JordanPersonal Data Protection Law, enforcement and data subject remedies
Law No. 24 of 2023, Arts. 21-22
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in Jordan risks administrative sanctions (warning, licence suspension or revocation, or a fine up to 3% of prior-year revenue) and criminal fines from 1,000 to 10,000 Dinars for a violation; a data subject harmed by a grossly negligent breach may recover compensation directly from the Controller under Art. 20(B), and after a criminal conviction, the affected party may petition the court to order the data destroyed or the database cancelled under Art. 22(B), a narrow, trigger-specific remedy rather than a blanket private right of action.
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 22(A) makes any violation of the Law, its regulations, or its instructions punishable by a fine of not less than 1,000 Dinars and not more than 10,000 Dinars, doubled on a repeat violation, without prejudice to any stricter penalty under other Jordanian legislation. This is a separate track from Article 21's administrative sanctions: Art. 22(B) conditions its own court-ordered data-destruction or database-cancellation remedy on the final conviction ruling, confirming the fine is prosecuted through the ordinary courts on a criminal footing rather than imposed as a second administrative fine.
Penalty structure
Article 21(A) sets a graduated administrative track: the Unit first warns the violator to cure the violation within a stated period, and if the period elapses uncured, the Council, on the Unit's recommendation, may impose a warning to suspend the licence or permit, a partial or complete suspension, a partial or complete revocation, or a fine. The fine accrues at up to 500 Dinars per day the violation continues, but its binding aggregate ceiling is a percentage of revenue rather than a fixed sum: the total fine may not exceed 3% of the violator's total annual revenue for the prior fiscal year. The Unit may also publish a statement of proven violations at the violator's expense (Art. 21(B)).
- Rule
- Turnover pct only
- As of
- Currency
- JOD
- Turnover percentage cap
- 3
- Per violation unit
- Day
- Per violation amount
- 500
Who enforces it
Enforcement body
The Unit, the Ministry of Digital Economy and Entrepreneurship's organisational unit responsible for the protection of Personal Data, issues the first-line warning under Art. 21(A) and may publish a statement of proven violations under Art. 21(B). Where a warning goes uncured, the Personal Data Protection Council, chaired by the Minister of Digital Economy and Entrepreneurship and including the Information Commissioner as vice-chair, the General Commissioner for Human Rights, the President of the National Cyber Security Center, and other named members, imposes the escalating sanctions on the Unit's recommendation. Article 22's criminal fine is prosecuted separately, before the ordinary courts, with the Public Prosecution named in Art. 22(B) as a party entitled to petition the court.
Settledness
- As of
- Open questions
- Which "license or permit" does the Council suspend or revoke under Article 21(A) of the Personal Data Protection Law when the violator is a Controller that holds none?
What it makes you log
Logging duty
Article 21 sets the Unit's warning and the Council's penalties (licence warning, suspension or revocation, and a daily fine capped at 3% of prior-year revenue), a power to publish proven violations, and a preserved civil action. Article 22 sets a criminal fine of 1,000 to 10,000 Dinars, doubled on repeat, and a court's power to order destruction of data or cancellation of a database. None of this requires a controller to keep a log or record, and neither Article gives the Unit a power to demand information; the Unit's compliance-monitoring task and its registry of controllers are in Article 18, which this row does not cite.
- Kind
- None
- As of
What this law does
Article 21 is administrative: for a violation, the Unit issues a warning first, and if uncured, the Council may impose licence suspension or revocation, or a fine up to 500 Dinars per day of continuing violation, capped at 3% of the violator's prior-fiscal-year annual revenue, and the Unit may publish a statement of proven violations at the violator's expense.
Article 22 is criminal-adjacent: a fine of 1,000 to 10,000 Dinars, doubled on repeat violation, without prejudice to any stricter penalty elsewhere in Jordanian law. Article 22(B), read verbatim, lets the relevant court, on request of the public prosecution, the affected party, or its own initiative, order the destruction of data or the cancellation of a database following a final conviction, naming the affected data subject as a party with standing to petition alongside the public prosecution.
Combined with Article 20(B)'s compensation clause, Jordan is the clearest case in this batch of a statute naming the data subject as a party with standing to seek a remedy, though neither clause is a freestanding tort-style private right of action: both are narrower and tied to specific triggers, compensation for gross-negligence breach harm, and a court petition following a criminal conviction, rather than a blanket civil cause of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .