PDPL

Defining and implementing masking for confidential data

Critical

High

Normal

Low

Data classification

Article 31: Photographing or copying official documents that reveal the identity of data subjects

Without prejudice to the relevant laws, the Controller shall refrain from photographing or copying official documents - issued by Public Entities - where Data Subjects are identifiable, except upon request from a public Competent Authority or when required by Law. The Controller shall provide the necessary protection for such documents and destroy them once the purpose for which they were obtained has ended unless there is a legal requirement to keep them.

Related tasks

Handling and protection of official identification documents

Critical

High

Normal

Low

Archiving and destruction processes for data sets

Critical

High

Normal

Low

Article 28.3: Controller obligations when advertising

Without prejudice to the Telecommunication and Information Technology Act or any other related laws, before using communication methods for the purpose of sending advertising or awareness materials, including the post and email of the Data Subject, the Controller shall commit to the following:

Clearly mention the sender's name without hiding their identity.
Provide a mechanism that enables the Data Subject to opt out of receiving advertising and awareness materials when desired, and ensure that the procedures for opting out of receiving such materials are easy, straightforward, and at least as easy as the procedures for giving consent to receive them.
Stop sending advertising or awareness materials as soon as the target recipient requests it.
The cessation of receiving advertising or awareness materials shall be free of charge.
Keep material evidence of consent from the targeted recipient to receive advertising or awareness materials.

Related tasks

Guidelines for marketing and awareness communications

Critical

High

Normal

Low

Article 14: Processing to serve the actual interest of data subject

When processing data to achieve an Actual Interest of the Data Subject, the Controller shall retain evidence that such interest exists and that it is difficult to contact or communicate with the Data Subject.

Related tasks

Process for processing based on the data subject's actual interest

Critical

High

Normal

Low

Documentation of lawful personal data processing and transfer

Critical

High

Normal

Low

Designation of data set owners

Critical

High

Normal

Low

Article 12.1-3: Withdrawal of consent

1. The Data Subject has the right to withdraw their consent for Processing their Personal Data at any time, and they shall inform the Controller of this through any available means according to Article (4) of this Regulation.

2. Before requesting consent from the Data Subject, the Controller shall establish procedures that allow for the withdrawal of that consent and take the necessary measures to ensure their implementation, with the procedures for withdrawing consent being similar to or easier than those for obtaining it.

3. In the event of consent withdrawal, the Controller shall cease Processing without undue delay from withdrawal request. The withdrawal of consent shall not affect the lawfulness of Processing based on consent before its withdrawal.

Related tasks

Process for ceasing data processing after consent withdrawal

Critical

High

Normal

Low

Documentation of conditions of consent for relevant processing purposes

Critical

High

Normal

Low

Process for data subjects to edit or cancel a consent

Critical

High

Normal

Low

Clear communication about the effects of consent

Critical

High

Normal

Low

Article 11.1-2: Processing consent

1. The Controller shall obtain the Data Subject's consent for Processing their Data in any appropriate form or means, including written or verbal consent or by using electronic methods, subject to the following conditions:

Consent shall be given freely and not obtained through misleading methods, and obtaining consent shall comply with the provisions of Article (7) of the Law.
Processing purposes shall be clear, specific, and shall be explained and clarified to the Data Subject before or at the time of requesting consent.
Consent shall be given by a person who has full legal capacity.
Consent shall be documented in a way that allows verification in the future, such as keeping records that include the Consent of the Data Subjects regarding the Processing operations, along with the time and the method of Consent.
Independent consent shall be obtained for each Processing purpose.

2. The Data Subject's consent shall be explicit in the following cases:

When the Processing involves Sensitive Data.
When the Processing involves Credit Data.
When decisions are made solely based on automated Processing of Personal Data.

