Law No. 12 of 2024 on Protection of Electronic Personal Data, sensitive personal data

Law No. 12 of 2024, arts. 13-14 (sensitive personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2025.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process sensitive personal data, including a psychological, mental, physical or genetic health condition or a biometric identifier such as a voiceprint or faceprint, without a license or permit from the Personal Data Protection Authority.
Obtain the data subject's written and explicit consent before processing their sensitive personal data, unless a legally authorized case applies.
Obtain the consent of a child's legal guardian before processing a child's personal data, and where a child takes part in a game, competition or other activity that calls for personal data, collect no more than participation requires.
Follow the information security plans, policies and procedures the Authority sets for protecting sensitive personal data, through your data protection officer and the staff under their supervision.

What it reaches

Obligation class

Prohibition, Consent, Biometric, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 13(a) prohibits a controller or processor, whether a natural or legal person, from processing sensitive personal data except with a license or permit from the Authority. Article 1 defines sensitive personal data as data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious belief, political opinion, or criminal status, and data belonging to a child or to a person lacking legal capacity.

Article 13(b) requires written and explicit consent from the data subject before processing sensitive personal data, except in cases the law permits. Article 13(c) requires the consent of a child's legal guardian for any operation involving a child's data, and where a child takes part in a game, competition or other activity that requires personal data, that data must not exceed what participation needs.

Article 14 requires the data protection officer and the staff under their supervision to follow the information security plans, policies and procedures the Authority sets.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
serves_minors
handles_health_records

Read the law

Law No. 12 of 2024, full Arabic text as posted by the Syrian Ministry of Communications and Technology, read from an archived capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app