Article 16 The Controller shall not disclose Personal Data in the situations stated in Paragraphs (1, 2, 5) and (6) of Article (15) if the Disclosure: 1- Represents a threat to security, harms the reputation of the Kingdom, or conflicts with the interests of the Kingdom. 2- Affects the Kingdom’s relations with any other state. 3- Prevents the detection of a crime, affects the rights of an accused to a fair trial, or affects the integrity of existing criminal procedures. 4- Compromises the safety of an individual. 5- Results in violating the privacy of an individual other than the Data Subject, as set out in the Regulations. 6- Conflicts with the interests of a person that fully or partially lacks legal capacity. 7- Violates legally established professional obligations. 8- Involves a violation of an obligation, procedure, or judicial decision. 9- Exposes the identity of a confidential source of information in a manner detrimental to the public interest. Article 17 1- If Personal Data is corrected, completed or updated, the Controller shall notify such amendment to all the other entities to which such Personal Data has been transferred and make the amendment available to such entities. 2- The Regulations shall set out the time frames for correction and updating of Personal Data, types of correction, and the procedures required to avoid the consequences of Processing incorrect, inaccurate or outdated Personal Data. Article 18 1- The Controller shall, without undue delay, Destroy the Personal Data when no longer necessary for the purpose for which they were collected. However, the Controller may retain data after the purpose of the Collection ceases to exist; provided that it does not contain anything that may lead to specifically identifying Data Subject pursuant to the controls stipulated in the Regulations. 2- In the following cases, the Controller shall retain the Personal Data after the purpose of the Collection ceases to exist: a) If there is a legal basis for retaining the Personal Data for a specific period, in which case the Personal Data shall be destroyed upon the lapse of that period or when the purpose of the Collection is satisfied, whichever longer.