Related tasks

Managing and documenting data subject consent

Critical

High

Normal

Low

Documentation of conditions of consent for relevant processing purposes

Critical

High

Normal

Low

Documentation of personal data processing purposes for data stores

Critical

High

Normal

Low

Consent condition review

Critical

High

Normal

Low

Clear communication about the effects of consent

Critical

High

Normal

Low

Article 13: Processing personal data through legal guardians

1. Considering applicable legal requirements, the legal guardian of the Data Subject that fully or partially lacks legal capacity shall act in the best interests of the Data Subject and for this purpose, they have the following options:

Exercise the rights granted to the Data Subject under the Law and this Regulation.
Consent to the Processing of the Data Subject's Personal Data in accordance with the provisions of the Law and this Regulation.

2. In addition to what is stipulated in paragraph (1) of Article 11 of this Regulations, in case of Processing Personal Data of a Data Subject that fully or partially lacks legal capacity, obtaining the consent of the legal guardian is conditional upon taking appropriate measures to verify validity of guardianship over the Data Subject.

3. When obtaining the consent from the legal guardian of a Data Subject that fully or partially lacks legal capacity, the Controller shall comply with the following provisions:

It shall not cause any harm to the interests of the Data Subject.
It shall enable the Data Subject to exercise their rights as provided in the Law and this Regulation when they reach legal capacity.

Related tasks

Handling requests and consent from legal guardians

Critical

High

Normal

Low

Article 12.4-5: Appropriate controller measures upon withdrawal of consent

4. When the Data Subject withdraws their consent for Processing their data, the Controller shall take appropriate measures to notify those to whom the Personal Data has been disclosed and request its Destruction through any available means.

5. Consent withdrawal shall not affect the Processing of Personal Data that is based on other legal basis.

Related tasks

Coordinated notification and secure destruction of personal data

Critical

High

Normal

Low

Process for ceasing data processing after consent withdrawal

Critical

High

Normal

Low

Documentation of conditions of consent for relevant processing purposes

Critical

High

Normal

Low

Process for data subjects to edit or cancel a consent

Critical

High

Normal

Low

Article 25.4: Grounds to re-conduct the assessment

The Controller shall - if the assessment mentioned in this article indicates that the Processing operation will harm the privacy of the Data Subjects - address the reasons for that and re-conduct the assessment.

Related tasks

Re-conducting data protection impact assessments after identifying privacy harm

Critical

High

Normal

Low

Article 25.2-3: Contents and communication of data protection impact assessments

2. The impact assessment shall include at least the following elements:

Purpose of the Processing and its legal basis.
Description of the nature of the Processing to be conducted, the types and sources of Personal Data to be processed, and any entities to whom the Personal Data is to be Disclosed.
Description of the scope of the Processing, which identifies the type of Personal Data and the geographical scope of the Processing.
Description of the context of the Processing, which identifies the relationship between the Data Subjects, the Controller, and the Processors, as well as any other relevant circumstances.
Necessity and proportionality of the measures to be taken to enable the Controller and Processors to process the minimal Personal Data necessary to achieve the purposes of the Processing.
Impact of the Processing, based on the severity of its impact, materially and morally, and the likelihood of any negative impact on Data Subjects, including any psychological, social, physical, or financial impact, and the likelihood of their occurrence.
Measures that will be taken to prevent or limit the risks.
The suitability of the measures envisaged to avoid identified risks.

3. The Controller shall provide a copy of the impact assessment to any Processor acting on its behalf in relation to the relevant Processing.

Related tasks

Managing and sharing data protection impact assessments

Critical

High

Normal

Low

Article 25.1: Impact assessment

The Controller shall prepare a written and documented assessment of the potential impacts and risks that may affect the Data Subject as a result of Personal Data Processing. Impact assessment shall be conducted in the following cases:

Processing of Sensitive Data.
Collecting, comparing, or linking two or more sets of Personal Data obtained from different sources.
The activity of the Controller includes - continuous and large scale - Processing of Personal Data of those who fully or partially lack legal capacity, or Processing operations that by their nature require continuous monitoring of Data Subjects, or Processing Personal Data using new technologies, or making decisions based on automated Processing of Personal Data.
Providing a product or service that involves Processing Personal Data that is likely to cause serious harm to the privacy of Data Subjects.

