Saudi Arabia PDPL 24: Credit data: explicit consent and notice of disclosure requests

What does 24 require?

Credit data processing requires verifying explicit consent for collection, change of purpose, disclosure or publication under the Law and the Credit Information Law, and notifying the data subject whenever any entity requests disclosure of their credit data (Law 24); the Controller adopts Saudi Central Bank and other authorities' requirements and protects credit data from misuse and unauthorised access (IR 27).