Saudi Arabia PDPL 4(2)-9: Right of access and to a copy, with the Law's limits

What does 4(2)-9 require?

Data subjects may access their personal data held by the Controller and obtain it in a readable, clear format (Law 4(2)-(3)); access may be given on request or through a self-service channel, must not harm others' rights such as intellectual property or trade secrets, and must not disclose data identifying another person; copies are given in a commonly used electronic format, or printed where feasible (IR 5-6). The Controller may set time frames and limit access where necessary to protect the data subject or others from harm, or, for a Public Entity, for security, another law or judicial requirements, and must refuse access in the cases of Law 16(1)-(6) (Law 9).