Makes insurance decisions, in Jordan

Cyber Security Law No. (16) of 2019, Article 8(b) · Read the law's page

• Adhere to the policies, standards, and controls the Center issues for the institution's own sector, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity or the security of cyberspace, taking every step necessary to prevent or avoid it.
• If the Council of Ministers has delegated some of the Center's tasks and powers to you as an oversight body, government department, or official or public institution, notify the Center immediately upon the occurrence or suspicion of a cybersecurity incident (Article 11(b)).when it serves a public body
• Where the incident is Critical or High severity, in particular where it touches critical infrastructure, a security or military body, a ministry or government institution, a government-owned or government-invested company, a supply chain feeding those entities, or where it disrupts essential services entirely at a higher-education institution, the Center's own Incident Response and Reporting Policy sets the time to report to the Center and the sectoral body at 1 hour at most for a Critical-tier incident, 2 hours for High, 4 hours for Medium, and 24 hours for Low; an ordinary private company or individual establishment with no such touchpoint is typically classified Medium or Low.
• Where the National Cyber Security Council designates an incident a threat to the Kingdom's own security and safety, the Center directs the response and every institution involved must comply with the Center's instructions and directives.
• This binds any ministry, government department, or official, public, private, or civil institution operating in Jordan; the National Cyber Security Center's own subsidiary instructions define the bound entity to include any company or individually registered establishment in the Kingdom, and the duty carries no sector, size, or personal-data gate of its own.
• A violation may draw a written warning, an order to correct the violation and reimburse the Center's resulting costs, blocking, cancellation, confiscation, or disabling of the offending network, system, or device, a requirement that the institution take legal measures against a responsible employee, suspension or cancellation of a cybersecurity-services license, or a fine of between 500 and 100,000 Jordanian dinars doubled for a repeated violation, imposed by the Center itself rather than through a private lawsuit.

Law No. 24 of 2023, data subject rights list · Read the law's page

• An app must let an individual in Jordan object to processing or profiling of their data that is unnecessary, excessive, discriminatory, or unlawful for its stated purpose, must let them obtain erasure or concealment of their data and a portable copy transferable to another controller, and must notify them of any data breach affecting the security or integrity of their data.