SyriaLaw No. 12 of 2024 on Protection of Electronic Personal Data, sensitive personal data
Law No. 12 of 2024, arts. 13-14 (sensitive personal data)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric, Age verification
- Audit expectation
- none
What it requires
- Do not process sensitive personal data, including a psychological, mental, physical or genetic health condition or a biometric identifier such as a voiceprint or faceprint, without a license or permit from the Personal Data Protection Authority.NIST Privacy FrameworkGV.PO-P5
- Obtain the data subject's written and explicit consent before processing their sensitive personal data, unless a legally authorized case applies.NIST Privacy FrameworkCT.PO-P1
- Obtain the consent of a child's legal guardian before processing a child's personal data, and where a child takes part in a game, competition or other activity that calls for personal data, collect no more than participation requires.NIST Privacy FrameworkCT.PO-P1
- Follow the information security plans, policies and procedures the Authority sets for protecting sensitive personal data, through your data protection officer and the staff under their supervision.NIST Privacy FrameworkPR.DS-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 13 bars processing sensitive data without a license or permit from the Authority, requires the data subject's written and explicit consent, requires a guardian's consent for a child's data and limits what may be collected from a child taking part in a game or contest; Article 14 binds the data protection officer to the Authority's information-security plans. Written consent is a condition of processing and the articles state no duty to keep a record of it, to audit, to report or to retain anything. The cited articles contain no territorial scope clause.
- Kind
- None
- As of
What this law does
Article 13(a) prohibits a controller or processor, whether a natural or legal person, from processing sensitive personal data except with a license or permit from the Authority. Article 1 defines sensitive personal data as data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious belief, political opinion, or criminal status, and data belonging to a child or to a person lacking legal capacity.
Article 13(b) requires written and explicit consent from the data subject before processing sensitive personal data, except in cases the law permits. Article 13(c) requires the consent of a child's legal guardian for any operation involving a child's data, and where a child takes part in a game, competition or other activity that requires personal data, that data must not exceed what participation needs.
Article 14 requires the data protection officer and the staff under their supervision to follow the information security plans, policies and procedures the Authority sets.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .