RegulationonPersonalDataEN

Personal Data to a Party Outside the Kingdom The controller shall conduct a risk assessment before transferring or disclosing personal data to a party outside the Kingdom in the following cases: A. Transfer or disclosure of personal data to a party outside the Kingdom in accordance with Article (4) of the Regulation. Public Classification Document B. Transferring or disclosing sensitive data to entities outside the Kingdom on a continuous or widespread basis. Risk assessment of transferring or disclosing personal data to a party outside the Kingdom should include the following elements: A. The purpose and legal basis for transferring or disclosing personal data to a party outside the Kingdom. B. A description of the nature of the transfer or disclosure of personal data to a party outside the Kingdom, including the activities involved in processing the data and their geographical scope. C. The appropriate safeguards and measures implemented for transferring or disclosing personal data to a party outside the Kingdom, and their adequacy in ensuring an appropriate level of protection for personal data not less than that prescribed by the Law and Regulations. D. The measures used to ensure that the transfer or disclosure of personal data to a party outside the Kingdom is limited to the minimum amount of data required to achieve the intended purposes, in cases not exempted by subparagraph (c) of paragraph (2) of Article (29) of the Law. E. The potential material or moral effects of transferring or disclosing personal data to a party outside the Kingdom and the likelihood of their occurrence. F. The measures or controls that will be applied to prevent potential risks to personal data subjects or to mitigate their effects if they occur. Public Classification Document