Syria

Article 8 requires a controller or processor, on becoming aware of a breach of the personal data in its possession, to notify the Authority immediately, and where the breach concerns national security matters, the Authority must immediately notify the competent authorities of the incident.

Article 8(b) requires the controller or processor to provide the Authority, within seventy two hours of becoming aware of the breach, with a description of its nature, form and causes, the approximate number of records, persons and categories affected, the data protection officer's details, the breach's likely effects, the measures taken or proposed to address it, documentation of the breach and the corrective steps taken, and any further document, information or data the Authority requests.

Article 8(c) requires the controller and processor to tell the data subject, within three working days of the date the Authority was notified, what measures have been taken.

Law No. 12 of 2024 on Protection of Electronic Personal Data regulates the electronic collection, processing, use and transfer of personal data in Syria. Article 46 enters the law into force from 1 January 2025, and it was signed by presidential decree in Damascus on 28 March 2024.

Article 1 defines sensitive personal data as data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious belief, political opinion, criminal status, or a child's or an incapacitated person's data, a controller as whoever determines how data is retained and processed, and a processor as whoever processes data on the controller's behalf.

Article 4 requires personal data to be collected for legitimate and specific purposes, processed in a manner suited to those purposes, kept no longer than the purpose requires unless the retention serves public interest archiving or scientific, historical or statistical purposes, and secured against unauthorized or unlawful processing and against loss or damage.

Article 7 makes processing lawful only where the data subject consents to a specific purpose, the processing performs a contractual or legal obligation or pursues a legal claim, a court decision requires it, it lets the controller or processor meet an obligation without conflicting with the data subject's rights, it rests on accurate and updated data, it causes the data subject no direct or indirect harm, or it preserves the data's confidentiality and integrity.

Article 5 requires a controller to obtain the data subject's consent before collecting personal data, obtain a license or permit from the Authority to deal with it, take the Authority's approved technical and organizational security measures, appoint a local representative if established outside Syria, erase personal data once its purpose lapses, and keep a register of the categories held, the recipients, the retention periods and any cross border transfer.

Article 6 places the equivalent obligations on a processor, including a bar on engaging a sub-processor without the controller's prior consent. Articles 9 and 10 require a controller or processor that is a legal person to appoint a data protection officer, registered with the Authority and announced on its website, responsible for periodic assessment of the protection systems, coordinating with the Authority, enabling the data subject's rights, and reporting any breach to the Authority.

Articles 27 to 30 make a license, permit or accreditation from the Authority a precondition for collecting, storing, transferring or processing electronic personal data, and let the Authority amend or revoke one for breach of its conditions, non-payment of fees, an unauthorized transfer to another party, or the holder's bankruptcy.

Article 40 exempts processing by a natural person for purely personal activity not disclosed to others, official statistics, accurate media or scientific work that does not target a decision, an action or a rights violation, national security, public order or crime prevention, judicial records and proceedings, and disaster or epidemic data exchange between states or ministries, and bars retaining data once its processing purpose has lapsed unless another law states otherwise.

Article 15(a) prohibits transferring, preparing to process, storing or sharing personal data with an Arab or foreign state unless the Authority has verified an acceptable level of protection there and licensed the transfer.

Article 15(b) lets a transfer proceed with the data subject's or their representative's explicit consent, even to a state lacking that verified protection level, only to preserve the data subject's life or provide medical care, to establish or defend a legal right before a competent judicial body, to conclude or perform a contract for the data subject's benefit, to carry out a judicial cooperation procedure, to meet a legal obligation protecting the public interest, or to perform a bilateral or multilateral international agreement Syria has joined.

Article 16 lets a controller or processor make personal data available to another controller or processor outside Syria, with the Authority's license, only where the nature of their work or the purpose for which they hold the data agree, both sides have a legitimate interest in the data, and the foreign controller's or processor's legal and technical protection is not below the level the law's executive instructions set.

Article 3(a) bars processing, disclosing or divulging personal data without the data subject's explicit consent or a case the law authorizes.

Article 3(b) gives the data subject the right to know the nature, purpose and method of any processing of their personal data, to access or obtain their personal data held by a controller or processor, to learn the retention period or the criteria used to set it, to withdraw a prior consent without retroactive effect, to correct, amend, delete, add to or update their personal data, to confine processing to a defined purpose or scope, to be told of any breach of their personal data, to object to processing or its results where it violates their constitutional rights and freedoms, and to file a complaint with the Authority.

