The Law generally prohibits Controllers from transferring Personal Data outside of Saudi Arabia or disclosing Personal Data to an entity outside of Saudi Arabia, except where sufficient guarantees are provided to safeguard the data transferred or disclosed and to protect the confidentiality of the same and that they meet the minimum criteria stipulated in the Regulation.