Written consent from the regulatory uthority is required to transfer data abroad. Article 8 of the Law states that when choosing the means by which to process data, a controller must have in place measures that guarantee it gives effect to the provisions of the law and must regularly check the conformity of its means of processing with data protection principles. That includes obtaining the consent of data owner prior to cross-border transfers as regulated in the Article 5.1 of the Law. Article 19 of the Law states that the controller is required to take appropriate technical and organisational measures to safeguard personal data, including on the transfer of such data. Article 29 of the Law states that the competent authority can excuse a controller, on a case-by-case basis, from compliance with any of the other conditions stipulated in the law if the competent authority itself or in cooperation with other bodies, assesses that the personal data will be accorded with sufficient safeguards outside the Kingdom and so long as no sensitive personal data is included.