JordanCyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty
Cyber Security Law No. (16) of 2019, Article 8(b)
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This binds any ministry, government department, or official, public, private, or civil institution operating in Jordan; the National Cyber Security Center's own subsidiary instructions define the bound entity to include any company or individually registered establishment in the Kingdom, and the duty carries no sector, size, or personal-data gate of its own.
- Adhere to the policies, standards, and controls the Center issues for the institution's own sector, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity or the security of cyberspace, taking every step necessary to prevent or avoid it.
- If the Council of Ministers has delegated some of the Center's tasks and powers to you as an oversight body, government department, or official or public institution, notify the Center immediately upon the occurrence or suspicion of a cybersecurity incident (Article 11(b)).
- Where the incident is Critical or High severity, in particular where it touches critical infrastructure, a security or military body, a ministry or government institution, a government-owned or government-invested company, a supply chain feeding those entities, or where it disrupts essential services entirely at a higher-education institution, the Center's own Incident Response and Reporting Policy sets the time to report to the Center and the sectoral body at 1 hour at most for a Critical-tier incident, 2 hours for High, 4 hours for Medium, and 24 hours for Low; an ordinary private company or individual establishment with no such touchpoint is typically classified Medium or Low.
- Where the National Cyber Security Council designates an incident a threat to the Kingdom's own security and safety, the Center directs the response and every institution involved must comply with the Center's instructions and directives.
- A violation may draw a written warning, an order to correct the violation and reimburse the Center's resulting costs, blocking, cancellation, confiscation, or disabling of the offending network, system, or device, a requirement that the institution take legal measures against a responsible employee, suspension or cancellation of a cybersecurity-services license, or a fine of between 500 and 100,000 Jordanian dinars doubled for a repeated violation, imposed by the Center itself rather than through a private lawsuit.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Article 16(a)(6): a fine of not less than 500 and not more than 100,000 Jordanian dinars per violation, doubled for a repeated violation. The Center's own 2025 instructions further grade the fine within this range, both by the type of violation and, for a violation tied to an actual incident, by that incident's own severity tier (up to a 50,000-to-100,000-dinar band where the incident is classified Severe).
- Rule
- Per violation only
- As of
- Minimum
- 500
- Currency
- JOD
- Per violation unit
- Violation
- Per violation amount
- 100,000
Who enforces it
Enforcement body
The National Cyber Security Center, which under Article 16(a) may take one or more of the listed measures against any violator of the Law and its subsidiary regulations, instructions and decisions.
What this law does
Any ministry, government department, or official, public, private, or civil institution must adhere to the National Cyber Security Center's sector-specific policies, standards and controls, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity, taking every step necessary to prevent or avoid it.
A violation may draw a written warning, a correction order, network or system blocking, license suspension, or a fine of between 500 and 100,000 Jordanian dinars doubled on repeat, imposed administratively by the Center rather than through a private lawsuit.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, runs an essential service, provides financial services, handles health records, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, is a listed company, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .