In accordance with Article (14) of the Law:

• The transfer and exchange of Data between the Controller and any other person, including the Recipient, shall not be allowed without the Consent of the Data Subject and in accordance with the following conditions:
• • The transfer serves legitimate interests of the Controller and the Recipient.
  • The Data Subject has sufficient knowledge of the purposes for which the Data will be used.
  • The transfer is not for marketing products or services unless the Data Subject has given Consent for that purpose.
• The Controller shall keep records documenting the Data that has been transferred or exchanged with the Recipient, as well as the purpose of the transfer, and document the Consent of the Data Subjects for the transfer.
• Notwithstanding paragraphs (a) and (b) of this article, the transfer and exchange of Data between public authorities shall be allowed to the extent required for the performance of their legal duties.
• The Recipient shall be subject to the same legal responsibilities and obligations as the Controller.
• The Controller, Processor, and Recipient shall ensure the safety and security of the Data and provide appropriate measures to detect and track any breach of its security and safety.

Additionally, Article (15) prohibits the transfer of data outside the Kingdom to any person, including recipients, where the level of data protection is lower than that required under the law, unless specific exceptions apply. These exceptions include transfers carried out within the framework of regional or international judicial cooperation pursuant to treaties in force in the Kingdom, cooperation with regional or international entities involved in combating crime or pursuing criminals, the exchange of medical data necessary for the treatment of the data subject, and the exchange of data related to epidemics, health crises, or matters impacting public health in the Kingdom.