LexLint

Know the law where your app runs.

Law / Jordan

Cyber Security Law No. 16 of 2019, Article 8 private-sector incident-reporting and Center-cooperation duty

Cyber Security Law No. (16) of 2019, Article 8(b)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force.

A vulnerability and incident reporting rule binding public and private bodies.

As of 16 September 2026.

What it requires

  • This binds any ministry, government department, or official, public, private, or civil institution operating in Jordan; the National Cyber Security Center's own subsidiary instructions define the bound entity to include any company or individually registered establishment in the Kingdom, and the duty carries no sector, size, or personal-data gate of its own.
  • Adhere to the policies, standards, and controls the Center issues for the institution's own sector, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity or the security of cyberspace, taking every step necessary to prevent or avoid it.
  • Where the incident is Critical or High severity, in particular where it touches critical infrastructure, a security or military body, a ministry or government institution, a government-owned or government-invested company, a supply chain feeding those entities, or where it disrupts essential services entirely at a higher-education institution, the Center's own Incident Response and Reporting Policy sets a reporting clock as short as 30 minutes for a Critical-tier incident, rising through roughly 1 hour for High, 4 hours for Medium, and 1 day for Low; an ordinary private company or individual establishment with no such touchpoint is typically classified Medium or Low.
  • Where the National Cyber Security Council designates an incident a threat to the Kingdom's own security and safety, the Center directs the response and every institution involved must comply with the Center's instructions and directives.
  • A violation may draw a written warning, an order to correct the violation and reimburse the Center's resulting costs, blocking, cancellation, confiscation, or disabling of the offending network, system, or device, a requirement that the institution take legal measures against a responsible employee, suspension or cancellation of a cybersecurity-services license, or a fine of between 500 and 100,000 Jordanian dinars doubled for a repeated violation, imposed by the Center itself rather than through a private lawsuit.

If you get it wrong

Criminal exposureNo

Private right of actionNo

Penalty structure

Article 16(a)(6): a fine of not less than 500 and not more than 100,000 Jordanian dinars per violation, doubled for a repeated violation. The Center's own 2025 instructions further grade the fine within this range, both by the type of violation and, for a violation tied to an actual incident, by that incident's own severity tier (up to a 50,000-to-100,000-dinar band where the incident is classified Severe).

Rule
Per violation only
As of
16 September 2026
Minimum
500
Currency
JOD
Per violation unit
Violation
Per violation amount
100,000

Who enforces it

Enforcement body

The National Cyber Security Center, which under Article 16(a) may take one or more of the listed measures against any violator of the Law and its subsidiary regulations, instructions and decisions.

What it reaches

Obligation class

Reporting, Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Any ministry, government department, or official, public, private, or civil institution must adhere to the National Cyber Security Center's sector-specific policies, standards and controls, provide the Center the information it needs to do its work, and inform the Center of any incident that threatens cybersecurity, taking every step necessary to prevent or avoid it.

A violation may draw a written warning, a correction order, network or system blocking, license suspension, or a fine of between 500 and 100,000 Jordanian dinars doubled on repeat, imposed administratively by the Center rather than through a private lawsuit.

The Law is plainly in force, evidenced by the Center's own dated subsidiary instruments from 2020 through 2025, but its own text sets commencement only as the date of Official Gazette publication (Article 1) without stating that date, and neither the Center's English translation nor its Arabic original states a specific Gazette issue or date; the commencement day is left unset rather than guessed.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

National Cyber Security Center, unofficial English translation of Cyber Security Law No. 16 of 2019

Back to the example  ·  Lint your app