PDPL

Legal bases for personal data transfers between different legal zones

Critical

High

Normal

Low

Records of personal data transfers to third parties

Critical

High

Normal

Low

Article 7.1: Right to request correction of personal data

The Data Subject shall have the right to obtain from the Controller a restriction of Processing when the accuracy of the Personal Data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the Personal Data. The aforementioned restriction shall not apply if providing such data contravenes provisions of the Law and this Regulation.

Related tasks

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Process for data subjects to rectify inaccurate personal data

Critical

High

Normal

Low

Privacy by design and default

Ensuring and documenting the accuracy of personal data

Critical

High

Normal

Low

Identification of the rights available to the data subject

Critical

High

Normal

Low

Security and responsibilities

Article 32.1-2: Appointment of a Data Protection Officer

1. The Controller shall appoint one or more individuals to be responsible for the protection of Personal Data in any of the following cases:

Controller is a Public Entity that provides services involving Processing of Personal Data on a large scale.
Primary activities of the Controller consist of Processing operations that require regular and continuous monitoring of individuals on a large scale.
Core activities of the Controller consist of Processing sensitive Personal Data.

2. Subject to the requirements of paragraph (1) of this Article, the data protection officer may be an official, an employee or an external contractor of the Controller.

Related tasks

Appointment, tasks and position of a Data Protection Officer (DPO)

Critical

High

Normal

Low

Cyber security management

Article 23: Information security

The Controller shall take the necessary organizational, administrative, and technical measures to ensure the security of Personal Data and the privacy of the Data Subjects, and shall comply with the following:

Implement necessary security and technical measures to limit security risks related to Personal Data Breach.
Comply with relevant controls, standards, and rules issued by the National Cybersecurity Authority or recognized best practices and cybersecurity standards if the Controller is not obligated to follow the controls, standards, and rules issued by the National Cybersecurity Authority.

Related tasks

Cyber security policy and procedure compliance requirements

Critical

High

Normal

Low

Privacy and Data Protection policy -report publishing, informing and maintenance

Critical

High

Normal

Low

Privacy by design and default

Detailed assessment of the risk of data breach for data subjects

Critical

High

Normal

Low

Data breach management

Risk management procedure -report publishing and maintenance

Critical

High

Normal

Low

Risk management

Article 24.5: Notification of data subjects

The Controller shall, without undue delay, notify the Data Subject of a Personal Data Breach, if it may cause damage to their data or conflict with their rights or interests, provided that the notification is in simple and clear language, and that it includes the following:

Description of the Personal Data Breach.
Description of the potential risks arising from the Personal Data Breach, and the measures taken to prevent or limit those risks and limit their impact.
Name and contact details of the Controller and its data protection officer, if any, or any other appropriate means of communication with the Controller.
Any recommendations or advice that may assist the Data Subject in taking appropriate measures to avoid the identified risks or limit their impact.

Related tasks

Reporting personal data breaches to authorities / data subjects

Critical

High

Normal

Low

Data breach management

Article 17.1: Choosing the processor

The Controller shall ensure that any Processor chosen provides sufficient guarantees to protect Personal Data, and that the agreement with the Processor includes the following:

Purpose of the Processing.
Categories of Personal Data being processed.
Duration of the Processing.
Processor's commitment to notify the Controller in case of a Personal Data Breach, in accordance with the provisions of the Law, this Regulation, and without undue delay.
Clarification of whether the Processor is subject to Regulations in other countries and the impact on their compliance with the Law and its Regulations.
Not requiring the Data Subject's prior consent for mandatory Disclosure of Personal Data under the applicable laws in the Kingdom, provided that the Processor notifies the Controller of such Disclosure.
Identifying any subcontractors contracted by the Processor, or any other party to whom Personal Data will be disclosed.

