JordanPersonal Data Protection Law, data subject rights
Law No. 24 of 2023, data subject rights list
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app must let an individual in Jordan object to processing or profiling of their data that is unnecessary, excessive, discriminatory, or unlawful for its stated purpose, must let them obtain erasure or concealment of their data and a portable copy transferable to another controller, and must notify them of any data breach affecting the security or integrity of their data.
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What "financial or contractual consequences" may a Controller attach to a Data Subject's exercise of a right under Article 4(B) of the Personal Data Protection Law, given that Article 4(C) is "without prejudice to the rights of the controller"?
What it makes you log
Logging duty
Article 4(B) lists eight data subject rights: awareness and access, withdrawal of consent, correction, limiting processing, erasure or concealment, objection to processing and profiling, transfer of a copy to another controller, and notice of a data breach. Each is a right of the individual to be exercised against the controller; none requires the controller to keep a log or record, and no clause gives a regulator or court a right to examine one. Article 4(C) and (D) leave the procedure to regulations. Article 8(C) to (F), which obliges a controller to run mechanisms for complaints and for the exercise of rights, is not cited by this row.
- Kind
- None
- As of
What this law does
A numbered rights list confirms, read verbatim: erasure or concealment of data (item 5), objection to processing and profiling that are unnecessary, excessive, discriminatory, prejudiced, or unlawful for the purposes collected (item 6), transfer of a copy of the data from one controller to another, i.e. portability (item 7), and being notified of any data breach or violation regarding the security and integrity of the data (item 8).
Items 1-4 of the same list, likely including access and correction rights, were not individually extracted, though the numbering implies they exist.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .