Without prejudice to Article (18) herein, the Controller shall maintain records, for such a period as required under the Regulations, of the Personal Data Processing activities, based on the nature of the activity carried out by the Controller. Such records are to be available whenever requested by the Competent Authority. The records shall contain the following information at a minimum:

1. Contact details of the Controller.
   
   
2. The purpose of the Personal Data Processing.
   
   
3. Description of the categories of Personal Data Subjects.
   
   
4. Any other entity to which Personal Data has been, or will be, disclosed.
   
   
5. Whether the Personal Data has been or will be transferred outside the Kingdom or disclosed to an entity outside the Kingdom.
   
   
6. The expected period for which Personal Data shall be retained.