Transfer and location of Customer Content 3.3.7 CSPs must inform any Cloud Customer, upon his request, of the information security features offered by the CSP or applied to the Cloud Customer's Customer Content. CSPs may also satisfy this obligation by making such information available in online format for Cloud Customers. 3.3.8 Cloud Customers must ensure that no Level 3 Customer Content is transferred outside the Kingdom, for whatever purpose and in whatever format, whether permanently or temporarily (e.g. for caching, redundancy or similar purposes), unless this is expressly allowed under the laws or regulations of the Kingdom, other than this Regulatory Framework. 3.3.9 Cloud Customers may not transfer, store or process Level 3 Customer Content to or in any Public Cloud, Community Cloud or a Hybrid Cloud, unless and for as long as the CSP is validly registered with the Commission pursuant to article ‎3.2, above. 3.3.10 Regardless of the level of information security (if any) required by the relevant Cloud Customer, CSPs registered under article ‎3.2 above must disclose to the Commission: 3.3.10.1 The location and main features of any of its Datacenters that are located in the Kingdom, and 3.3.10.2 The foreign country or countries of the location of any of its Datacenters used for the processing, storage, transit or transfer of Customer Data or Customer Content of Cloud Customers that have a Residence or Customer Address in the Kingdom. 3.3.11 Without prejudice to their obligations under Article ‎3.3.7, CSPs must inform their Cloud Customers in advance whether their Customer Content will be transferred, stored or processed outside the Kingdom, permanently or temporarily. Reporting of security breaches 3.3.12 CSPs must inform Cloud Customers, without undue delay, of any security breach or information leakage that those CSPs become aware of, if such breach or leakage affects, or is likely to affect, those Cloud Customers’ Cloud Content, Customer Data or any Cloud Service they receive from that CSP. 3.3.13 CSPs must inform the Commission, without undue delay, of any security breach or information leakage that those CSPs become aware of, if such breaches or leakages affect, or are likely to affect: 3.3.13.1 any Level 3 Customer Content, Cloud Computing Regulatory Framework Page 7 of 15