SyriaLaw No. 12 of 2024 on Protection of Electronic Personal Data, rights of data subjects and electronic marketing
Law No. 12 of 2024, arts. 3, 11, 17-18, 33 (rights, requests and electronic marketing)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 1 January 2025.
A data subject rights rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Do not process, disclose or divulge personal data without the data subject's explicit consent, unless a legally authorized case applies.
- Tell a data subject, on request, the nature, purpose and method of processing their personal data and the retention period or how it is set, and let them access their own data, withdraw a prior consent without retroactive effect, correct, delete, add to or update it, confine your processing to a defined purpose, and object to processing that violates their constitutional rights.
- Decide a request to make a data subject's personal data available within five working days of registering it, and give reasons in writing for any refusal.
- Answer any other request from a data subject to exercise a right under this law within seven working days of its submission.
- Obtain a data subject's consent, identify yourself as sender, give a correct return address, and label the message as direct marketing before sending any electronic marketing contact, and give the data subject a clear and easy way to refuse it or withdraw consent.
- Keep electronic records of a data subject's marketing consent, its amendments, or their non-objection to continued contact, for three years from the date you last sent them a marketing message.
What it reaches
Obligation class
Data subject rights, Disclosure, Consent
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 3(a) bars processing, disclosing or divulging personal data without the data subject's explicit consent or a case the law authorizes.
Article 3(b) gives the data subject the right to know the nature, purpose and method of any processing of their personal data, to access or obtain their personal data held by a controller or processor, to learn the retention period or the criteria used to set it, to withdraw a prior consent without retroactive effect, to correct, amend, delete, add to or update their personal data, to confine processing to a defined purpose or scope, to be told of any breach of their personal data, to object to processing or its results where it violates their constitutional rights and freedoms, and to file a complaint with the Authority.
Article 11 requires a controller or processor to decide a request to make personal data available within five working days of registering it, verifying the legal justification the requester attaches, and to give reasons for any refusal. Article 33 requires whoever receives a request from a data subject to exercise a right under the law to respond within seven working days of its submission.
Article 17 bars a sender from making electronic contact with a data subject for marketing without the data subject's consent, an identified originator and sender, a correct and sufficient return address, a statement that the contact is for direct marketing, and a clear and easy mechanism for the data subject to refuse the contact or withdraw consent to it.
Article 18 requires a marketing sender to keep to the stated marketing purpose, not disclose the data subject's contact data, and retain electronic records of the data subject's consent, its amendments, or their non-objection to continued marketing contact for three years from the last message sent.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachgenerates_content
Read the law
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://moct.gov.sy/news-0171Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.