Personal Data Protection and Safeguarding Draft Act June 2019 a) Iranian citizens: individuals or corporations, public or private, whether their private data is being processed inside or outside Iran. b) Foreign citizens: individuals or corporations, public or private, only if their data is processed by Iranian processors or controllers. Chapter Two: Rights of persons who are subject of data Section One: Consent to processing Article 4: Processing non- public personal data is conditional on the consent of person subject of data. Article 5: Consent given by individuals subject of data should conform to the following conditions: a) Given prior to processing b) Express the knowledge of the individual c) be referable Article 6: Processing private data about public situations or states without the consent of the person or persons who are subject of data is only allowed if: a) The person has made the data prone to processing; or b) They not limited the processing of their data. Article 7: Consent obtained by deception or threat or ambivalence of the person is not valid and if the person is not of capacity, the consent of his or her guardian or guarantor is necessary. State of coma or similar states which mean the person doesn’t have intention or will mean that he or she lacks the legal capacity to give consent. Section Two: Request processing or cessation of processing ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 40 of 58