SyriaLaw No. 12 of 2024 on Protection of Electronic Personal Data, Authority, complaints and penalties
Law No. 12 of 2024, arts. 19-26, 31, 34-39, 43 (Authority, complaints, fines and offences)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 January 2025.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the Authority to license, inspect and receive complaints against you as a controller or processor, and to be able to order you to stop and remove the effects of any violation of this law.
- Comply with a stop order the Director General serves within the period it specifies, or expect the Board to warn of, suspend, or revoke your license, permit or accreditation, publish the violation at your expense, or place you under the Authority's technical supervision.
- Respond within seven working days to a decision the Authority issues on a data subject's complaint against you, after the Authority has decided the complaint within thirty days of it being filed.
- Provide the Authority with any reports, statistics or information it requests about your personal data protection activities.
- Expect an administrative fine of up to 15,000,000 Syrian Pounds for failing your registration, security, breach notification, data protection officer, or request-handling duties, or for a marketing or licensing violation, on top of the criminal penalties this law sets.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Collecting personal data without meeting the article 4 criteria is punished with imprisonment from one to six months and a fine from 1,000,000 to 3,000,000 Syrian Pounds (art. 37(a)). Collecting, processing, disclosing, making available, circulating, storing, transferring, keeping or deleting personal data without the data subject's consent, or otherwise unlawfully, is punished with imprisonment from one to six months and a fine from 5,000,000 to 7,000,000 Syrian Pounds (art. 37(b)), rising to imprisonment from six months to two years and a fine from 7,000,000 to 10,000,000 Syrian Pounds where the act was done for material or moral gain, to expose the data subject to danger or harm, or where the data was sensitive personal data (art. 37(c)). Failing the article 8 breach notification duties is punished with imprisonment from three months to two years and a fine from 7,000,000 to 10,000,000 Syrian Pounds (art. 37(d)). Violating the cross-border transfer rules in articles 15 and 16 is punished with imprisonment from three to seven years and a fine from 10,000,000 to 20,000,000 Syrian Pounds (art. 37(e)). Practicing a licensed activity before obtaining the license is punished with imprisonment from one to three years and a fine from 7,000,000 to 12,000,000 Syrian Pounds (art. 37(f)), and obstructing an Authority officer with judicial police powers is punished with imprisonment from one to three months and a fine from 5,000,000 to 7,000,000 Syrian Pounds (art. 37(g)).
Penalty structure
Article 37(e) sets the highest criminal fine, 10,000,000 to 20,000,000 Syrian Pounds plus imprisonment from three to seven years, for violating the cross-border transfer rules of articles 15 and 16; other article 37 offences carry lower fixed tiers from 1,000,000 to 12,000,000 Syrian Pounds, and article 36 sets separate administrative fines from 1,000,000 to 15,000,000 Syrian Pounds for specific registration, security and marketing failures.
- Rule
- Fixed only
- As of
- 19 September 2026
- Currency
- SYP
- Fixed cap
- 20,000,000
Who enforces it
Enforcement body
Personal Data Protection Authority
What it reaches
Obligation class
Governance, Reporting
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 19 establishes the Personal Data Protection Authority as a public body with legal personality and financial and administrative independence, seated in Damascus and linked to the Minister of Communications and Technology, with the power to set data protection policy, license and inspect controllers and processors, receive complaints and notifications, verify cross-border data movement, and issue an annual report on personal data protection in Syria.
Articles 20 to 26 place the Authority under a Board of Directors chaired by the Minister and a Director General, both appointed by decree, bar Board members and staff from disclosing any document or data from a case under the Authority's review, and let the Authority cooperate with foreign counterparts to verify a controller's or processor's compliance abroad.
Article 31 lets the Director General, on any violation of the law other than a licensing violation under article 30, order the violator to stop and remove its cause, and lets the Board, if that order is not obeyed, warn of, partially or wholly suspend, or partially or wholly revoke the violator's license, permit or accreditation, publish the violation in the media at the violator's expense, or place the violator under the Authority's technical supervision.
Article 34 gives a data subject the right to complain to the Authority over an infringement of their personal data rights, a refusal to let them exercise those rights, or a decision their controller's or processor's data protection officer made on their request, and requires the Authority to decide the complaint within thirty days and the party complained against to comply within seven working days of being notified.
Article 35 lets the Minister assign Authority staff judicial police powers to enter a licensee's premises, record violations, and seize any material or means used to commit one.
Article 36 sets administrative fines from 1,000,000 to 15,000,000 Syrian Pounds for a controller's or processor's specific failures under articles 3, 5, 6, 9, 10 and 11, for a marketing violation of articles 17 and 18, for an Authority board member's or staff member's breach of article 23, and for violating the terms of a license, permit or accreditation.
Article 37 punishes unlawfully collecting, processing, disclosing, storing, transferring or deleting personal data with imprisonment from one month to two years and a fine from 1,000,000 to 10,000,000 Syrian Pounds, rising to imprisonment from three to seven years and a fine from 10,000,000 to 20,000,000 Syrian Pounds for violating the cross-border transfer rules in articles 15 and 16, and punishes practicing an activity that needs the Authority's license before obtaining it, and obstructing an Authority officer with judicial police powers.
Article 43 requires every public and private entity to provide the Authority with any reports, statistics or information it requests about the Authority's personal data protection activities.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachgenerates_contentprocesses_biometricsprocesses_voicehigh_risk_decisions
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.