act on request when it is repetitive, manifestly unfounded, or requires disproportionate efforts, in which the Data Subject shall be notified of such reason. 3- In cases where the Data Subject fully or partially lacks legal capacity, their legal guardian shall exercise their rights on their behalf. Public