Processes personal data, in Jordan

Cyber Security Law No. (16) of 2019, Article 8(b) · Read the law's page

• Adhere to the policies, standards, and controls the Center issues for the institution's own sector, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity or the security of cyberspace, taking every step necessary to prevent or avoid it.
• If the Council of Ministers has delegated some of the Center's tasks and powers to you as an oversight body, government department, or official or public institution, notify the Center immediately upon the occurrence or suspicion of a cybersecurity incident (Article 11(b)).when it serves a public body
• Where the incident is Critical or High severity, in particular where it touches critical infrastructure, a security or military body, a ministry or government institution, a government-owned or government-invested company, a supply chain feeding those entities, or where it disrupts essential services entirely at a higher-education institution, the Center's own Incident Response and Reporting Policy sets the time to report to the Center and the sectoral body at 1 hour at most for a Critical-tier incident, 2 hours for High, 4 hours for Medium, and 24 hours for Low; an ordinary private company or individual establishment with no such touchpoint is typically classified Medium or Low.
• Where the National Cyber Security Council designates an incident a threat to the Kingdom's own security and safety, the Center directs the response and every institution involved must comply with the Center's instructions and directives.
• This binds any ministry, government department, or official, public, private, or civil institution operating in Jordan; the National Cyber Security Center's own subsidiary instructions define the bound entity to include any company or individually registered establishment in the Kingdom, and the duty carries no sector, size, or personal-data gate of its own.
• A violation may draw a written warning, an order to correct the violation and reimburse the Center's resulting costs, blocking, cancellation, confiscation, or disabling of the offending network, system, or device, a requirement that the institution take legal measures against a responsible employee, suspension or cancellation of a cybersecurity-services license, or a fine of between 500 and 100,000 Jordanian dinars doubled for a repeated violation, imposed by the Center itself rather than through a private lawsuit.

Law No. 24 of 2023, Art. 14 · Read the law's page

• An app transferring or exchanging the personal data of an individual in Jordan with another recipient must obtain the Data Subject's consent, confirm a legitimate interest on both sides, ensure the Data Subject has sufficient knowledge of the purpose, and must not use the data for marketing without a separate consent; Jordan's base Law does not impose an adequacy or localization gate on the transfer.

Law No. 24 of 2023, Art. 2 definitions · Read the law's page

• An app that processes biometric data about an individual in Jordan, including a faceprint or voiceprint, must treat it as Sensitive Personal Data and obtain consent or rely on one of the Law's enumerated exceptions, and must not retain it beyond the processing purpose unless legislation specifies otherwise. Whether Jordan requires a heightened, explicit-consent standard specifically for biometric processing, beyond ordinary consent, is not confirmed.

Law No. 24 of 2023, Art. 20 · Read the law's page

• An app that suffers a serious breach of data security or safety that could cause significant harm to an individual in Jordan must notify the affected individuals within 24 hours of discovery and must notify the Unit within 72 hours of discovery with the source, mechanism, and affected individuals; a Controller found grossly negligent or engaged in misconduct in a breach is liable to compensate the affected Data Subject.

Law No. 24 of 2023, Arts. 1-2, 11 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Jordan must obtain consent or rely on one of the Law's enumerated alternative bases, must confine retention to the processing purpose unless legislation specifies otherwise, and must appoint a data-protection lead if it processes Sensitive Personal Data or transfers personal data to a database outside Jordan.

Law No. 24 of 2023, Arts. 21-22 · Read the law's page

• An app processing the personal data of an individual in Jordan risks administrative sanctions (warning, licence suspension or revocation, or a fine up to 3% of prior-year revenue) and criminal fines from 1,000 to 10,000 Dinars for a violation; a data subject harmed by a grossly negligent breach may recover compensation directly from the Controller under Art. 20(B), and after a criminal conviction, the affected party may petition the court to order the data destroyed or the database cancelled under Art. 22(B), a narrow, trigger-specific remedy rather than a blanket private right of action.

Law No. 24 of 2023, data subject rights list · Read the law's page

• An app must let an individual in Jordan object to processing or profiling of their data that is unnecessary, excessive, discriminatory, or unlawful for its stated purpose, must let them obtain erasure or concealment of their data and a portable copy transferable to another controller, and must notify them of any data breach affecting the security or integrity of their data.