Related tasks

Evaluation of data processing agreement for important data processors

Critical

High

Normal

Low

Reporting personal data breaches to authorities / data subjects

Critical

High

Normal

Low

Data breach management

Inventory and documentation of data processing agreements

Critical

High

Normal

Low

Data processing partner listing and owner assignment

Critical

High

Normal

Low

Documentation of partner contract status

Critical

High

Normal

Low

Defining and documenting retention times for data sets

Critical

High

Normal

Low

Article 8.2: Elements of the data transfer risk assessment

The risk assessment of data Transfer outside the Kingdom or Disclosure to a party outside the Kingdom should include at least the following elements:

The purpose of the Transfer or Disclosure and its legal basis.
Description of the nature of the Transfer or Disclosure to be carried out and its geographic scope.
Means and appropriate safeguards adopted for the Transfer of Personal Data outside the Kingdom and the extent to which they are sufficient to achieve the required level of protection for Personal Data.
Measures taken to ensure that the Transfer or Disclosure is limited to the minimum amount of Personal Data necessary to achieve the purposes.
The material or moral impact that may result from the Transfer or Disclosure, and the possibility of any harm to Data Subjects.
Measures to prevent and mitigate identified risks to protect Personal Data.

Related tasks

Managing and sharing data protection impact assessments

Critical

High

Normal

Low

Documentation of lawful personal data processing and transfer

Critical

High

Normal

Low

Security and responsibilities

Controls for ensuring the proper recipient of personal data transfer

Critical

High

Normal

Low

Legal bases for personal data transfers between different legal zones

Critical

High

Normal

Low

Records of personal data transfers to third parties

Critical

High

Normal

Low

Article 8.1: Risk assessment of transferring or disclosing personal data outside the Kingdom

The Controller shall conduct a risk assessment of the Transfer of Personal Data outside the Kingdom or Disclosure to a party outside the Kingdom in any of the following cases:

Transfer of data outside the Kingdom in accordance with Article (5) of this Regulation.
Transfer of data outside the Kingdom in accordance with Article (6) of this Regulation.
Continuous or large-scale Transfer of Sensitive Data outside the Kingdom.

Related tasks

Managing and assessing cross-border data transfers

Critical

High

Normal

Low

Article 2.3: Ensuring transfer or disclosure does not impact the privacy

When transferring or disclosing Personal Data to a party outside the Kingdom, the Controller shall ensure that such Transfer or Disclosure does not impact the privacy of Data Subjects or the level of protection guaranteed for Personal Data under the Law and its Regulations, by ensuring that the Transfer or Disclosure will not compromise -at least- any of the following:

Data Subject's ability to exercise their rights guaranteed by the Law.
Data Subject's ability to withdraw their consent to the processing.
Controller's ability to comply with requirements for notifying Personal Data Breaches.
Controller's ability to comply with provisions, controls, and procedures for disclosing Personal Data.
Controller's ability to comply with provisions and controls for destroying Personal Data.
Controller's ability to take necessary organizational, administrative, and technical measures to ensure the security of Personal Data.

Related tasks

Managing and assessing cross-border data transfers

Critical

High

Normal

Low

Documentation of lawful personal data processing and transfer

Critical

High

Normal

Low

Executing and documenting data protection impact assessments

Critical

High

Normal

Low

Documentation of partner contract status

Critical

High

Normal

Low

Legal bases for personal data transfers between different legal zones

Critical

High

Normal

Low

Records of personal data transfers to third parties

Critical

High

Normal

Low

Article 7: Conditions for the cessation of personal data transfer or disclosure

1. If the Controller transfers Personal Data or discloses it to a party outside the Kingdom in accordance with Article (5) or Article (6) of this Regulation, it shall immediately stop the Transfer of Personal Data or Disclosure to a party outside the Kingdom in any of the following cases:

Transfer or Disclosure affects national security or Vital Interests of the Kingdom.
If the results of the risk assessment of personal data transfer outside the Kingdom or disclosing it to a party outside the Kingdom causes high risk to the privacy of Data Subjects.
The appropriate safeguards adopted by the Controller are no longer applicable.
The Controller is unable to enforce the appropriate safeguards.

2. If any of the conditions stipulated in Paragraph (1) of this Article applies, the controller must do the following:

Stop - without undue delay - the process of transferring personal data outside the Kingdom or disclosing it to a party outside the Kingdom.
Re-assess the risks of transferring personal data outside the Kingdom or disclosing it to a party outside the Kingdom.

Related tasks

Managing and assessing cross-border data transfers

Critical

High

Normal

Low

Article 5.2: Ensuring non-disclosure

When enabling the Data Subject to access their Personal Data, the Controller shall ensure that it does not involve disclosing Personal Data that identifies another individual.

