Introduction

The Jordanian Personal Data Protection Law No. 24 of 2023 (the PDPL) has officially been ratified and shall come into force six months from the date of its publication (17 September 2023) in the official gazette (i.e. enforceable starting 17 March 2024). The PDPL consists of 25 articles and is the first legislation of its kind to tackle the protection of personal data in the Hashemite Kingdom of Jordan.

Overview

In light of our increasing reliance on technology, and the mass collection and use of personal data (even more so with the arrival of artificial intelligence), the Jordanian government issued the PDPL, which aims to create a balanced framework that permits the collection of personal data by both public and private entities for the purpose of their activities, whilst protecting citizens' rights to privacy.

The PDPL defines Personal Data as: "Any data or information related to a natural person, which would identify him/her, directly or indirectly, regardless of its source or form, including data related to his/her person, family status or whereabouts."

The PDPL further defines Sensitive Personal Data as: "Any data or information related to a natural person that directly or indirectly indicates his/her origin or race or indicates his/her opinions, political affiliations, religious beliefs, or any data related to his/her financial status, health, physical, mental or genetic status, or his/her biometric fingerprint or his/her criminal record, or any information or any data that the [Council] decides to consider sensitive, if its disclosure or misuse causes harm to the person concerned."

The PDPL regulates the processing of personal data and provides clear guidelines for the collection, processing and use of such data.

Article (4) provides that an individual's prior approval must be obtained for the processing of their data, whilst Article (5) details the conditions that must be satisfied for such pre-approval. Article (6) outlines certain restricted instances where such pre-approval is not mandatory for the processing of data.

Article (7) provides the conditions for processing personal data including, but not limited to, that the processing should be completed for a clear and legitimate purpose, should be carried out via legal and legitimate means, and should be based on valid, accurate and relevant data.

Article (12) provides the conditions to which data processors are required to adhere, including: conducting and implementing the processing in accordance with the requirements and conditions stipulated in the PDPL and the regulations and instructions issued pursuant thereto; conducting the processing within the limits of the specific purpose and duration of the processing; erasing the data at the end of the processing period or handing it over to the person in charge; and refraining from performing any action that would make data or processing results available, except in cases authorised by law.

Articles (16) and (17) provide for the formation of a Personal Data Protection Council, which will be responsible for, among other matters: approving policies, strategies, plans and programmes related to data protection and monitoring their implementation; adopting standards and measures for data protection, including codes of conduct for the proper performance of the administrator and processor for their work; and issuing licences and permits for storing, processing, diagnosing and transferring data.

Article (20) provides for the measures to be taken in the event of a breach of data security and integrity which would cause serious harm to an individual.

Finally, Articles (21) and (22) provide for the penalties that apply in case of breach of the PDPL and the regulations and instructions issued pursuant thereto. Such penalties include the revocation of the licence or permit for data processing, or a monetary fine.