Executive Regulation of the Personal Data Protection Law — Article 4

Before Processing Personal Data, the Controller must obtain the Data Subject's explicit consent. Valid consent must: (1) be given by a person with full legal capacity; (2) be clear and freely given without coercion; and (3) be written, electronic or given by another means specified by the Controller.

Interpretation and application must be checked against the official Arabic text and the current version.