Law No. 12 of 2024 on Protection of Electronic Personal Data, cross border transfer

Law No. 12 of 2024, arts. 15-16 (cross-border transfer of personal data)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2025.

A cross border transfer rule binding public and private bodies.

As of 19 September 2026.

What it requires

Obtain the Authority's license and verify that the destination Arab or foreign state offers an acceptable level of protection before transferring, storing abroad, or sharing personal data with a party there.
Where the destination state lacks a verified protection level, transfer personal data only with the data subject's or their representative's explicit consent and only for one of the purposes article 15(b) lists, such as preserving the data subject's life, defending a legal right, or performing a contract for their benefit.
Obtain the Authority's license before making personal data available to another controller or processor outside Syria, and confirm that its legal and technical protection level meets the level set in the law's executive instructions.

What it reaches

Obligation class

Transfer, Licensing

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 15(a) prohibits transferring, preparing to process, storing or sharing personal data with an Arab or foreign state unless the Authority has verified an acceptable level of protection there and licensed the transfer.

Article 15(b) lets a transfer proceed with the data subject's or their representative's explicit consent, even to a state lacking that verified protection level, only to preserve the data subject's life or provide medical care, to establish or defend a legal right before a competent judicial body, to conclude or perform a contract for the data subject's benefit, to carry out a judicial cooperation procedure, to meet a legal obligation protecting the public interest, or to perform a bilateral or multilateral international agreement Syria has joined.

Article 16 lets a controller or processor make personal data available to another controller or processor outside Syria, with the Authority's license, only where the nature of their work or the purpose for which they hold the data agree, both sides have a legitimate interest in the data, and the foreign controller's or processor's legal and technical protection is not below the level the law's executive instructions set.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
processes_biometrics
processes_voice

Read the law

Law No. 12 of 2024, full Arabic text as posted by the Syrian Ministry of Communications and Technology, read from an archived capture

archived copy

Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app