Law note · Jordan

Personal Data Protection Law, breach notification

cite Law No. 24 of 2023, Art. 20 stage IN FORCE in force since 2024-03-17 kind Breach notification binds public and private bodies reviewed 2026-08-29

What it requires

An app that suffers a serious breach of data security or safety that could cause significant harm to an individual in Jordan must notify the affected individuals within 24 hours of discovery and must notify the Unit within 72 hours of discovery with the source, mechanism, and affected individuals; a Controller found grossly negligent or engaged in misconduct in a breach is liable to compensate the affected Data Subject.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice

What we found

Article 20(A) requires the Controller, on discovering a serious breach of data security and safety that could cause significant harm to the Data Subject, to notify the affected Data Subjects within 24 hours of discovery, and to notify the Unit (MoDEE's internal data-protection unit) within 72 hours of discovery about the breach's source, mechanism, affected Data Subjects, and any other available related information. This is a materiality-gated duty with two distinct fixed timelines.

Article 20(B) separately makes the Controller liable to compensate the affected Data Subject in case of gross negligence or misconduct, a direct statutory compensation right tied to a breach.

Primary source

official bilingual statute text, Ministry of Digital Economy and Entrepreneurship

← Back to the example · Lint your app →