Support Centre

Jordan

Summary

Law: Law No. 24 of 2023 Personal Data Protection Law (only available in Arabic here

Regulator: Personal Data Protection Directorate

Summary: On September 17, 2023, Law No. 24 of 2023 Personal Data Protection Law (the Law) was published in the Official Gazette, and will enter into effect in six months, i.e. on March 17, 2024. Importantly, the Directorate confirmed that all entities dealing with personal data are required, upon the law's enforcement, to align their conditions with the law's provisions within a period not exceeding one year, ending on March 16, 2025 (only available in Arabic here).

The provisions of the Law will apply to any personal and sensitive information processing of natural persons, whether such data was collected or processed before or after the effectiveness of the Law within Jordan, and applies to controllers who are also based outside of Jordan. The Law also applies to both domestic and international data transfers. In addition, the Law outlines several rights for individuals, namely the right to be informed, to access and obtain held data by the data controller, to object and withdraw consent, to correct, amend, add or update data, to restrict data processing, to be forgotten, to ensure data is erased, and to data portability. Furthermore, the Law includes obligations regarding the notification of data infringements and breaches to individuals.

Insights

Part one of this comparison outlined the differences in the scope, definitions, and legal bases for processing between the Jordanian Personal Data Protection Act 2023 (JPDPA) and the General Data Protection Regulation (GDPR). In part two of the comparison between the two laws, Mariana Abudayah, of Nsair & Partners – Lawyers, explores the differences in controller and processor obligations, data subject rights, and enforcement for a better understanding of the two frameworks. This article will also consider the unique challenges and compliance considerations that companies and organizations may encounter.

On September 17, 2023, the Jordanian Personal Data Protection Act 2023 (JPDPA), which regulates privacy in Jordan, was issued and entered into force on March 17, 2024. In issuing the JPDPA, Jordan has become one of the leading countries in the Middle East and North Africa (MENA) region to regulate and govern personal information protection rules and regulations. The JPDPA resembles the General Data Protection Regulation (GDPR), which has been in effect since May 25, 2018, aiming to protect individuals' privacy and personal data in light of economic, business, and commercial rapid growth.  

However, in examining both the GDPR and the JPDPA, it becomes evident that while both regulations share the common goal of protecting individuals' data protection, privacy, and security, there are distinguished differences in their methods, scope, and implementation. In part one of this comparative series, Mariana Abudayah, of Nsair & Partners – Lawyers, explores the differences in the scope, definitions, and legal bases for processing to gain an inclusive and better understanding of the two frameworks.  

Jordan is considered one of the leading countries in the MENA region to regulate personal information protection rules, as of September 17, 2023, the Jordanian Data Protection Law (the Law) is published in the Official Gazette, and according to the Law, it shall be effective after six months of being published, i.e on March 17, 2024. In this Insight article, Mariana Abudayah delves into the main and key points mentioned in the Law.

In an increasingly interconnected world, establishing regulations to protect personal data in transactions between individuals, data controllers, and data processors has become necessary. This is particularly important for transactions between companies and individuals located in different countries. In the following Insight article, Mariana Abudayah, from Nsair & Partners - Lawyers, provides an overview of Jordan's ongoing efforts to address this pressing issue. Until now, Jordan has not issued a data protection law. However, the country is currently undergoing an assessment and review process by the Economic Committee at the Jordanian Parliament to develop a Data Protection Bill (the Bill). This article analyses the key aspects of the Bill, shedding light on its significance in safeguarding personal data and fostering secure cross-border transactions.