Personal Data Protection and Safeguarding Draft Act June 2019 Note 1. Implementation of private regulation and instructions of the safeguarding chain is incumbent upon bearing of the costs by the requester and it not contravening general regulations. Note 2. Controller can ask for priority order from the commission if regulations and instructions contradict one another. Section Four: Foreign-based processing Article 37. In the cases below, the processing of personal data is considered foreign-based: a) If any of the controllers or processors holds foreign citizenship b) If the systems that process data exist outside the sovereign realm of the Islamic Republic of Iran Article 38. For the processing of personal data of Iranian citizens, the following conditions need to be met: a) They can only be stored in the data centers located in the sovereign realm of the Islamic Republic of Iran or the foreign-based data centers approved by the relevant authorities; b) All hardware and software processors should hold licenses issued by relevant authorities; c) They should be transferred on trustable communication networks; d) Relevant authorities have to confirm the foreign controllers and processors; e) Foreign-based processors should register based on regulations. Chapter Four: Regulation and supervision of personal data Article 39: Regulation and supervision of personal data is the responsibility of following organs: a) Personal data protection commission ARTICLE 19 – Free Word Centre, 60 Farringdon Rd, London EC1R 3GA – www.article19.org – +44 20 7324 2500 Page 47 of 58