Article (12) The Controller shall, at the time of disclosing Personal Data or transferring it to the Processor, take into consideration that it is in line with Lawful Purposes and is processed according to provisions hereof. Article (13) Each of the Controller and the Processor shall take the precautions necessary to protect Personal Data against loss, damage, change, disclosure, access thereto, or the inadvertent or illegal use thereof. Such precautions shall be commensurate with the nature and the importance of the Personal Data intended to be protected. The Processor shall forthwith notify the Controller of the existence of any breach of the precautions referred to, or where any risk arises threatening Personal Data in any way. Article (14) The Controller shall inform the Individual and Competent Department of the occurrence of any breach of the precautions provided for in the preceding Article, and if such breach may cause serious damage to Personal Data or individual privacy. Article (15) Taking into account the liabilities provided for hereto, the Controller shall be forbidden from taking any decision or measure that may limit the CrossBorder Data Flow, unless the processing of such data is in breach of this Law, or where such processing may cause serious damage to the Personal This document is not official and the official version of the law is the one published in the Official Gazette number 15 of year 2016 that is available on almeezan.qa