With due consideration to the provisions on confidentiality of credit information and the banking rules followed in Saudi Arabia, none of the entities referred to in Article (32) of these Implementing Regulations may refuse to provide the companies with the requested credit data and information on consumers for the purposes stipulated in the Law and its Implementing Regulations.

Members and companies shall maintain confidentiality of credit information and data in their possession and limit the use and sharing of such information to the members, companies, and relevant persons and parties according to the Law and its Implementing Regulations. Without prejudice to the liability of their employees and workers for any violations they might commit, companies and members shall be held fully liable for any violations to the Law and its Implementing Regulations committed by their employees.

Employees and workers of companies and organizations subject to the Law and its Implementing Regulations must not disclose, or keep, any information which they may come upon while performing their job duties, even after the end of their employment.

Provisions on confidentiality of credit information will not apply to the following:

Companies may not establish a credit record of any consumer for the first time, or exchange it with any member or company without the consumer's consent.