Related tasks

Managing and sharing data protection impact assessments

Critical

High

Normal

Low

Executing and documenting data protection impact assessments

Critical

High

Normal

Low

Article 24.3-4: Reporting obligations

3. The Controller shall keep a copy of the reports submitted to the Competent Authority under paragraph (1) of this article and document the corrective measures taken in relation with the Personal Data Breach, as well as any relevant documents or supporting evidence.

4. The provisions of this article do not prejudice the obligations of the Controller or Processor to submit any report or notification about Personal Data Breaches according to what is issued by the National Cybersecurity Authority or any laws and Regulations applicable in the Kingdom.

Related tasks

Notification and documentation of personal data breaches

Critical

High

Normal

Low

Data breach management

Cyber security in contracts

Article 24.1-2: Notification of personal data breach

1. The Controller shall notify the Competent Authority within a delay not exceeding (72) hours of becoming aware of the incident, if such incident potentially causes harm to the Personal Data, or to Data Subject or conflict with their rights or interests. The notification shall include the following:

A description of the Personal Data Breach incident, including the time, date, and circumstances of the breach and the time when the Controller became aware of it.
Data categories, actual or approximate numbers of impacted Data Subjects, and the type of Personal Data.
Description of the risks of the Personal Data Breach, including the actual or potential impact on Personal Data and Data Subjects, and the actions and measures taken by the Controller to prevent or limit the impact of those risks and mitigate them, as well as the future measures that will be taken to avoid a recurrence of the breach.
A Statement if the Data Subject has been notified of the breach of their Personal Data, as stipulated in Paragraph (5) of this Article.
Contact details of the Controller or its data protection officer, if any, or any other official having information regarding the reported incident.

2. If the Controller is not able to provide any of the required information within (72) hours from the time it became aware of the Personal Data Breach in accordance with paragraph (1) of this article, it shall provide it as soon as possible, along with justifications for the delay.

Related tasks

Notification and documentation of personal data breaches

Critical

High

Normal

Low

Data breach management

Disciplinary process for security breaches

Critical

High

Normal

Low

Reporting personal data breaches to authorities / data subjects

Critical

High

Normal

Low

Data breach management

Article 3.1: Procedure upon receipt of request from the Data Subject

1. The Controller shall, upon receiving a request from the Data Subject regarding their rights as stipulated in the Law, do the following:

Act on the request of the Data Subject for exercising their rights under the Law within a period not exceeding (30) days and without delay. This period may be extended in case the implementation requires disproportionate effort, or if the Controller receives multiple requests from the data subject, provided that the extension does not exceed an additional (30) days and the Data Subject is notified in advance of the extension with the reasons for the delay.
Take the necessary technical, administrative, and organizational measures to ensure a prompt response to requests related to exercising rights.
Take appropriate measures to verify the identity of the requester before executing the request in accordance with relevant legal requirements.
Take the necessary measures to document and keep record of all submitted, including oral requests.

Related tasks

Publication and maintenance of privacy notice reports

Critical

High

Normal

Low

Documentation of personal data processing purposes

Critical

High

Normal

Low

Supporting data subject requests with administrative and technical measures

Critical

High

Normal

Low

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Ensuring the timeliness of privacy communication

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Identification of the rights available to the data subject

Critical

High

Normal

Low

Article 3.3: Exercising of rights by a legal guardian

In cases where the Data Subject fully or partially lacks legal capacity, their legal guardian shall exercise their rights on their behalf.

Related tasks

Handling requests and consent from legal guardians

Critical

High

Normal

Low

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Article 3.2: Grounds for refusal

The Controller may refuse to act on request when it is repetitive, manifestly unfounded, or requires disproportionate efforts, in which the Data Subject shall be notified of such reason.

Related tasks

Criteria for refusing data subject requests

Critical

High

Normal

Low

Communication methods for refusing to implement data protection requests

Critical

High

Normal

Low