The Law generally prohibits Controllers from transferring Personal Data outside of Saudi Arabia or disclosing Personal Data to an entity outside of Saudi Arabia, except where consent of the competent authority has been obtained in respect of the transfer or disclosure concerned.