Law No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties

Law No. 12 of 2024, arts. 19-26, 31, 34-39, 43 (Authority, complaints, fines and offences)

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171

In force since 1 Jan 2025.

An enforcement supervision rule binding public and private bodies.

Enforcement body: Personal Data Protection Authority
Obligation class: Governance, Reporting
Audit expectation: on_request
Who audits it: Regulator

What it requires

Expect the Authority to license, inspect and receive complaints against you as a controller or processor, and to be able to order you to stop and remove the effects of any violation of this law.
Comply with a stop order the Director General serves within the period it specifies, or expect the Board to warn of, suspend, or revoke your license, permit or accreditation, publish the violation at your expense, or place you under the Authority's technical supervision.NIST Privacy FrameworkGV.PO-P5
Respond within seven working days to a decision the Authority issues on a data subject's complaint against you, after the Authority has decided the complaint within thirty days of it being filed.NIST Privacy FrameworkGV.MT-P7
Provide the Authority with any reports, statistics or information it requests about your personal data protection activities.NIST Privacy FrameworkGV.MT-P4
Expect an administrative fine of up to 15,000,000 Syrian Pounds for failing your registration, security, breach notification, data protection officer, or request-handling duties, or for a marketing or licensing violation, on top of the criminal penalties this law sets.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
GV.MT-P4Policies, processes, and procedures for communicating progress on managing privacy risks are established and in place.
GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Collecting personal data without meeting the article 4 criteria is punished with imprisonment from one to six months and a fine from 1,000,000 to 3,000,000 Syrian Pounds (art. 37(a)). Collecting, processing, disclosing, making available, circulating, storing, transferring, keeping or deleting personal data without the data subject's consent, or otherwise unlawfully, is punished with imprisonment from one to six months and a fine from 5,000,000 to 7,000,000 Syrian Pounds (art. 37(b)), rising to imprisonment from six months to two years and a fine from 7,000,000 to 10,000,000 Syrian Pounds where the act was done for material or moral gain, to expose the data subject to danger or harm, or where the data was sensitive personal data (art. 37(c)). Failing the article 8 breach notification duties is punished with imprisonment from three months to two years and a fine from 7,000,000 to 10,000,000 Syrian Pounds (art. 37(d)). Violating the cross-border transfer rules in articles 15 and 16 is punished with imprisonment from three to seven years and a fine from 10,000,000 to 20,000,000 Syrian Pounds (art. 37(e)). Practicing a licensed activity before obtaining the license is punished with imprisonment from one to three years and a fine from 7,000,000 to 12,000,000 Syrian Pounds (art. 37(f)), and obstructing an Authority officer with judicial police powers is punished with imprisonment from one to three months and a fine from 5,000,000 to 7,000,000 Syrian Pounds (art. 37(g)).

Penalty structure

Article 37(e) sets the highest criminal fine, 10,000,000 to 20,000,000 Syrian Pounds plus imprisonment from three to seven years, for violating the cross-border transfer rules of articles 15 and 16; other article 37 offences carry lower fixed tiers from 1,000,000 to 12,000,000 Syrian Pounds, and article 36 sets separate administrative fines from 1,000,000 to 15,000,000 Syrian Pounds for specific registration, security and marketing failures.

Rule: Fixed only
As of: 19 September 2026
Currency: SYP
Fixed cap: 20,000,000

What it makes you log

Who may demand the log

Regulator

Logging duty

These articles set up the Personal Data Protection Authority, its board and director, the 30-day complaint procedure and the stop order, fines, offences and publication of a conviction. They require no log or register of a controller. The Authority may inspect and supervise (Article 19(c)(12)), its staff may enter a licensee's premises (Article 35(c)) and public and private bodies must supply the reports and information it asks for (Article 43), so a check waits on the Authority choosing to ask; no record, auditor, report or retention period is named. The party complained against must tell the Authority it has carried out a decision (Article 34(c)), which is a report and not a log. The cited articles state no territorial scope clause.

Kind: None
As of: 28 October 2026

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 19 establishes the Personal Data Protection Authority as a public body with legal personality and financial and administrative independence, seated in Damascus and linked to the Minister of Communications and Technology, with the power to set data protection policy, license and inspect controllers and processors, receive complaints and notifications, verify cross-border data movement, and issue an annual report on personal data protection in Syria.

Articles 20 to 26 place the Authority under a Board of Directors chaired by the Minister and a Director General, both appointed by decree, bar Board members and staff from disclosing any document or data from a case under the Authority's review, and let the Authority cooperate with foreign counterparts to verify a controller's or processor's compliance abroad.

Article 31 lets the Director General, on any violation of the law other than a licensing violation under article 30, order the violator to stop and remove its cause, and lets the Board, if that order is not obeyed, warn of, partially or wholly suspend, or partially or wholly revoke the violator's license, permit or accreditation, publish the violation in the media at the violator's expense, or place the violator under the Authority's technical supervision.

Article 34 gives a data subject the right to complain to the Authority over an infringement of their personal data rights, a refusal to let them exercise those rights, or a decision their controller's or processor's data protection officer made on their request, and requires the Authority to decide the complaint within thirty days and the party complained against to comply within seven working days of being notified.

Article 35 lets the Minister assign Authority staff judicial police powers to enter a licensee's premises, record violations, and seize any material or means used to commit one.

Article 36 sets administrative fines from 1,000,000 to 15,000,000 Syrian Pounds for a controller's or processor's specific failures under articles 3, 5, 6, 9, 10 and 11, for a marketing violation of articles 17 and 18, for an Authority board member's or staff member's breach of article 23, and for violating the terms of a license, permit or accreditation.

Article 37 punishes unlawfully collecting, processing, disclosing, storing, transferring or deleting personal data with imprisonment from one month to two years and a fine from 1,000,000 to 10,000,000 Syrian Pounds, rising to imprisonment from three to seven years and a fine from 10,000,000 to 20,000,000 Syrian Pounds for violating the cross-border transfer rules in articles 15 and 16, and punishes practicing an activity that needs the Authority's license before obtaining it, and obstructing an Authority officer with judicial police powers.

Article 43 requires every public and private entity to provide the Authority with any reports, statistics or information it requests about the Authority's personal data protection activities.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.