LexLint

Know the law your code answers to.

Law / Lebanon

Law No. 81/2018, Part V, penal provisions and supervision

Law No. 81/2018 Arts. 102 and 106 to 109 (penal provisions and the court remedy), with the Ministry of Economy and Trade's role under Arts. 95 to 98

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 31 March 2019.

An enforcement supervision rule binding public and private bodies.

As of 19 September 2026.

What it requires

  • Expect a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or one of those two penalties, for processing personal data without a filed permit or a prior licence, for collecting or processing it outside the Section II rules, or for disclosing personal data under processing to unauthorized persons, even negligently.
  • Expect a fine of one million to fifteen million Lebanese Pounds for refusing to answer a person's access or correction request within ten working days, or for answering it incorrectly or imperfectly.
  • Expect both fines and prison terms to rise by one third to one half where the act recurs.
  • Expect the owner of the personal data, or any of their heirs, to bring you before the competent courts, in particular the Magistrate of Summary Justice, to compel the right of access and correction.
  • Note that prosecution for disclosing data to unauthorized persons and for refusing an access or correction request starts only on the complaint of the injured party, and ends if that party waives the personal right before the judgment becomes final.
  • Deal with the Ministry of Economy and Trade for a permit and with the Minister of Public Health, the Minister of Justice, or the Minister of National Defence and the Minister of Interior and Municipalities for a licence: Law 81/2018 creates no independent data protection authority.

If you get it wrong

Criminal exposureYes

Private right of actionNo

Criminal exposure note

Processing personal data without filing a permit or obtaining a prior licence, collecting or processing personal data outside the Section II rules, or disclosing personal data under processing to unauthorized persons even negligently, is punished with a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or with one of those two penalties (Art. 106). Refusing to answer an access or correction request within ten working days, or answering it incorrectly or imperfectly, is punished with a fine of one million to fifteen million Lebanese Pounds (Art. 107). Both rise by one third to one half on recurrence (Art. 108), and prosecution for the disclosure offence and the refusal offence requires a complaint by the injured party (Art. 109).

Penalty structure

Art. 106 sets the top Part V fine at thirty million Lebanese Pounds, with imprisonment of three months to three years available alongside or instead of it, for unlicensed or unpermitted processing, for processing outside the Section II rules, and for disclosing personal data to unauthorized persons. Art. 107 sets a lower ceiling of fifteen million Lebanese Pounds for refusing or botching an access or correction response. Art. 108 raises both by one third to one half on recurrence, so a repeat offence under Art. 106 reaches forty-five million Lebanese Pounds. The law states no turnover-based penalty and no administrative fine, and the figures are nominal 2018 Lebanese Pounds, unindexed.

Rule
Fixed only
As of
19 September 2026
Currency
LBP
Fixed cap
30,000,000

Who enforces it

Enforcement body

Ministry of Economy and Trade, which receives permits under Art. 95 and publishes the register under Art. 98; licences under Art. 97 are issued by the Minister of National Defence and the Minister of Interior and Municipalities, the Minister of Justice, or the Minister of Public Health according to the category of data. Law No. 81/2018 establishes no independent data protection authority.

What it reaches

Obligation class

Governance, Licensing

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 106 punishes three things with a fine of one million to thirty million Lebanese Pounds and imprisonment of three months to three years, or with one of those two penalties: processing personal data without filing a permit or obtaining a prior licence before starting work, collecting or processing personal data outside the rules of Section II, and disclosing personal data under processing to unauthorized persons, even negligently.

Article 107 punishes a processing officer who refuses to answer a person's access or correction request within ten working days, or answers it incorrectly or imperfectly, with a fine of one million to fifteen million Lebanese Pounds.

Article 108 raises the penalties and fines by one third to one half where the act recurs, and Article 109 makes prosecution for the disclosure offence and for the refusal offence turn on a complaint by the injured party, the general right lapsing with the personal right where the waiver comes before the judgment becomes final.

Article 102 gives the owner of the personal data, or any of their heirs, access to the competent courts and in particular to the Magistrate of Summary Justice to enforce the right of access and correction, which is a procedural remedy rather than a general claim for damages.

Supervision itself is administrative and not independent: Law 81/2018 creates no data protection authority, and the permit function sits with the Ministry of Economy and Trade under Article 95, the licence function with the Minister of National Defence and the Minister of Interior and Municipalities, the Minister of Justice and the Minister of Public Health under Article 97, and the public register of permits and licences with the Ministry under Article 98.

Article 136 makes the law effective three months after its publication in the Official Gazette, so these provisions bind today.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • high_risk_decisions
  • handles_health_records
  • provides_telecom_services

Read the law

official English translation of the Official Gazette text, hosted by SMEX

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app