SyriaLaw No. 12 of 2024 on Protection of Electronic Personal Data
Law No. 12 of 2024 (Syrian Arab Republic) arts. 1-2, 4-7, 9-10, 12, 27-30, 40, 45 (definitions, lawful processing, controller and processor obligations, licensing and scope)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Consent, Governance, Security, Retention, Licensing
- Audit expectation
- periodic
- Who audits it
- Self, Regulator
- Where the report goes
- Kept
What it requires
- Determine a lawful basis under one of the grounds article 7 lists before processing personal data, such as the data subject's consent to a specific purpose, a contractual or legal obligation, or a court order.NIST Privacy FrameworkCT.PO-P1
- Obtain a license or permit from the Personal Data Protection Authority before collecting, storing, transferring or processing personal data, and appoint a local representative if you are established outside Syria.NIST Privacy FrameworkGV.PO-P5
- Collect personal data only for legitimate and specific purposes, process it in a manner appropriate to those purposes, and do not retain it longer than the purpose requires unless the retention is for archiving in the public interest or for scientific, historical or statistical purposes.NIST Privacy FrameworkGV.PO-P1
- Take the technical and organizational security measures the Authority approves to protect personal data against unauthorized or unlawful processing and against loss or damage, and appoint a data protection officer, registered with the Authority, if you are a legal person.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkGV.PO-P3
- Keep a register describing the categories of personal data you hold, who you disclose it to, the retention periods, and any cross border transfer, and make it available for the Authority's inspection.NIST Privacy FrameworkID.IM-P4
- Erase personal data once the purpose for holding it lapses, unless a lawful reason permits retention, in which case keep it in a form that no longer identifies the data subject.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
1 more
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which kind of license or permit from the Authority must a developer outside Syria hold, given that Article 27 leaves it to the Authority to classify and grant them: تقوم الهيئة بتصنيف ومنح التراخيص والتصاريح والاعتماديات وتحديد أنواعها ("the Authority classifies and grants licenses, permits and accreditations and determines their types")?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Logging duty
Article 5(a)(12) requires a controller to keep a special register describing the categories of personal data it holds, to whom they are disclosed and on what basis, the retention periods, the erasure and amendment mechanisms, any cross-border transfer and the security measures; Article 6(a)(10) requires a processor to keep a register of its processing. Article 5(a)(6) separately requires the controller to prove the data subject's consent where processing rests on it, so a consent record is also needed. Article 5(a)(13) requires the means to prove compliance and to let the Authority inspect, and Article 10(a) has the data protection officer assess the protection systems periodically and document the results; no interval is fixed. The register contents are categories, recipients and periods, which the log-content vocabulary does not name, so only the consent state is coded. Article 2(c) speaks of the data of Syrian citizens and Article 5(a)(7) asks a controller outside Syria to appoint a local representative; the first is a nationality test and the second states no test for when the Law reaches a foreign controller, so no hook is coded.
- Kind
- Explicit
- As of
- Provision
- Article 5(a)(12) (special register of data categories, recipients, periods and erasure mechanisms), with Article 5(a)(6) (proof of consent) and Article 6(a)(10) (processor register)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Law No. 12 of 2024 on Protection of Electronic Personal Data regulates the electronic collection, processing, use and transfer of personal data in Syria. Article 46 enters the law into force from , and it was signed by presidential decree in Damascus on .
Article 1 defines sensitive personal data as data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious belief, political opinion, criminal status, or a child's or an incapacitated person's data, a controller as whoever determines how data is retained and processed, and a processor as whoever processes data on the controller's behalf.
Article 4 requires personal data to be collected for legitimate and specific purposes, processed in a manner suited to those purposes, kept no longer than the purpose requires unless the retention serves public interest archiving or scientific, historical or statistical purposes, and secured against unauthorized or unlawful processing and against loss or damage.
Article 7 makes processing lawful only where the data subject consents to a specific purpose, the processing performs a contractual or legal obligation or pursues a legal claim, a court decision requires it, it lets the controller or processor meet an obligation without conflicting with the data subject's rights, it rests on accurate and updated data, it causes the data subject no direct or indirect harm, or it preserves the data's confidentiality and integrity.
Article 5 requires a controller to obtain the data subject's consent before collecting personal data, obtain a license or permit from the Authority to deal with it, take the Authority's approved technical and organizational security measures, appoint a local representative if established outside Syria, erase personal data once its purpose lapses, and keep a register of the categories held, the recipients, the retention periods and any cross border transfer.
Article 6 places the equivalent obligations on a processor, including a bar on engaging a sub-processor without the controller's prior consent. Articles 9 and 10 require a controller or processor that is a legal person to appoint a data protection officer, registered with the Authority and announced on its website, responsible for periodic assessment of the protection systems, coordinating with the Authority, enabling the data subject's rights, and reporting any breach to the Authority.
Articles 27 to 30 make a license, permit or accreditation from the Authority a precondition for collecting, storing, transferring or processing electronic personal data, and let the Authority amend or revoke one for breach of its conditions, non-payment of fees, an unauthorized transfer to another party, or the holder's bankruptcy.
Article 40 exempts processing by a natural person for purely personal activity not disclosed to others, official statistics, accurate media or scientific work that does not target a decision, an action or a rights violation, national security, public order or crime prevention, judicial records and proceedings, and disaster or epidemic data exchange between states or ministries, and bars retaining data once its processing purpose has lapsed unless another law states otherwise.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .