Article 4.1-4: Right to be informed about the collection of personal data

Oh no! No description found. But not to worry. Read from Tasks below how to advance this topic.

1. If the Personal Data is collected directly from the Data Subject, the Controller shall, before or when collecting the Data, take the necessary measures to inform the Data Subject of the following:

Controller’s identity, its contact details, and any other details related to the channels established by the Controller for the purpose of communicating in relation with Personal Data protection.
Contact details of the data protection officer appointed by the Controller, where applicable.
The legal basis and a specific, clear, and explicit purpose for collecting and Processing Personal Data.
The period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period.
Explanation about Data Subject’s rights, as stipulated in Article (4) of the Law and the mechanisms for exercising those rights.
Explanation on how to withdraw consent given to process of any Personal Data.
Explaining whether collecting or Processing Personal Data is mandatory or optional.

2. The provisions of paragraph (1) of this article shall not apply if the information specified in sub-paragraphs (a) to (g) is already available to the Data Subject, or if providing such information conflicts with any of the existing laws in the Kingdom.

3. If Personal Data is collected directly from an individual other than the Data Subject, the Controller shall, without undue delay and within a period not exceeding (30) days, take necessary steps to inform the Data Subject of the provisions specified in paragraph (1) of this article, in addition to the categories of Personal Data being processed and the source from which the Controller obtained it.

4. The provisions of paragraph (3) of this article shall not apply in any of the following conditions if:

The information is already available to the Data Subject.
The implementation is not possible or requires disproportionate effort.
The Controller obtained the data in accordance with a law.
The Controller is a Public Entity and the Collection of Personal Data is for security purposes, or to fulfil judicial requirements, or to achieve a Public Interest.
The Personal Data is subject to professional confidentiality provisions established by law.

Fulfill this requirement by completing the tasks below ->

This requirement is part of the framework:

Personal Data Protection Law (Saudi Arabia)

Other requirements of the framework

Article 4.1-4: Right to be informed about the collection of personal data

Best practices

How to implement:

Article 4.1-4: Right to be informed about the collection of personal data

This policy on

Article 4.1-4: Right to be informed about the collection of personal data

provides a set concrete tasks you can complete to secure this topic. Follow these best practices to ensure compliance and strengthen your overall security posture.

1. If the Personal Data is collected directly from the Data Subject, the Controller shall, before or when collecting the Data, take the necessary measures to inform the Data Subject of the following:

Controller’s identity, its contact details, and any other details related to the channels established by the Controller for the purpose of communicating in relation with Personal Data protection.
Contact details of the data protection officer appointed by the Controller, where applicable.
The legal basis and a specific, clear, and explicit purpose for collecting and Processing Personal Data.
The period for which the Personal Data will be stored, or if that is not possible, the criteria used to determine that period.
Explanation about Data Subject’s rights, as stipulated in Article (4) of the Law and the mechanisms for exercising those rights.
Explanation on how to withdraw consent given to process of any Personal Data.
Explaining whether collecting or Processing Personal Data is mandatory or optional.

4. The provisions of paragraph (3) of this article shall not apply in any of the following conditions if:

The information is already available to the Data Subject.
The implementation is not possible or requires disproportionate effort.
The Controller obtained the data in accordance with a law.
The Controller is a Public Entity and the Collection of Personal Data is for security purposes, or to fulfil judicial requirements, or to achieve a Public Interest.
The Personal Data is subject to professional confidentiality provisions established by law.

Read below what concrete actions you can take to improve this ->

Frameworks that include requirements for this topic:

No items found.

How to improve security around this topic

In Cyberday, requirements and controls are mapped to universal tasks. A set of tasks in the same topic create a Policy, such as this one.

Here's a list of tasks that help you improve your information and cyber security related to

Article 4.1-4: Right to be informed about the collection of personal data

Task name

Priority

Task completes