ImplementingRegulationPersonalDataProtectionLaw

1- If the Personal Data is collected directly from the Data Subject, the Controller shall, before or when collecting the Data, take the necessary measures to inform the Data Subject of the following: a) Controller’s identity, its contact details, and any other details related to the channels established by the Controller for the purpose of communicating in relation with Personal Data protection. b) Contact details of the data protection officer appointed by the Controller, where applicable. c) The legal basis and a specific, clear, and explicit purpose for collecting and Processing Personal Data. d) The period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period. e) Explanation about Data Subject’s rights, as stipulated in Article (4) of the Law and the mechanisms for exercising those rights. f) Explanation on how to withdraw consent given to process of any Personal Data. g) Explaining whether collecting or Processing Personal Data is mandatory or optional. 2- Paragraph (1) of this article shall not apply if the information specified in sub- paragraphs (a) to (g) is already available to the Data Subject, or if providing such information conflicts with any of the existing laws in the Kingdom. 3- If Personal Data is collected from a party other than the Data Subject, the Controller shall, without undue delay and within a period not exceeding (30) days, take necessary steps to provide to the Data Subject information specified in paragraph (1) of this article, in addition to the categories of Personal Data being processed and the source from which the Controller obtained it. 4- Paragraph (3) of this article shall not apply in any of the following conditions if: a) The information is already available to the Data Subject. b) the provision of such information proves impossible or would involve a disproportionate effort. c) The Controller collects data to fulfil a legal requirement. d) The Controller is a Public Entity and the Collection of Personal Data is for security purposes, or to fulfil judicial requirements, or to achieve a Public Interest. e) The Personal Data is subject to an obligation to a professional secrecy regulated by a law. 5- A Controller whose activities require continuous or large scale Processing of Personal Data on individuals lacking full or partial legal capacity or whose parents are unknown, continuous monitoring of Data Subjects, adoption of new technologies, or making automated decisions based on Personal Data, shall take the necessary measures to inform the Data Subject of what is stipulated in paragraph (1) of this Article, in addition to the following: Public a) Means and methods of collecting and Processing Sensitive Data, where applicable. b) Means and procedures taken to protect Personal Data. c) Indicate whether decisions will be made based solely on automated Processing of Personal Data. 6- When the Controller engages in an additional Processing of Personal Data for a purpose other than the one for which it was initially collected for, it shall provide the Data Subject with the necessary information in accordance with the provisions of this article, before conducting such additional Processing. 7- The Controller shall provide the required information in an appropriate language as stipulated in this Article when aware that the Data Subject lacks full or partial legal capacity.