3.3.13.2 the Customer Content or Customer Data of a significant number of Cloud Customers, 3.3.13.3 a significant number of Persons in the Kingdom because of their reliance on one or more Cloud Customers’ services that are affected by the security breach or information leakage. 3.3.14 CSPs must inform their Cloud Customers, upon their request, of any insurance coverage that those CSPs have for any civil liability to those Cloud Customers. This information to the Cloud Customers must include at least the essential features of the CSP’s insurance coverage, if these are reasonably required for Cloud Customers to assess their exposure to risk and decide on their own insurance coverage accordingly. 3.3.15 Cloud Providers must adopt internal rules and policies on business continuity, disaster recovery and risk management, and provide to their Cloud Customers or the CSPs they co-operate with, upon their request, a summary of these rules and policies. 3.4 Protection of Customer Data 3.4.1 The provisions of this Article 3 ‎ .4 shall be binding upon CSPs who: 3.4.1.1 conclude a Cloud Contract with a Cloud Customer, as well as 3.4.1.2 those who, although not a party to such a Cloud Contract with the Cloud Customer concerned, alone or jointly with others determine the purposes and means of the processing of the relevant Cloud Customer’s Customer Data in a Cloud System. 3.4.2 Save as required to comply with the laws of a foreign jurisdiction in respect of a Cloud Customer subject to the laws of that jurisdiction, CSPs may not: 3.4.2.1 provide or authorize another party to provide to any third party (including, but not limited to, any individuals, legal entities, domestic or foreign government or public authorities) Customer Content or Customer Data, or 3.4.2.2 process or use Customer Content or Customer Data for purposes other than those allowed under the Cloud Computing Agreement with the Cloud Customer concerned. 3.4.3 A CSP’s obligations under Article ‎3.4.2, above, shall not apply with regard to any Customer Content or Customer Data that meets one of the following two conditions: 3.4.3.1 that CSP is required to disclose, transmit, process or use that Customer Content or Customer Data under the laws of the Kingdom; or 3.4.3.2 the Customer Data are Level 1 or Level 2 Data, and the relevant Cloud Customer provides its express prior consent Cloud Computing Regulatory Framework Page 8 of 15