Processes personal data, in Syria

Law No. 12 of 2024 (Syrian Arab Republic), arts. 1-2, 4-7, 9-10, 12, 27-30, 40, 45 (definitions, lawful processing, controller and processor obligations, licensing and scope) · Read the law's page

• Determine a lawful basis under one of the grounds article 7 lists before processing personal data, such as the data subject's consent to a specific purpose, a contractual or legal obligation, or a court order.
• Obtain a license or permit from the Personal Data Protection Authority before collecting, storing, transferring or processing personal data, and appoint a local representative if you are established outside Syria.
• Collect personal data only for legitimate and specific purposes, process it in a manner appropriate to those purposes, and do not retain it longer than the purpose requires unless the retention is for archiving in the public interest or for scientific, historical or statistical purposes.
• Take the technical and organizational security measures the Authority approves to protect personal data against unauthorized or unlawful processing and against loss or damage, and appoint a data protection officer, registered with the Authority, if you are a legal person.
• Keep a register describing the categories of personal data you hold, who you disclose it to, the retention periods, and any cross border transfer, and make it available for the Authority's inspection.
• Erase personal data once the purpose for holding it lapses, unless a lawful reason permits retention, in which case keep it in a form that no longer identifies the data subject.

Law No. 12 of 2024, art. 8 (personal data breach notification) · Read the law's page

• Notify the Authority immediately on becoming aware of the breach, and expect the Authority to immediately notify the competent authorities where the breach concerns national security matters.
• Notify the Authority within 72 hours of becoming aware of the breach, with a description of its nature, form and causes, the approximate number of records, persons and categories affected, the data protection officer's contact details, the breach's likely effects, the measures taken or proposed to address it, and documentation of the breach and the corrective action taken.
• Tell the affected data subject what measures have been taken within three working days of the date you notified the Authority of the breach.

Law No. 12 of 2024, arts. 13-14 (sensitive personal data) · Read the law's page

• Do not process sensitive personal data, including a psychological, mental, physical or genetic health condition or a biometric identifier such as a voiceprint or faceprint, without a license or permit from the Personal Data Protection Authority.
• Obtain the data subject's written and explicit consent before processing their sensitive personal data, unless a legally authorized case applies.
• Obtain the consent of a child's legal guardian before processing a child's personal data, and where a child takes part in a game, competition or other activity that calls for personal data, collect no more than participation requires.
• Follow the information security plans, policies and procedures the Authority sets for protecting sensitive personal data, through your data protection officer and the staff under their supervision.

Law No. 12 of 2024, arts. 15-16 (cross-border transfer of personal data) · Read the law's page

• Obtain the Authority's license and verify that the destination Arab or foreign state offers an acceptable level of protection before transferring, storing abroad, or sharing personal data with a party there.
• Where the destination state lacks a verified protection level, transfer personal data only with the data subject's or their representative's explicit consent and only for one of the purposes article 15(b) lists, such as preserving the data subject's life, defending a legal right, or performing a contract for their benefit.
• Obtain the Authority's license before making personal data available to another controller or processor outside Syria, and confirm that its legal and technical protection level meets the level set in the law's executive instructions.

Law No. 12 of 2024, arts. 19-26, 31, 34-39, 43 (Authority, complaints, fines and offences) · Read the law's page

• Expect the Authority to license, inspect and receive complaints against you as a controller or processor, and to be able to order you to stop and remove the effects of any violation of this law.
• Comply with a stop order the Director General serves within the period it specifies, or expect the Board to warn of, suspend, or revoke your license, permit or accreditation, publish the violation at your expense, or place you under the Authority's technical supervision.
• Respond within seven working days to a decision the Authority issues on a data subject's complaint against you, after the Authority has decided the complaint within thirty days of it being filed.
• Provide the Authority with any reports, statistics or information it requests about your personal data protection activities.
• Expect an administrative fine of up to 15,000,000 Syrian Pounds for failing your registration, security, breach notification, data protection officer, or request-handling duties, or for a marketing or licensing violation, on top of the criminal penalties this law sets.

Law No. 12 of 2024, arts. 3, 11, 17-18, 33 (rights, requests and electronic marketing) · Read the law's page

• Do not process, disclose or divulge personal data without the data subject's explicit consent, unless a legally authorized case applies.
• Tell a data subject, on request, the nature, purpose and method of processing their personal data and the retention period or how it is set, and let them access their own data, withdraw a prior consent without retroactive effect, correct, delete, add to or update it, confine your processing to a defined purpose, and object to processing that violates their constitutional rights.
• Decide a request to make a data subject's personal data available within five working days of registering it, and give reasons in writing for any refusal.
• Answer any other request from a data subject to exercise a right under this law within seven working days of its submission.
• Obtain a data subject's consent, identify yourself as sender, give a correct return address, and label the message as direct marketing before sending any electronic marketing contact, and give the data subject a clear and easy way to refuse it or withdraw consent.
• Keep electronic records of a data subject's marketing consent, its amendments, or their non-objection to continued contact, for three years from the date you last sent them a marketing message.