Table of Contents
Article 1
Article 2
Article 3
Article 4
Article 5
Article 6
Article 7
Article 8
Article 9
Article 10
Article 11
Article 12
Article 13
Article 14
Article 15
Article 16
Article 17
Article 18
Article 19
Article 20
Article 21
Article 22
Article 23
Article 24
Article 25
Article 26
Article 27
Article 28
Article 29
Article 30
Article 31
Article 32
Article 33
Article 34
Article 35
Article 36
Article 37
Article 38
Article 39
Article 40
Article 41
Article 42
Article 43
Article 15
The Controller may not Disclose Personal Data except in the following situations:
- Data Subject consents to the Disclosure in accordance with the provisions of the Law.
- Personal Data has been collected from a publicly available source.
- The entity requesting Disclosure is a Public Entity, and the Collection or Processing of the Personal Data is required for public interest or security purposes, or to implement another law, to fulfill judicial requirements.
- The Disclosure is necessary to protect public health, public safety, or to protect the lives or health of specific individuals.
- The Disclosure will only involve subsequent Processing in a form that makes it impossible to directly or indirectly identify the Data Subject.
- The Disclosure is necessary to achieve legitimate interests of the Controller, without prejudice to the rights and interests of the Data Subject, and provided that no Sensitive Data is to be processed.
The Regulations shall set out the provisions, controls and procedures related to what is stated in paragraphs (2) to (6) of this Article.
FAQs
The Controller may only share your data under specific conditions:
- With your consent: This is the primary basis unless you explicitly agree, they can’t disclose it.
- Public data: If the data is already publicly accessible, it can be shared without additional consent.
- Public-interest requests: If a government or judicial authority legally requests it for reasons like national security, law enforcement, or public safety, the Controller must comply.
- Protecting public health or safety: Disclosure is allowed when necessary to safeguard lives or address serious health threats.
- Legitimate interests: The Controller may share data when necessary for its legitimate business purposes provided the data is not sensitive, your rights aren’t harmed, and they’ve carefully justified the need.
Before disclosing any personal data, the Controller must:
- Verify the legal basis: Confirm that consent exists, the data is public, or that the request is officially required for legal, public-interest, or safety reasons.
- Evaluate impact on your rights: Ensure that the disclosure won’t harm your privacy or other fundamental rights.
- Anonymize if possible: If disclosure is for legitimate interests, and the data can be anonymized to prevent identification, that step should be taken.
- Keep a record: Document the reason, legal justification, date, and recipient of the disclosure to maintain transparency and prove compliance.
If you suspect improper disclosure:
- Ask the Controller for explanation: You’re entitled to ask why they shared your data, under what legal basis, and whether your rights were considered.
- File a complaint with SDAIA: If their explanation isn’t satisfactory or you believe the sharing violated the law, you can lodge a formal complaint with the data protection authority.
- Seek legal compensation: If the improper disclosure caused you harm—whether emotional or financial—you can pursue legal action and claim compensation under the PDPL.