Jordan

Jordan's Digital Declaration: The Emergence of Data Privacy Legislation

Jordan has recently published a landmark Personal Data Protection Law. This is the first legislation of its kind to directly address the protection of personal data in the Hashemite Kingdom of Jordan, and it will come into force on 17 March 2024.

Implementing a data protection regime is a major step towards a country protecting the privacy and personal data of its citizens. This law not only sets legal standards and responsibilities for how data is managed, but it also gives individuals more rights and authority over their own information in line with global trends. This welcome move has set the scene for a wave of new changes in the conduct of business in Jordan in 2024 in terms of increased responsibility in the handling of data, heightened compliance obligations and systemic management systems audits.

Application of the law
The law will affect any natural or legal person who processes personal or sensitive data of individuals in or outside Jordan. It also applies to controllers who are based outside of Jordan.

What to expect
Businesses will have to review and update their existing data processing activities and policies to ensure compliance with the law, regardless of their location or the date of data collection.

Prior consent
The law requires obtaining the prior consent of the concerned person for processing their data and informing them of the data to be processed before commencing processing, unless one of the exceptions apply.

What to expect
Businesses will have to provide clear and transparent information to the individuals whose data they process, and obtain their valid and explicit consent, unless they can rely on a legal basis such as contractual necessity, legal obligation, vital interest, public interest or legitimate interest.

Rights of individuals
Rights for individuals include the right to be informed, to access and obtain held data by the data controller, to object and withdraw consent, to correct, amend, add or update data, to restrict data processing, to be forgotten, to ensure data is erased, and to data portability.

What to expect
Businesses will have to provide means for the individuals to exercise their rights and respond to their requests and complaints in a timely and effective manner.

This welcome move has set the scene for a wave of new changes in the conduct of business in Jordan in 2024 in terms of increased responsibility in the handling of data, heightened compliance obligations and systemic management systems audits.

Samer Al Zuriekat
Partner, Head of Litigation - Jordan

Obligations of data recipients
The law imposes various obligations and responsibilities on data stewards, processors, controllers and recipients, and grants various rights and remedies to the concerned persons whose data are processed.

What to expect
Businesses will have to define and document their roles and relationships with other parties involved in data processing, and ensure that they have adequate contracts, policies and procedures in place to protect the data and prevent any breach or infringement.

Personal Data Protection Council
The law also establishes a Personal Data Protection Council and a regulatory unit within the Ministry of Digital Economy and Entrepreneurship to oversee and enforce the law.

What to expect
Businesses will have to register with the unit and obtain the necessary licences and permits for processing, profiling or transferring data, in accordance with the regulations and instructions issued by the Council and cooperate with the authorities in case of any investigation or inspection.

Infringement
The law includes obligations regarding the notification of data infringements and breaches to individuals and the unit within the specified time frames and provides for the revocation of the licence or permit for data processing, or a monetary fine, as penalties for breach of the law and the regulations and instructions issued pursuant thereto.

What to expect
Businesses will have to implement the necessary security, technical and regulatory measures to protect the data from any breach or infringement and establish the mechanisms and procedures for reporting and addressing any incidents, and be prepared to face the consequences of non-compliance.

Since the law will become enforceable on 17 March 2024, parties handling personal data prior to this date will have a period of one year from the effective date to rectify their position or risk sanctions. Inevitably this law will impact the way businesses operate in Jordan, and we are optimistic that it will also facilitate cross-border transfer of data which can enable businesses to expand their markets and opportunities in the digital economy within an environment of data security, innovation, competition and growth.

Contact Partner:
Samer Al Zuriekat

Contributing Author:
Hala Qutteineh