Jordan. Comprehensive data protection. Law

Jordan PDPLPersonal Data Protection Law No. (24) of 2023

In force

Partly verified

Medium confidence. Precise in-force date (March 2024) from brief; implementing regulations status not verified.

§1Summary

Synopsis

Jordan's first comprehensive data protection law, built around consent, purpose limitation and security, with a council to impose sanctions on recommendation of a ministry unit.

Key themes

consent
data subject rights
DPO
breach notification
transfers
sensitive data

Unique features

Financial status is treated as sensitive data; DPO required when processing sensitive data or transferring data abroad; breach notice to individuals within 24h.

SaaS relevance

SaaS providers processing Jordanian data, especially if transferring outside Jordan, trigger DPO and transfer conditions.

§2Obligations

Extraterritorial: Limited
Breach notification: Individuals within 24h; Unit within 72h (serious breaches)
DPO: Conditional
Cross-border transfers: No transfer to lower-protection recipients unless exception; consent-based
Maximum penalty: JOD 10,000 (criminal fines); daily fines capped at 3% of prior-year revenue

§3Dates

Key dates

Adopted September 2023
In force 17 March 2024
Published Sept 2023; in force six months after publication (March 2024); implementing instructions pending/issued by Council

§4Text and authority

Text

Authoritative text modee.gov.jo

Authority

Personal Data Protection Council and Data Protection Unit, Ministry of Digital Economy and Entrepreneurship

§5Where it applies

Domestic law of: Jordan

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Precise in-force date (March 2024) from brief; implementing regulations status not verified.