Executive Regulation of the Personal Data Protection Law — Article 17

The Controller may reject a request wholly or partly if it is unjustifiably repetitive or requires extraordinary effort. A reasoned refusal must be notified within the article 16 period.

Interpretation and application must be checked against the official Arabic text and the current version.