<p>Every individual has the right to the protection of their personal data privacy, and such data may only be processed within the framework of Transparency, integrity, respect for human dignity, and acceptable practices, In accordance with the provisions of this Law.</p>

<p>The controller may not process personal data except after obtaining the individual's consent, unless processing is necessary to achieve a legitimate purpose of the controller or the third party to whom the data is sent.</p>

<p>An individual may, at any time, do the following:<br>1- Withdraw their prior consent to the processing of their personal data.<br>2- Object to the processing of their personal data if it is unnecessary for achieving the purposes for which it was collected, or if it exceeds those requirements, is discriminatory or unfair, or is in violation of the law.<br>3- Request the deletion or erasure of their personal data in the cases mentioned in the previous two points, or upon the conclusion of the purpose for which the data was processed, or if there is no justification for the controller to retain it.<br>4- Request the correction of their personal data, accompanied by evidence supporting their request.</p>

<p>An individual has the right, at any time, to access their personal data and request its review in relation to any controller. In particular, they have the right to the following:<br>1- To be informed about the processing of their personal data and the purposes for which such processing is carried out.<br>2- To be informed of any disclosure of inaccurate personal data about them.<br>3- To obtain a copy of their personal data after paying an amount not exceeding the service fee.</p>

<p>The regulations and procedures related to individuals exercising the rights mentioned in the two preceding articles shall be determined by a decision from the minister.</p>

<p>The controller must comply with the following:<br>1- Process Personal Data Protection honestly and legally.<br>2- Observe the controls related to designing, changing, or developing products, systems, and services related to processing Personal Data Protection.<br>3- Take appropriate administrative, technical, and physical precautions for Personal Data Protection, as determined by the relevant Department / Directorate.<br>4- Privacy Protection policies set by the relevant Department / Directorate, issued by a decision from the Minister.</p>

<p>Before starting to process any personal data, the controller must inform the individual of the following:<br>1- The controller’s data, or any other party processing the data on behalf of the controller or for its use.<br>2- The legitimate purposes for which the controller or any other party wishes to process the personal data.<br>3- A comprehensive and accurate description of the processing activities and the levels of disclosure of personal data for legitimate purposes; if the controller is unable to provide this, the individual must be enabled to provide a general description.<br>4- Any other information that is necessary and required to fulfill the conditions for processing personal data.</p>

<p>The controller must ensure that the personal data collected by him, or on his behalf, is relevant to the legitimate purposes and sufficient to achieve them. He must also ensure that such data is accurate, complete, and updated as needed to fulfill the legitimate purposes, and that it is not retained for longer than necessary to achieve those purposes.</p>

<p>The controller must take the following actions:<br>1- Review Privacy protection procedures before introducing new processing operations.<br>2- Identify processors responsible for Personal Data Protection.<br>3- Train and raise the awareness of processors on Personal Data Protection.<br>4- Establish internal systems for receiving and studying Complaints, requests for data access, and requests for data correction or deletion, and make these available to individuals.<br>5- Establish internal systems for the effective management of personal data, and report any breaches of the procedures intended to protect it.<br>6- Use appropriate technological means to enable individuals to exercise their right to access personal data, review, and correct it directly.<br>7- Conduct comprehensive audits and reviews on compliance with Personal Data Protection.<br>8- Verify the processor’s compliance with the instructions provided, take appropriate precautions for Personal Data Protection, and continuously monitor and follow up on it.</p>

<p>The controller, when disclosing or transferring personal data to the processor, must ensure that it conforms to legitimate purposes, and that such data is processed In accordance with the provisions of this Law.</p>

<p>Both the controller and the processor must take necessary precautions to protect personal data from loss, damage, alteration, disclosure, access, or use accidentally or unlawfully.<br>These precautions must be proportionate to the nature and importance of the personal data to be protected.<br>The processor must notify the controller of any breach of the aforementioned precautions or whenever any risk threatens individuals’ personal data in any way, as soon as they become aware of it.</p>

<p>The supervisor must inform the individual and the relevant administration of any breach of the precautions stipulated in the previous article, if such breach could cause serious harm to personal data or the individual's privacy.</p>

<p>Subject to the obligations stipulated in this Law / Act, the controller is prohibited from making any decision or taking any action that would restrict the flow of personal data across borders, except if the processing of that data is contrary to the provisions of this Law / Act, or if it would cause serious harm to personal data or individual privacy.</p>

