JordanPersonal Data Protection Law, sensitive personal data and biometric data
Law No. 24 of 2023, Art. 2 definitions
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that processes biometric data about an individual in Jordan, including a faceprint or voiceprint, must treat it as Sensitive Personal Data and obtain consent or rely on one of the Law's enumerated exceptions, and must not retain it beyond the processing purpose unless legislation specifies otherwise. Whether Jordan requires a heightened, explicit-consent standard specifically for biometric processing, beyond ordinary consent, is not confirmed.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which information has the Council "deemed sensitive" under the definition of Sensitive Personal Data in Article 2 of the Personal Data Protection Law, beyond the categories the definition lists?
What it makes you log
Logging duty
Article 2 only defines terms. Its definition of Sensitive Personal Data (origin, race, political opinions, religious beliefs, financial status, health, physical or mental condition, genetic data, biometric data, criminal record, and anything the Council deems sensitive) and its definitions of Processing, Controller and Data Breach state no duty to keep a log or record and no audit, and the Article names no territorial test. The record duties of the Law sit in Articles 11 and 14 and are coded on their own rows.
- Kind
- None
- As of
What this law does
Biometric data is explicitly named within the Sensitive Personal Data definition, alongside origin, race, political opinions, religious beliefs, financial status, health, physical or mental condition, genetic data, criminal record, and any information deemed sensitive by regulation, the same structural pattern as the UAE and Saudi Arabia.
Unlike the UAE, Oman, and ADGM statutes, no standalone "Biometric Data" definition with worked examples was found, the same lighter-touch pattern found in Saudi Arabia's Art. 1(11).
Processing Sensitive Personal Data, including biometric data, falls under the same consent-plus-enumerated-exceptions structure as general personal data; whether a heightened, explicit-consent standard specifically applies to sensitive or biometric processing (as in Bahrain and Saudi Arabia) is not independently confirmed. The general storage-limitation principle applies to biometric data as much as any other category, though it is not biometric-specific.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .