PDPL

Article 20.5-6: Disclosure operations in the records of personal data processing activities

5. When disclosing Personal Data to achieve a Legitimate Interest of the Controller, the Controller shall comply with the provisions of Article 16 of this Regulation.

6. The Controller shall include Disclosure operations in the records of Personal Data Processing activities, document the dates, methods, and purposes of Disclosure.

Related tasks

Legitimate interest assessment process

Critical

High

Normal

Low

Documentation of lawful personal data processing and transfer

Critical

High

Normal

Low

Records of processing activities -report publishing and maintenance

Critical

High

Normal

Low

Records of personal data disclosures to third parties

Critical

High

Normal

Low

Article 20.4: Necessary care and guarantees to ensure the privacy of third parties

Except as provided in paragraphs (3) and (4) of Article 15 of the Law, when disclosing Personal Data related to another person who is not the Data Subject, the Controller shall take necessary care and provide sufficient guarantees to ensure the privacy of the other individual is preserved and not violated. This includes considering the following steps:

Balance between the rights of the Data Subject and the rights of any other person in each case separately.
Pseudonymisation of Personal Data that indicates the identity of another individual whenever possible.

Related tasks

Procedure for applying pseudonymisation and privacy-enhancing measures

Critical

High

Normal

Low

Processing personal data collected from third-party sources

Critical

High

Normal

Low

Pseudonymisation of personal data

Critical

High

Normal

Low

Article 17.2: Controller instructions to the processor

The Controller shall issue clear instructions to the Processor, and in case of any violation of the Controller’s instructions or any applicable laws in the Kingdom, the Processor shall notify the Controller in writing without undue delay.

Related tasks

Notification process for violations

Critical

High

Normal

Low

Security and responsibilities

Handling of instructions from controller regarding the processing of personal data

Critical

High

Normal

Low

Article 15: Processing data from third parties

1. Except for what is stated in Paragraph (3) of Article (10) of the Law, when Processing Personal Data collected from sources other than the Data Subject directly, the Controller shall consider the following:

Processing shall be necessary and proportionate to the specified purpose.
Processing shall not affect the rights and interests of the Data Subject.

2. When Processing Personal Data in accordance with paragraph (2) of Article (10) of the Law, the Controller shall ensure that such data Collection from a publicly available source is lawful.

3. When Processing Personal Data in accordance with paragraph (6) of Article (10) of the Law, the Controller shall consider the provisions of Article (9) of this Regulation regarding Anonymisation.

Related tasks

Ensuring secure anonymisation of personal data

Critical

High

Normal

Low

Processing personal data collected from third-party sources

Critical

High

Normal

Low

Documentation of lawful personal data processing and transfer

Critical

High

Normal

Low

Evaluation of data processing agreement for important data processors

Critical

High

Normal

Low

Anonymization of personal data

Critical

High

Normal

Low

Article 20.1-2: Disclosure of personal data

1. Disclosure of data collected from publicly available sources under paragraph (2) of Article 15 of the Law is conditional upon ensuring that such Disclosure to the public has not been carried out in violation of the provisions of the Law and its Regulations.

2. Except for the circumstances provided in paragraphs (3) and (4) of Article 15 of the Law, the Controller shall consider the following when disclosing Personal Data:

Disclosure request is closely related to a specific and clear purpose or subject.
Necessary care shall be provided to protect the privacy of the Data Subject or any other individual.
Disclosure is limited to the minimum amount of Personal Data necessary to achieve the purpose.

Related tasks

Processing personal data collected from third-party sources

Critical

High

Normal

Low

Documentation of data disclosures for data stores

Critical

High

Normal

Low

Article 22.1-4: Correction of personal data

1. The types of correction of Personal Data referred to in paragraph (2) of Article 17 of the Law include correcting data that is incorrect, completing data that is incomplete, or updating data that is outdated.

2. When correcting Personal Data, the Controller shall comply with the following:

Ensure the accuracy and integrity of Personal Data by examining and reviewing supporting documents if necessary.
Notify the parties to whom the Personal Data has been disclosed previously without delay.
Notify the Data Subject when the correction is completed.
Document all updates made to Personal Data.

3. If the Controller identifies that Personal Data is inaccurate or incomplete, and that may cause harm to the Data Subject, the Controller shall suspend Processing until the data is updated or corrected.

4. In accordance with paragraph (2) of this Article, when the Controller becomes aware that Personal Data is inaccurate, outdated, or incomplete, the Controller shall take the necessary steps to correct, complete, or update it using the available means without delay.

Related tasks

Personal data verification and correction procedure

Critical

High

Normal

Low

Ensuring and documenting the accuracy of personal data

Critical

High

Normal

Low

Cyber security management

Article 17.3-4: Periodic assessment of processor compliance

3. The Controller is responsible to periodically assess Processor's compliance with the Law and its Regulations, and ensure that all regulatory requirements are met, whether the Processing is achieved by the Processor or third parties acting under their behalf. The Controller may appoint an independent third party to assess and monitor Processor’s compliance on its behalf.

4. If the Processor violates the instructions issued by the Controller or the agreement regarding the Processing of Personal Data, the Processor shall be considered as a Controller and held directly accountable for violating any provisions of the Law.

Related tasks

Principles for personal data protection audits

Critical

High

Normal

Low

Data processing agreement analysis for most important system providers

Critical

High

Normal

Low

Data system procurement

Evaluation of data processing agreement for important data processors

Critical

High

Normal

Low

Article 21: Controls for processing personal data for public interest purposes

When a Public Entity collects Personal Data not directly from the Data Subject, processes it for a purpose other than the one for which it was initially collected, or requests Disclosure of such data to achieve a public interest, the Public Entity shall comply with the following:

Ensure that it is necessary to achieve a clearly defined public interest.
That the public interest is related to the mandate as specified by law.
Take suitable measures to limit the damage that may result, including implementing necessary administrative and technical controls to ensure its personnel’s compliance with the provisions of Article 41 of the Law.
Record those operations in the records of Personal Data Processing activities.
Collecting and Processing the minimum necessary Personal Data to achieve the purpose.

Related tasks

Procedure for introducing new personal data processing purposes

Critical

High

Normal

Low

Process for data disclosure to public authorities

Critical

High

Normal

Low

Assessment for processing personal data for public interest

Critical

High

Normal

Low

Article 22.5: Measures to avoid the impact of processing inaccurate, incomplete, or outdated personal data

The Controller shall take appropriate organizational, administrative and technical measures to avoid the impact of Processing inaccurate, incomplete, or outdated Personal Data, including:

Develop and update internal policies and procedures in accordance with the provisions of the Law and this Regulation, including procedures that enable Data Subjects to exercise their right to request correction in accordance with the provisions of the Law and this Regulation.
Periodic review of the accuracy and timeliness of Personal Data.

Related tasks

Personal data verification and correction procedure

Critical

High

Normal

Low

Process for receiving and handling data subject requests

Critical

High

Normal

Low

Process for data subjects to rectify inaccurate personal data

Critical

High

Normal

Low

Article 19: Data minimisation

1. The Controller shall collect only the minimum amount of Personal Data necessary to achieve the purpose of the Processing, and ensure the following:

Collecting only the necessary Personal Data that is directly related to the purpose of Processing, and this shall be determined using appropriate means, including data maps that indicate the need for each collected data and link it to each objective of the Processing or other means.
Provide necessary care to achieve the purpose of the Processing without collecting unnecessary Personal Data.

2. The Controller shall retain the minimal Personal Data necessary to achieve the purpose of the Processing.

Related tasks

Ensuring minimal retention of personal data

Critical

High

Normal

Low

Reviewing the execution of data minimisation

Critical

High

Normal

Low

Verification of the necessity and proportionality of personal data

Critical

High

Normal

Low

Article 17.5: Guarantees for sub-processor

Before entering any subsequent contracts with sub-Processors, the Processor shall abide by the following:

Take sufficient guarantees to ensure that such contracts would not impact the level of protection provided to the Personal Data being processed.
Choose only sub-Processors that provide the sufficient guarantees to comply with the Law and its Regulations.
Obtain prior acceptance from Controller, with the Controller being notified before entering into such contracts and enabling the Controller to object to them within a timeframe agreed upon between the Controller and the Processor.

Related tasks

Managing contracts with sub-processors

Critical

High

Normal

Low

Security and responsibilities

Passing client requirements on to relevant partner organizations

Critical

High

Normal

Low

Evaluation of data processing agreement for important data processors

Critical

High

Normal

Low

Informing the controller of the processors of personal data

Critical

High

Normal

Low

Detailed descriptions of required security measures for subcontractors on contracts related to offered cloud services

Critical

High

Normal

Low

Article 16.1-2: Processing for limited interest

1. Except in cases where the Controller is a Public Entity, the Controller may process Personal Data to achieve a Legitimate Interest provided that the following conditions are met:

Purpose shall not violate any of the laws in the Kingdom.
A balance between the rights and interests of the Data Subject and the Legitimate Interest of the Controller, so that the interests of the Controller do not affect the rights and interests of the Data Subject.
Processing shall not include Sensitive Data.
Processing shall be within the reasonable expectations of the Data Subject.

2. Legitimate interests include the Disclosure of fraud operations, the protection of network and information security, and other Legitimate Interests that meet the conditions outlined in paragraph (1) of this article.

Related tasks

Limitations on processing sensitive data under legitimate interest

Critical

High

Normal

Low

Legitimate interest assessment process

Critical

High

Normal

Low

Documentation of data sets for data stores

Critical

High

Normal

Low

Management of data sets

Identification of the rights available to the data subject

Critical

High

Normal

Low

Article 16.3-4: Assessment of proposed processing

3. According to the provisions of paragraph (4) of Article (6) of the Law, before Processing Personal Data for Legitimate Interests, the Controller shall conduct and document an assessment of the proposed Processing and its impact on the rights and interests of Data Subjects. The assessment shall include the following:

Identification of the proposed Processing and its purposes, as well as the type of data and categories of Data Subjects.
Evaluation of the purpose to ensure that it is legitimate and compliant with the laws in the Kingdom.
Verification of the necessity to process Personal Data to achieve the legitimate purpose of the Controller.
Evaluation of whether the proposed Processing will cause any potential harm to Data Subjects or their ability to exercise their legally established rights.
Identification of any measures that shall be taken to avoid potential risks or harms, in accordance with the provisions of paragraph (2) of Article (25) of this Regulation.

4. If the assessment outlined in paragraph (3) of this article indicates that the proposed Processing will in any way violate any laws, infringe on the rights and interests of Data Subjects, cause harm to them or any other party, the Controller shall modify the proposed Processing and conduct a new assessment, or consider relying on another legal basis.

Related tasks

Limitations on processing sensitive data under legitimate interest

Critical

High

Normal

Low

Legitimate interest assessment process

Critical

High

Normal

Low

Managing and sharing data protection impact assessments

Critical

High

Normal

Low

Detailed assessment of the risk of data breach for data subjects

Critical

High

Normal

Low

Data breach management

Executing and documenting data protection impact assessments

Critical

High

Normal

Low

Regular, internal review of privacy policies

Critical

High

Normal

Low

Goals related to restrictions of processing

Critical

High

Normal

Low

Verification of the necessity and proportionality of personal data

Critical

High

Normal

Low

Article 18.1: Further processing of personal data

When the Controller processes Personal Data for a purpose other than the one for which it was initially collected, as provided in Article 10 of the Law, the following steps must be taken:

Clearly and specifically define the new processing purposes.
Document the procedures to determine the scope of data to be processed in line with the specific purposes, including the use of data maps that justify the need for each data element and link it to the related processing purpose.
Take necessary measures to ensure that Personal Data is collected and processed in accordance with the principle of data minimization to achieve the identified purposes.

Related tasks

Procedure for introducing new personal data processing purposes

Critical

High

Normal

Low

Reviewing the execution of data minimisation

Critical

High

Normal

Low

Article 18.2: Processing obligations for the Controller

Except for cases stated in paragraph (3) of Article 10 of the Law, when the Controller processes Personal Data for a purpose other than the one for which it was initially collected as provided in paragraphs (1), (2), (4), (5), and (6) of Article 10 of the Law, the Controller shall comply with the following:

Clearly and accurately define the purpose of the Processing and refer to it in the records of Personal Data Processing activities.
Limit the Collection and Processing of the Personal Data to the minimum amount necessary to achieve the purpose.
Identify the type of Personal Data to be processed and the necessary measures to ensure that such data is processed appropriately.

Related tasks

Procedure for introducing new personal data processing purposes

Critical

High

Normal

Low