<p>Personal data of a special nature includes data related to ethnic origin, children, health or physical or psychological condition, religious beliefs, marital status, and criminal offenses.<br>The Minister may add other categories of personal data of a special nature if their misuse or disclosure is likely to cause serious harm to the individual.<br>It is not permitted to process personal data of a special nature except after obtaining a Permit from the competent Department / Directorate, in accordance with the procedures and controls specified by a decision issued by the Minister.<br>The Minister, by his decision, may impose additional precautions for the purpose of Personal Data Protection of a special nature.</p>

<p>Subject to the obligations stipulated in this Law / Act, the owner or operator of any website directed to children must observe the following:<br>1- Place a notice on the website regarding the nature of children's data, how it is used, and the policies followed in disclosing it.<br>2- Obtain explicit consent from the guardian of the child whose personal data is being processed, either through electronic communication or any other appropriate means.<br>3- Provide the child's guardian, upon their request and after verifying their identity, with a description of the type of personal data being processed, stating the purpose of the processing, and a copy of the data that has been processed or collected about the child.<br>4- Delete, erase, or suspend processing of any personal data collected from or about the child if the guardian requests it.<br>5- Ensure that the child's participation in a game, contest, or any other activity is not conditional upon the child providing more personal data than is necessary to participate in that activity.</p>

<p>The Competent Authority may decide to process certain personal data without adhering to the provisions of Articles (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=38ba9081-cc9c-4dbf-bfc3-2153d2a053cc">4</a>), (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=4b2af488-dee2-4101-9e47-33fd9ccbf122">9</a>), (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=7edd0382-9f20-49b2-9d99-3ffb63640d95">15</a>), (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=2cd3514e-c096-4aa8-a824-e66d33cfd595">17</a>) of this Law / Act, in order to achieve any of the following purposes:<br>1- Protecting National Security and Public Security.<br>2- Protecting the International Relations of the state.<br>3- Protecting the economic or financial interests of the state.<br>4- Preventing any criminal offense, or gathering information about it, or investigating it.<br>The Competent Authority shall keep a special Record in which the data that fulfills the aforementioned purposes is entered, and a resolution issued by the Minister shall determine the conditions, controls, and circumstances of recording in this Record.</p>

<p>The controller is exempt from complying with the provisions of Articles (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=38ba9081-cc9c-4dbf-bfc3-2153d2a053cc">4</a>), (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=19f8f3aa-9561-4224-b38b-f1f6539ca145">5</a>/Sections 1, 2, 3), (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=f9c4f862-228b-4d3c-978e-e3e5fa9b8dc1">6</a>) of this Law / Act, in any of the following cases:<br>1- Executing a task related to the public interest in accordance with the Law / Act.<br>2- Implementing a legal obligation or an order from a competent court.<br>3- Protecting the vital interests of the individual.<br>4- Achieving the purposes of Scientific Research conducted for the public interest.<br>5- Collecting the information necessary to investigate one of the Criminal Offenses, based on an official request from the investigating authorities.</p>

<p>The controller is exempt from disclosing the reasons for his refusal to comply with the individual's rights, as stipulated in Article (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=f9c4f862-228b-4d3c-978e-e3e5fa9b8dc1">6</a>) of this Law / Act, if such disclosure would prevent the achievement of the purposes set out in Article (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=08325093-9ef7-4131-aab1-4849b43fe8de">18</a>) of this Law / Act.</p>

<p>Subject to the provisions of the previous two articles, the auditor shall be exempt from complying with the provisions of Article (<a target="_top" rel="noopener noreferrer nofollow" class="text-blue-600 underline" href="/legislations/9c7dca4b-8722-4212-9368-ea3abba0c95c?almawadId=f9c4f862-228b-4d3c-978e-e3e5fa9b8dc1">6</a>) of this Law / Act in either of the following cases:<br>1- If disclosure would harm the commercial interests of another person.<br>2- If compliance with this obligation would result in the disclosure of personal data relating to another individual who has not consented to such disclosure, and the disclosure may cause material or moral harm to this individual or any other person.</p>

<p>It is prohibited to send any electronic communication for the purpose of direct marketing to an individual, except after obtaining their prior consent.<br>The electronic communication must include the identity of its creator and indicate that it is sent for direct marketing purposes. It must also include a correct and accessible address through which the individual can send a request to the creator to stop those communications or withdraw their consent to receive them.</p>