Related tasks

Use of unique identifiers for data separation

Critical

High

Normal

Low

Preventing unauthorized viewing personal data

Critical

High

Normal

Low

Property security

Article 4.7: Provision of information in an appropriate language

The Controller shall provide the required information in an appropriate language as stipulated in this Article when aware that the Data Subject fully or partially lacks legal capacity.

Related tasks

Communication with data subjects lacking legal capacity

Critical

High

Normal

Low

Testing the clarity of privacy communications

Critical

High

Normal

Low

Article 7.2: Supporting documentation or evidence

The Controller may request needed supporting documents or evidence to verify in order to update, correct, or complete the Personal Data, provided that such documents or evidence are destroyed once the verification process is completed.

Related tasks

Personal data verification and correction procedure

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Article 8.2-3: Notification of parties and destruction of copies

2. When destroying Personal Data, the Controller shall take the following steps:

Take appropriate measures to notify other parties to whom the Controller disclosed the concerned Personal Data and request their Destruction.
Take the appropriate measures to notify the individuals to whom the Personal Data has been disclosed by any means and request its Destruction.
Destroy all copies of the Personal Data stored in the Controller's systems, including backups, in accordance with relevant regulatory requirements.

3. The provisions of this article shall not prejudice the requirements specified in Article 18 of the Law and the legal requirements established by the relevant Competent Authorities.

Related tasks

Coordinated notification and secure destruction of personal data

Critical

High

Normal

Low

Safe destruction of data

Critical

High

Normal

Low

Article 6: Right to request access to personal data

Subject to the provisions of Article (16) of the Law, the Data Subject has the right to request a copy of their Personal Data in a readable and clear format, subject to the following:

Exercising the right to access Personal Data should not negatively impact the rights of others, such as intellectual property rights or trade secrets.
The Personal Data is provided to the Data Subject in a commonly used electronic format and the Data Subject may request a printed hard copy if feasible.
When granting a Data Subject access to their Personal Data, the Controller shall ensure that it does not involve disclosing Personal Data that identifies another individual.

Related tasks

Use of unique identifiers for data separation

Critical

High

Normal

Low

Documentation of lawful personal data processing and transfer

Critical

High

Normal

Low

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Securely delivering a copy of data subject's personal data

Critical

High

Normal

Low

Article 4.1-4: Right to be informed about the collection of personal data

1. If the Personal Data is collected directly from the Data Subject, the Controller shall, before or when collecting the Data, take the necessary measures to inform the Data Subject of the following:

Controller’s identity, its contact details, and any other details related to the channels established by the Controller for the purpose of communicating in relation with Personal Data protection.
Contact details of the data protection officer appointed by the Controller, where applicable.
The legal basis and a specific, clear, and explicit purpose for collecting and Processing Personal Data.
The period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period.
Explanation about Data Subject’s rights, as stipulated in Article (4) of the Law and the mechanisms for exercising those rights.
Explanation on how to withdraw consent given to process of any Personal Data.
Explaining whether collecting or Processing Personal Data is mandatory or optional.

2. The provisions of paragraph (1) of this article shall not apply if the information specified in sub-paragraphs (a) to (g) is already available to the Data Subject, or if providing such information conflicts with any of the existing laws in the Kingdom.

3. If Personal Data is collected directly from an individual other than the Data Subject, the Controller shall, without undue delay and within a period not exceeding (30) days, take necessary steps to inform the Data Subject of the provisions specified in paragraph (1) of this article, in addition to the categories of Personal Data being processed and the source from which the Controller obtained it.

4. The provisions of paragraph (3) of this article shall not apply in any of the following conditions if:

The information is already available to the Data Subject.
The implementation is not possible or requires disproportionate effort.
The Controller obtained the data in accordance with a law.
The Controller is a Public Entity and the Collection of Personal Data is for security purposes, or to fulfil judicial requirements, or to achieve a Public Interest.
The Personal Data is subject to professional confidentiality provisions established by law.

Related tasks

Documentation of personal data processing purposes

Critical

High

Normal

Low

Establishing a data collection transparency procedure

Critical

High

Normal

Low

Processing personal data collected from third-party sources

Critical

High

Normal

Low

Data store listing and owner assignment

Critical

High

Normal

Low

Privacy notices -report publishing and maintenance

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low