RegulationonPersonalDataEN

Level of Personal Data Protection Outside the Kingdom The competent authority shall publish on its official website a list of countries or international organizations that provide an appropriate level of protection for personal data not less than that prescribed by the Law and Regulations. The competent authority shall review this list every four years, or as necessary, based on the following criteria: A. The existence of regulations that ensure the protection of personal data and the rights of data subjects, including the right to seek compensation for damages caused by violations of these rights. These Public Classification Document regulations must meet at least the level of protection prescribed by Law and Regulations. B. The existence of a supervisory body responsible for enforcing the provisions related to the protection of personal data. C. The supervisory authority is prepared to cooperate with the competent authority in the Kingdom on matters related to the protection of personal data. D. The regulatory requirements related to the disclosure of personal data under the relevant statutory provisions applicable in the State or international organization must not conflict with the provisions for the disclosure of personal data set forth in the Law and Regulations, nor with any other statutory provisions in force in the Kingdom. E. Obligations arising from international treaties or agreements binding on a State or an international organization, as well as those related to its membership in regional or multilateral organizations, which may require the transfer of personal data. F. Provisions related to subsequent transfers of personal data, as stipulated in Article (5) of the Regulation. ２. The competent authority may amend the list of countries or international organizations that ensure an appropriate level of protection for personal data transferred outside the Kingdom not less than that prescribed by the Law and Regulations in accordance with the statutory procedures. If a review indicates that any of these countries or organizations no longer guarantees an appropriate level of protection, the competent authority may work with the relevant authorities in the State or the international organization to address the reasons for its exclusion from the list. Public Classification Document ３. The competent authority may suspend the transfer or disclosure of personal data to any of the countries or organizations listed in paragraph (1) of this Article, in accordance with the statutory procedures. ４. The standards applied to countries and international organizations for evaluating the level of protection of personal data outside the Kingdom shall also apply to cities, special economic zones, and global trade centers.