Executive Regulation of the Personal Data Protection Law — Article 23

The Controller and Processor must appoint an external auditor who is accredited and licensed by the Ministry and independent of both. They must allow the auditor to inspect the records, Processing systems and data necessary for the audit.

Interpretation and application must be checked against the official Arabic text and the current version.