Article 11 requires a controller or processor to decide a request to make personal data available within five working days of registering it, verifying the legal justification the requester attaches, and to give reasons for any refusal. Article 33 requires whoever receives a request from a data subject to exercise a right under the law to respond within seven working days of its submission.

Article 17 bars a sender from making electronic contact with a data subject for marketing without the data subject's consent, an identified originator and sender, a correct and sufficient return address, a statement that the contact is for direct marketing, and a clear and easy mechanism for the data subject to refuse the contact or withdraw consent to it.

Article 18 requires a marketing sender to keep to the stated marketing purpose, not disclose the data subject's contact data, and retain electronic records of the data subject's consent, its amendments, or their non-objection to continued marketing contact for three years from the last message sent.

Article 19 establishes the Personal Data Protection Authority as a public body with legal personality and financial and administrative independence, seated in Damascus and linked to the Minister of Communications and Technology, with the power to set data protection policy, license and inspect controllers and processors, receive complaints and notifications, verify cross-border data movement, and issue an annual report on personal data protection in Syria.

Articles 20 to 26 place the Authority under a Board of Directors chaired by the Minister and a Director General, both appointed by decree, bar Board members and staff from disclosing any document or data from a case under the Authority's review, and let the Authority cooperate with foreign counterparts to verify a controller's or processor's compliance abroad.

Article 31 lets the Director General, on any violation of the law other than a licensing violation under article 30, order the violator to stop and remove its cause, and lets the Board, if that order is not obeyed, warn of, partially or wholly suspend, or partially or wholly revoke the violator's license, permit or accreditation, publish the violation in the media at the violator's expense, or place the violator under the Authority's technical supervision.

Article 34 gives a data subject the right to complain to the Authority over an infringement of their personal data rights, a refusal to let them exercise those rights, or a decision their controller's or processor's data protection officer made on their request, and requires the Authority to decide the complaint within thirty days and the party complained against to comply within seven working days of being notified.

Article 35 lets the Minister assign Authority staff judicial police powers to enter a licensee's premises, record violations, and seize any material or means used to commit one.

Article 36 sets administrative fines from 1,000,000 to 15,000,000 Syrian Pounds for a controller's or processor's specific failures under articles 3, 5, 6, 9, 10 and 11, for a marketing violation of articles 17 and 18, for an Authority board member's or staff member's breach of article 23, and for violating the terms of a license, permit or accreditation.

Article 37 punishes unlawfully collecting, processing, disclosing, storing, transferring or deleting personal data with imprisonment from one month to two years and a fine from 1,000,000 to 10,000,000 Syrian Pounds, rising to imprisonment from three to seven years and a fine from 10,000,000 to 20,000,000 Syrian Pounds for violating the cross-border transfer rules in articles 15 and 16, and punishes practicing an activity that needs the Authority's license before obtaining it, and obstructing an Authority officer with judicial police powers.

Article 43 requires every public and private entity to provide the Authority with any reports, statistics or information it requests about the Authority's personal data protection activities.

Article 13(a) prohibits a controller or processor, whether a natural or legal person, from processing sensitive personal data except with a license or permit from the Authority. Article 1 defines sensitive personal data as data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious belief, political opinion, or criminal status, and data belonging to a child or to a person lacking legal capacity.

Article 13(b) requires written and explicit consent from the data subject before processing sensitive personal data, except in cases the law permits. Article 13(c) requires the consent of a child's legal guardian for any operation involving a child's data, and where a child takes part in a game, competition or other activity that requires personal data, that data must not exceed what participation needs.

Article 14 requires the data protection officer and the staff under their supervision to follow the information security plans, policies and procedures the Authority sets.

Article 40 permits the legitimate holder of a copy of a computer program to make backup copies where the original is lost or unusable, to port the copy to a new computing environment where necessary for compatibility and limited to the holder's own private use, and to convert a work's format to serve persons with special needs.

