JordanPersonal Data Protection Law, comprehensive regime and lawful basis
Law No. 24 of 2023, Arts. 1-2, 11
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Kept
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Jordan must obtain consent or rely on one of the Law's enumerated alternative bases, must confine retention to the processing purpose unless legislation specifies otherwise, and must appoint a data-protection lead if it processes Sensitive Personal Data or transfers personal data to a database outside Jordan.
These lines are LexLint's reading of the law's text. Also read by: Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0 (guidance from the Central Bank of Jordan, issued ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What activity makes processing Personal Data "the primary activity of the Controller" under Article 11(A)(1) of the Personal Data Protection Law, so that the Controller must appoint a Data Protection Officer?
What it makes you log
Logging duty
Article 11(A) requires a controller to appoint a Data Protection Officer in six listed cases, among them where its primary activity is processing Personal Data, where it processes Sensitive Personal Data and where it transfers to databases outside the Kingdom. Article 11(B)(1) and (2) charge that officer with documenting the controller's compliance with the Law and documenting the results of periodic assessments and reviews of its database and processing systems, which cannot be shown without a kept record. The text names no log, no content of the documentation, no period for keeping it and no person entitled to see it. Article 2 defines a Controller as a person located inside or outside the Kingdom who has the Data in custody, but it sets no test linking the data to Jordan, so no territorial hook is recorded. Articles 1 and 2 are commencement and definitions and add no record duty; the transfer record sits in Article 14 and is coded on its own row.
- Kind
- Implicit
- As of
- Provision
- Article 11(B)(1) and (2) (the Data Protection Officer documents the controller's compliance and the results of periodic assessments and reviews)
- Trigger
- personal_data_processing
What this law does
The Personal Data Protection Law, 23 articles, is Jordan's first comprehensive personal-data statute.
Processing generally requires consent, with an enumerated list of alternative lawful bases covering medical necessity, vital-interest protection, crime prevention and prosecution, statutory or court-ordered disclosure, Central Bank-supervised entity functions, regulation-specified cases, scientific or historical research, statistical, national-security, or public-interest purposes, and publicly available data.
A Controller must appoint a data-protection lead in specified cases, including when processing Sensitive Personal Data or transferring to databases outside the Kingdom (Art. 11(A)(5)). A general storage-limitation principle applies to all processing: data "shall not be retained after the purpose of the Processing is fulfilled, unless otherwise specified by legislation."
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- Central Bank of Jordan Artificial Intelligence Framework for the Banking Sector, Version 1.0, the Central Bank of Jordan
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .