1- The Controller may process personal data to achieve a legitimate interest provided that the following conditions are met:
a) The purpose shall not violate any of the laws in the Kingdom.
b) The processing shall not affect the rights and interests of the Data Subject or third parties.
c) The processing shall not conflict with the interests of Data Subjects or have negative impact on them.
d) The processing shall not include Sensitive Data.
2- Legitimate interests include the Disclosure of fraud operations, the protection of network and information security, and other legitimate interests that meet the conditions outlined in paragraph (1) of this article.
3- According to the provisions of paragraph (4) of Article (6) of the Law, before processing Personal Data for legitimate interests, the Controller shall conduct and document an assessment of the proposed processing and its impact on the rights and interests of Data Subjects. The assessment shall include the following:
a) Identification of the proposed processing and its purposes, as well as the type of data and categories of Data Subjects.
b) Evaluation of the purpose to ensure it is legitimate and compliant with the laws in the Kingdom.
c) Verification of the necessity to process Personal Data to achieve the legitimate purpose of the Controller.
d) Determination of whether the proposed processing falls within the reasonable expectations of the affected Data Subjects.
e) Evaluation of whether the proposed processing will cause any potential harm to Data Subjects.
f) Identification of any measures that shall be taken to avoid potential risks or harms, in accordance with the provisions of paragraph (2) of Article (26) of the Regulation.
4- If the assessment outlined in paragraph (3) of this article indicates that the proposed processing will in any way violate any laws, infringe on the rights and interests of Data Subjects, cause harm to them or any other party, the Controller shall modify the proposed processing and conduct a new assessment.