Law note · Jordan

Personal Data Protection Law, comprehensive regime and lawful basis

cite Law No. 24 of 2023, Arts. 1-2, 11 stage IN FORCE in force since 2024-03-17 kind Comprehensive regime binds public and private bodies reviewed 2026-08-29

What it requires

An app that collects, uses, or discloses the personal data of an individual in Jordan must obtain consent or rely on one of the Law's enumerated alternative bases, must confine retention to the processing purpose unless legislation specifies otherwise, and must appoint a data-protection lead if it processes Sensitive Personal Data or transfers personal data to a database outside Jordan.

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

What we found

The Personal Data Protection Law, 23 articles, is Jordan's first comprehensive personal-data statute.

Processing generally requires consent, with an enumerated list of alternative lawful bases covering medical necessity, vital-interest protection, crime prevention and prosecution, statutory or court-ordered disclosure, Central Bank-supervised entity functions, regulation-specified cases, scientific or historical research, statistical, national-security, or public-interest purposes, and publicly available data.

A Controller must appoint a data-protection lead in specified cases, including when processing Sensitive Personal Data or transferring to databases outside the Kingdom (Art. 11(A)(5)). A general storage-limitation principle applies to all processing: data "shall not be retained after the purpose of the Processing is fulfilled, unless otherwise specified by legislation."

Primary source

official bilingual statute text, Ministry of Digital Economy and Entrepreneurship

← Back to the example · Lint your app →