Law note · Jordan
Personal Data Protection Law, enforcement and data subject remedies
What it requires
- An app processing the personal data of an individual in Jordan risks administrative sanctions (warning, licence suspension or revocation, or a fine up to 3% of prior-year revenue) and criminal fines from 1,000 to 10,000 Dinars for a violation; a data subject harmed by a grossly negligent breach may recover compensation directly from the Controller under Art. 20(B), and after a criminal conviction, the affected party may petition the court to order the data destroyed or the database cancelled under Art. 22(B), a narrow, trigger-specific remedy rather than a blanket private right of action.
When LexLint raises it
crawls_webtrains_modelsgenerates_contentdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometrics
- Private right of action
- Yes
What we found
Article 21 is administrative: for a violation, the Unit issues a warning first, and if uncured, the Council may impose licence suspension or revocation, or a fine up to 500 Dinars per day of continuing violation, capped at 3% of the violator's prior-fiscal-year annual revenue, and the Unit may publish a statement of proven violations at the violator's expense.
Article 22 is criminal-adjacent: a fine of 1,000 to 10,000 Dinars, doubled on repeat violation, without prejudice to any stricter penalty elsewhere in Jordanian law. Article 22(B), read verbatim, lets the relevant court, on request of the public prosecution, the affected party, or its own initiative, order the destruction of data or the cancellation of a database following a final conviction, naming the affected data subject as a party with standing to petition alongside the public prosecution.
Combined with Article 20(B)'s compensation clause, Jordan is the clearest case in this batch of a statute naming the data subject as a party with standing to seek a remedy, though neither clause is a freestanding tort-style private right of action: both are narrower and tied to specific triggers, compensation for gross-negligence breach harm, and a court petition following a criminal conviction, rather than a blanket civil cause of action.