The same article separately permits a licensee of a database to carry out all acts necessary to access the database's content for the licensee's own use without the database author's authorization, and permits the legitimate holder of a database, without the author's authorization and without compensation, to copy and reproduce a non-electronic database for private purposes, to use it exclusively for illustration in education or scientific research with the source identified, or to use it for public-security or administrative and judicial-procedure purposes.

None of these exceptions is a general text-and-data-mining exception or a machine-readable opt-out mechanism of the kind the European Union's Digital Single Market Directive creates: each is scoped to a named, narrow purpose, and none authorizes copying a copyrighted work, or extracting and reusing the contents of a protected database, for the purpose of training a machine-learning model.

The Law protects a database as a derivative work only where its selection or arrangement is an original intellectual creation, which is a compilation-copyright standard rather than a sui generis database right of the kind the European Union's Database Directive creates. Article 3 of the decree issuing the Law puts it in force six months after its publication in the Official Gazette, and no Gazette notice giving the publication day has been located.

Article 1 defines a child as anyone who has not completed eighteen years of age. Article 34 prohibits an operator of an establishment providing internet access service from allowing a child to access pornographic or indecent websites. Article 35 separately directs the State, not the establishment operator, to take measures preventing children's access to websites that incite violence, racial discrimination, hatred, religious contempt, intolerance, or pornography generally.

Article 60 penalizes a violation of Article 34 with imprisonment of one to three months and a fine of 100,000 to 300,000 Syrian pounds. The Law's closing article provides only that it is published in the Official Gazette, and no commencement notice for it has been located.

Article 35 permits, without the author's authorization and without compensation, provided the source and the author's name are cited where they appear in the source: copying a short part of a published work for quotation in another work to the extent necessary for that purpose; using a published work for illustration in publications, sound or audiovisual recordings, and broadcast material for educational purposes, consistent with fair practice and to the extent necessary; and photocopying an article, short excerpts of a work, or a short work, previously lawfully published, for education within non-profit educational institutions, limited to a single copy and to the extent necessary.

Article 38 separately permits, without the author's or rights holder's authorization and without compensation, provided the source and the author's name are cited where they appear in the source: reproducing in a newspaper or periodical an economic, political, or religious article already published in a newspaper, or similar broadcast material, or transmitting that article or material to the public, in cases where the right to authorize reproduction or transmission has not been expressly reserved by the author or rights holder; reproducing and transmitting to the public, by photography, cinema, or radio or television broadcast, short excerpts of works seen or heard in the course of covering current events, to the extent the purpose justifies; and reproducing in a newspaper or periodical, or transmitting to the public, speeches, lectures, seminars, and talks delivered in public sessions of legislative or administrative bodies or public scientific, literary, artistic, political, social, or religious gatherings, including public judicial pleadings, to the extent informational purposes justify.

Neither article carries a headline-length or short-extract cap distinct from its own purpose-bound test, and Article 38's newspaper-to-newspaper reproduction permission operates as an opt-out mechanism, applying only where the source publication has not expressly reserved its reproduction right, rather than as a modern press-publisher neighbouring right.

No provision read addresses hyperlinking, framing, or inline display, and no reported Syrian decision applies either article to a systematic news aggregator rather than a newspaper, broadcaster, or individual quoting a published work. Article 3 of the decree issuing the Law puts it in force six months after its publication in the Official Gazette, and no Gazette notice giving the publication day has been located.

Article 96 punishes, with a fine of twenty thousand to one hundred thousand Syrian pounds, whoever transmits or publishes any media content without citing the source it was taken from, without prejudice to the injured party's right to seek compensation.

The Law defines media content broadly, as the body of information of interest to a recipient in the form of articles, news, investigations, programs, notes, comments, or similar material, and defines a media outlet to include an electronic media outlet and, specifically, a network communication outlet whose published media content is accessible to any individual over the network.

Article 96 is not conditioned on the reproduced content being protected by copyright and applies regardless of whether the source has reserved its rights, so it functions as a general attribution mandate on republication rather than a press-publisher neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates, and it carries no separate exclusive right, term, or licensing mechanism.

No provision read in this Law addresses hyperlinking, framing, or inline display, and no reported Syrian decision applies Article 96 to a systematic news aggregator. Article 4 of the decree issuing the Law puts it in force at the start of the month following its publication in the Official Gazette, and no Gazette notice giving the publication day has been located.