JordanPersonal Data Protection Law, enforcement and data subject remedies
Law No. 24 of 2023, Arts. 21-22
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 17 March 2024.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- An app processing the personal data of an individual in Jordan risks administrative sanctions (warning, licence suspension or revocation, or a fine up to 3% of prior-year revenue) and criminal fines from 1,000 to 10,000 Dinars for a violation; a data subject harmed by a grossly negligent breach may recover compensation directly from the Controller under Art. 20(B), and after a criminal conviction, the affected party may petition the court to order the data destroyed or the database cancelled under Art. 22(B), a narrow, trigger-specific remedy rather than a blanket private right of action.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Article 22(A) makes any violation of the Law, its regulations, or its instructions punishable by a fine of not less than 1,000 Dinars and not more than 10,000 Dinars, doubled on a repeat violation, without prejudice to any stricter penalty under other Jordanian legislation. This is a separate track from Article 21's administrative sanctions: Art. 22(B) conditions its own court-ordered data-destruction or database-cancellation remedy on the final conviction ruling, confirming the fine is prosecuted through the ordinary courts on a criminal footing rather than imposed as a second administrative fine.
Penalty structure
Article 21(A) sets a graduated administrative track: the Unit first warns the violator to cure the violation within a stated period, and if the period elapses uncured, the Council, on the Unit's recommendation, may impose a warning to suspend the licence or permit, a partial or complete suspension, a partial or complete revocation, or a fine. The fine accrues at up to 500 Dinars per day the violation continues, but its binding aggregate ceiling is a percentage of revenue rather than a fixed sum: the total fine may not exceed 3% of the violator's total annual revenue for the prior fiscal year. The Unit may also publish a statement of proven violations at the violator's expense (Art. 21(B)).
- Rule
- Turnover pct only
- As of
- 2 September 2026
- Currency
- JOD
- Turnover percentage cap
- 3
- Per violation unit
- Day
- Per violation amount
- 500
Who enforces it
Enforcement body
The Unit, the Ministry of Digital Economy and Entrepreneurship's organisational unit responsible for the protection of Personal Data, issues the first-line warning under Art. 21(A) and may publish a statement of proven violations under Art. 21(B). Where a warning goes uncured, the Personal Data Protection Council, chaired by the Minister of Digital Economy and Entrepreneurship and including the Information Commissioner as vice-chair, the General Commissioner for Human Rights, the President of the National Cyber Security Center, and other named members, imposes the escalating sanctions on the Unit's recommendation. Article 22's criminal fine is prosecuted separately, before the ordinary courts, with the Public Prosecution named in Art. 22(B) as a party entitled to petition the court.
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 21 is administrative: for a violation, the Unit issues a warning first, and if uncured, the Council may impose licence suspension or revocation, or a fine up to 500 Dinars per day of continuing violation, capped at 3% of the violator's prior-fiscal-year annual revenue, and the Unit may publish a statement of proven violations at the violator's expense.
Article 22 is criminal-adjacent: a fine of 1,000 to 10,000 Dinars, doubled on repeat violation, without prejudice to any stricter penalty elsewhere in Jordanian law. Article 22(B), read verbatim, lets the relevant court, on request of the public prosecution, the affected party, or its own initiative, order the destruction of data or the cancellation of a database following a final conviction, naming the affected data subject as a party with standing to petition alongside the public prosecution.
Combined with Article 20(B)'s compensation clause, Jordan is the clearest case in this batch of a statute naming the data subject as a party with standing to seek a remedy, though neither clause is a freestanding tort-style private right of action: both are narrower and tied to specific triggers, compensation for gross-negligence breach harm, and a court petition following a criminal conviction, rather than a blanket civil cause of action.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
Read the law
official bilingual statute text, Ministry of Digital Economy and Entrepreneurship
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.