JordanPersonal Data Protection Law, breach notification
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers a serious breach of data security or safety that could cause significant harm to an individual in Jordan must notify the affected individuals within 24 hours of discovery and must notify the Unit within 72 hours of discovery with the source, mechanism, and affected individuals; a Controller found grossly negligent or engaged in misconduct in a breach is liable to compensate the affected Data Subject.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What makes a breach "serious" and one that "could cause significant harm" to the Data Subject under Article 20(A) of the Personal Data Protection Law, so that the 24-hour and 72-hour notices apply?
What it makes you log
Logging duty
Article 20(A) requires a controller that suffers a serious breach likely to cause significant harm to notify the affected Data Subjects within 24 hours and the Unit within 72 hours of discovery, with the breach's source, mechanism, affected Data Subjects and other available information. That is a duty to notify, and nothing in Article 20 requires the breach to be documented or kept in a register, and no one is given a right to examine a record. Article 20(B) is a liability rule for gross negligence or misconduct. A duty to detect and track breaches appears in Article 14(E), which this row does not cite.
- Kind
- None
- As of
What this law does
Article 20(A) requires the Controller, on discovering a serious breach of data security and safety that could cause significant harm to the Data Subject, to notify the affected Data Subjects within 24 hours of discovery, and to notify the Unit (MoDEE's internal data-protection unit) within 72 hours of discovery about the breach's source, mechanism, affected Data Subjects, and any other available related information. This is a materiality-gated duty with two distinct fixed timelines.
Article 20(B) separately makes the Controller liable to compensate the affected Data Subject in case of gross negligence or misconduct, a direct statutory compensation right tied to a breach.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .