LebanonLaw No. 81/2018 on Electronic Transactions and Personal Data, Part V (Personal Data Protection)
Law No. 81 Official Gazette of Lebanon, promulgated (in force ), Arts. 85, 87, 90, 93 to 98 and 103 to 105 (Part V, Personal Data Protection), with the definitions in Article One and the provider retention duties in Arts. 72 and 74
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Licensing, Security, Retention, Governance, Disclosure
- Audit expectation
- on_request
What it requires
- File a permit with the Ministry of Economy and Trade, issued against a receipt, before collecting or processing the personal data of a person in Lebanon, unless one of the exemptions in Article 94 covers the processing.NIST Privacy FrameworkGV.PO-P5
- State in that permit the objectives of the processing, the personal data and its source, the categories of persons concerned, the third parties who may view the data, the retention period, your identity and address and those of your representative if you live outside Lebanon, the agency carrying out the processing, who exercises the right of access and how, any subcontractor, and the measures you take to keep the data intact.NIST Privacy FrameworkGV.PO-P5
- Obtain a ministerial licence before processing personal data on the internal or external security of the State or on penal offences and judicial proceedings, and treat no answer within two months of the application as a refusal.NIST Privacy FrameworkGV.PO-P5
- Collect personal data faithfully and for legitimate, specific and explicit purposes, keep it appropriate to and within those purposes, correct, complete and as relevant as possible, and do not later process it for purposes out of line with the objectives you stated, except for statistical, historical or scientific research.NIST Privacy FrameworkGV.PO-P1
- Retain personal data only for the period stated in the declaration of processing or in the decision authorizing it.NIST Privacy FrameworkCT.PO-P2
- Take all measures, in light of the nature of the data and the risks of processing it, to keep the data intact and secure and to protect it against distortion, damage and access by unauthorized persons.NIST Privacy FrameworkPR.DS-P5
- Do not rely on a contract clause, an agreement or a unilateral undertaking that contravenes Part V: none of them may be invoked against the rights of the persons concerned or against your own obligations.NIST Privacy FrameworkGV.PO-P5
- As a network service provider or data host, keep the traffic data of everyone using your service, the data that identifies them and the other technical data of their communications for three years from the service delivery date, keep it under professional secrecy, and produce it to the judicial police or the court when the competent judicial authority so decides.NIST Privacy FrameworkCT.DM-P8NIST Privacy FrameworkCT.PO-P2
- As a data host, store for ten years the identification data of a non-professional who makes information available online to the public anonymously.NIST Privacy FrameworkCT.DM-P8
- Expect the Ministry of Economy and Trade to publish your permit or licence, its date, the name and purpose of the processing, your identity and address, the categories of personal data processed and the third parties authorized to view them on a public list on its website.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does Article 95's requirement that those collecting and processing personal data 'shall inform the Ministry of Economy and Trade under a permit issued duly against a receipt' make a developer's filing a notification acknowledged by receipt, or a permit that must be granted before processing starts?
What it makes you log
Who may demand the log
Court
What the log must hold
Actor identity, Access record
Log retention
Three years from the service delivery date for the traffic and identification data an IT service provider saves under Article 72. Article 74 sets ten years for the identification data a data host stores about a non-professional who publishes anonymously.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Article 72 requires an IT service provider to save the traffic data of everyone using its service, the data that helps identify them and other technical data of communications, for three years from the service delivery date, and bars it from pleading a technical failure for not saving them. Content that expresses the views of its author, such as correspondence or the content of stored or transferred information, is outside the duty. Article 74 requires a data host to store for ten years the identification data a non-professional supplies when publishing information anonymously. The judicial police may, after notifying the judicial authority, ask a provider to store additional technical data on a given incident or specific individuals for no more than thirty days, and the data may go to the judicial police only on a decision of the competent judicial authority. The Part V articles this row cites impose no log or record-keeping duty on a processing officer: Article 90 limits how long personal data may be kept, the permit filed with the Ministry of Economy and Trade under Articles 95 and 96 is a notification, and Article 98 has the Ministry publish the list of permits. Article 75, outside this row, deems an IT service provider permanently residing in Lebanon to have elected domicile there.
- Kind
- Explicit
- As of
- Provision
- Law No. 81 of 2018, Articles 72 and 74
- Trigger
- personal_data_processing
What this law does
Article 85 applies Part V to all automatic and non-automatic processing of data of a personal nature, by public and private actors alike, exempting only processing related to the personal activities an individual carries out exclusively to fulfil their own needs, and it voids any agreement, contravening clause or unilateral undertaking that would contract out of the rights and obligations Part V sets.
Article One defines personal data as any information that helps to directly or indirectly identify a natural person, including by comparing or overlapping data collected from multiple sources, defines processing to reach collection, recording, organization, storage, adaptation, modification, extraction, reading, use, transmission, copying, dissemination, deletion and destruction alike, and puts the duties on the person who sets the processing objectives and methods, the role the act calls the personal data processor and Part V calls the personal data processing officer.
Article 87 requires personal data to be collected faithfully and for legitimate, specific and explicit purposes, to be appropriate, not to go beyond the stated objectives, to be correct, complete and as relevant as possible on a daily basis, and not to be processed later for purposes out of line with those objectives, save for statistical, historical or scientific research.
Article 90 limits retention to the period stated in the declaration of processing or in the decision authorizing it, and Article 93 requires the processing officer to take all measures, in light of the nature of the data and the risks of processing it, to keep the data intact and secure and to protect it against distortion, damage and access by unauthorized persons.
Article 94 lists the processing that needs no permit or licence at all, including book-keeping by non-profit organizations of their own members and clients, public registers kept under legal or regulatory provisions, pupil and student records held by educational institutions, the records of an institution's or company's own members, clients and customers within the needs of its lawful activity, and processing the person concerned agreed to in advance; Article 95 requires everyone else who wishes to collect and process personal data to inform the Ministry of Economy and Trade under a permit issued against a receipt, Article 96 fixes the fourteen items that permit must state, Article 97 subjects state-security, penal-offence and health, genetic-identity or sexual-life processing to a ministerial licence, and Article 98 requires the Ministry to publish the resulting permits and licences on a public list.
Articles 103 to 105 carve out the limits: a person is not to be informed of processing tied to the internal or external security of the State where informing them would endanger it, access to public, official and medical files stays governed by the rules that already govern those files, and Articles 99 to 101 do not reach processing carried out solely for literary or artistic expression or for the professional exercise of journalism.
Outside Part V, Article 72 requires an IT service provider to keep the traffic data of everyone using its service, the data that identifies them and other technical communications data for three years from the service delivery date, under professional secrecy and subject to judicial production orders, and Article 74 requires a data host to store for ten years the identification data of a non-professional who publishes to the public anonymously.
Article 136 makes the law effective three months after its publication in the Official Gazette, so these provisions bind today.
When LexLint raises it
When your app profile says your app provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .