2- The purpose of the Collection, and shall specify the Personal Data whose Collection is mandatory and the Personal Data whose Collection is optional. The Data Subject shall be informed that the Personal Data will not be subsequently processed in a manner inconsistent with the Collection purpose or in cases other than those stated in Article (10) of this Law. 3- Unless the Collection is for security purposes, the identity of the person collecting the Personal Data and the address of its representative, if necessary. 4- The entities to which the Personal Data will be disclosed, the capacity of such entities, and whether the Personal Data will be transferred, disclosed or processed outside the Kingdom. 5- The potential consequences and risks that may result from not collecting the Personal Data. 6- The rights of the Data Subject pursuant to Article (4) herein. 7- Such other elements as set out in the Regulations based on the nature of the activity done by the Controller. Article 14 The Controller may not process Personal Data without taking sufficient steps to verify the Personal Data accuracy, completeness, timeliness and relevance to the purpose for which it is collected in accordance with the provisions of the Law. Article 15 The Controller may not Disclose Personal Data except in the following situations: 1- Data Subject consents to the Disclosure in accordance with the provisions of the Law. 2- Personal Data has been collected from a publicly available source. 3- The entity requesting Disclosure is a Public Entity, and the Collection or Processing of the Personal Data is required for public interest or security purposes, or to implement another law, to fulfill judicial requirements. 4- The Disclosure is necessary to protect public health, public safety, or to protect the lives or health of specific individuals. 5- The Disclosure will only involve subsequent Processing in a form that makes it impossible to directly or indirectly identify the Data Subject. 6- The Disclosure is necessary to achieve legitimate interests of the Controller, without prejudice to the rights and interests of the Data Subject, and provided that no Sensitive Data is to be processed. The Regulations shall set out the provisions, controls and procedures related to what is stated in paragraphs (2) to (6) of this Article.