SyriaLaw No. 12 of 2024 on Protection of Electronic Personal Data, rights of data subjects and electronic marketing
Law No. 12 of 2024, arts. 3, 11, 17-18, 33 (rights, requests and electronic marketing)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure, Consent
- Audit expectation
- none
What it requires
- Do not process, disclose or divulge personal data without the data subject's explicit consent, unless a legally authorized case applies.NIST Privacy FrameworkCT.PO-P1
- Tell a data subject, on request, the nature, purpose and method of processing their personal data and the retention period or how it is set, and let them access their own data, withdraw a prior consent without retroactive effect, correct, delete, add to or update it, confine your processing to a defined purpose, and object to processing that violates their constitutional rights.NIST Privacy FrameworkCT.PO-P3
- Decide a request to make a data subject's personal data available within five working days of registering it, and give reasons in writing for any refusal.NIST Privacy FrameworkCT.DM-P1
- Answer any other request from a data subject to exercise a right under this law within seven working days of its submission.NIST Privacy FrameworkCT.PO-P3
- Obtain a data subject's consent, identify yourself as sender, give a correct return address, and label the message as direct marketing before sending any electronic marketing contact, and give the data subject a clear and easy way to refuse it or withdraw consent.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCT.PO-P3
- Keep electronic records of a data subject's marketing consent, its amendments, or their non-objection to continued contact, for three years from the date you last sent them a marketing message.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P1Data elements can be accessed for review.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
What the log must hold
Consent or opt-out state
Log retention
Three years counted from the date of the last marketing message sent to the data subject.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Article 18(c) requires a sender of direct electronic marketing to keep electronic records proving the data subject's consent and its amendments, or that the person did not object to continued contact, for three years from the last message sent. The duty binds the marketing sender, not every controller. Articles 3 and 33 (rights and the seven-day reply) and Article 11 (a request to make data available is decided within five working days on the evidence attached to it) add no further record. The Authority's inspection power is in Article 19(c) and Article 35, outside the cited articles, so no auditor or access is coded on this row. The cited articles state no territorial test.
- Kind
- Explicit
- As of
- Provision
- Article 18(c) (electronic records of consent, amendments or non-objection kept for three years from the last marketing message)
- Trigger
- consent_or_optout
What this law does
Article 3(a) bars processing, disclosing or divulging personal data without the data subject's explicit consent or a case the law authorizes.
Article 3(b) gives the data subject the right to know the nature, purpose and method of any processing of their personal data, to access or obtain their personal data held by a controller or processor, to learn the retention period or the criteria used to set it, to withdraw a prior consent without retroactive effect, to correct, amend, delete, add to or update their personal data, to confine processing to a defined purpose or scope, to be told of any breach of their personal data, to object to processing or its results where it violates their constitutional rights and freedoms, and to file a complaint with the Authority.
Article 11 requires a controller or processor to decide a request to make personal data available within five working days of registering it, verifying the legal justification the requester attaches, and to give reasons for any refusal. Article 33 requires whoever receives a request from a data subject to exercise a right under the law to respond within seven working days of its submission.
Article 17 bars a sender from making electronic contact with a data subject for marketing without the data subject's consent, an identified originator and sender, a correct and sufficient return address, a statement that the contact is for direct marketing, and a clear and easy mechanism for the data subject to refuse the contact or withdraw consent to it.
Article 18 requires a marketing sender to keep to the stated marketing purpose, not disclose the data subject's contact data, and retain electronic records of the data subject's consent, its amendments, or their non-objection to continued marketing contact for three years from the last message sent.
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .