Executive Regulation of the Personal Data Protection Law — Article 21

The Controller or Processor must display a personal data protection policy where the Data Subject can review it before Processing. At minimum, it must explain the mechanism and procedures for exercising rights under the Law and Regulation.

Interpretation and application must be checked against the official Arabic text and the current version.