Jordan Personal Data Protection Law: Obligations Under Law No. 24 of 2023

Jordan's Personal Data Protection Law No. 24 of 2023 makes prior, documented consent the default basis for processing personal data and sets one of the shortest breach clocks anywhere: 24 hours to tell affected people and 72 hours to tell the regulator. The law was published in the Official Gazette on 17 September 2023, took effect six months later on 17 March 2024, and gave existing processors one year to comply, so full compliance has been expected since 17 March 2025. It applies to controllers inside or outside the Kingdom, covers data collected before it took effect, and is supervised by a Personal Data Protection Council and a unit within the Ministry of Digital Economy and Entrepreneurship (MoDEE). This guide covers scope, obligations, transfers, the breach clocks, penalties, implementing regulations and what the law means for service accounts and AI agents. It is for privacy, security and engineering leads at organisations that process personal data of people in Jordan.

Confirm every obligation, figure and penalty on this page against the official text of the law before relying on it.

Key takeaways

• Consent first, with ten exceptions: Article 4(A) bars processing without prior consent unless the law permits otherwise; Article 5 requires consent to be explicit, documented, and specific as to purpose and duration; Article 6 lists ten exceptions, including Central Bank of Jordan regulated entities and public bodies.
• 24 hours and 72 hours: Article 20 requires a controller to notify affected data subjects within 24 hours of discovering a breach likely to cause severe harm, and the MoDEE unit within 72 hours.
• DPO triggers are broad: Article 11 requires a data protection officer where processing is the main activity, or where sensitive data, financial data or data of people lacking legal capacity is processed, or where databases are transferred outside Jordan.
• Transfers depend on protection level: Article 15 prohibits transfers to recipients with lower protection unless one of six exceptions applies, and the Council publishes a list of adequate countries (Article 17).
• Fines scale with revenue: administrative fines reach 500 dinars per day of violation, capped at 3% of prior-year annual revenue (Article 21), and criminal fines run from 1,000 to 10,000 dinars, doubled for repeat offences (Article 22).

Scope: who and what is covered

The law covers processing of personal data, defined as any information that identifies a natural person directly or indirectly. "Processing" includes collecting, storing, using, transferring and erasing data. Article 2 defines a controller as a natural or legal person, inside or outside the Kingdom, who holds the data, which gives the law reach beyond Jordan's borders. Article 3(A) applies it to data collected or processed before it took effect, and Article 3(B) excludes individuals processing their own data for personal purposes.

MoDEE's published English text is an official translation. The English labels for "controller" and "data protection officer" appear to map differently from the Arabic terms (المسؤول and المراقب). Where precision matters, rely on the Arabic text and local counsel.

Key obligations

Lawful basis and notice

• Consent (Articles 4 and 5): explicit, documented in writing or electronically, specific as to duration and purpose, in clear language. Consent is invalid if obtained through incorrect information or deception, or if the purpose changes without fresh consent.
• Exceptions (Article 6): public entities performing their duties, medical care, vital interests, crime prevention, legal requirements or court orders, Central Bank of Jordan regulated entities, processing under a bylaw, non-targeted research, statistics, national security or public interest, and data the subject has made public.
• Notice before processing (Article 9): tell the data subject the data involved and start date, purpose, duration, processor, security controls and any profiling.
• Retention (Article 6(B)): do not keep data after its purpose is fulfilled unless another law requires it.

Data subject rights

Article 4(B) gives eight rights: access and knowledge, withdrawing consent, correction and updating, restriction, erasure or concealment, objection to processing or profiling, transfer of a copy, and being notified of security breaches. Article 10 sets the cases where data must be erased or hidden. Exercising rights must carry no financial or contractual penalty (Article 4(C)). The Cabinet approved a Regulation on Organising Data Subject Rights in August 2025, which details consent, objection and complaint procedures.

Controller and processor duties

Breach notification

Article 20(A) applies to breaches likely to cause severe harm. Notify affected data subjects within 24 hours of discovery, with the steps taken to mitigate consequences, and report to the unit within 72 hours with the source, mechanism, affected subjects and other available information. Article 20(B) makes a controller whose gross fault or wilful misconduct causes harm liable to compensate the data subject. The 24-hour duty to individuals is the hard one: draft notices in advance and agree who decides "severe harm". MoDEE lists a data breach reporting guide among its published guidance. For other countries' timelines see the Breach Notification Laws by Country Guide.

Transfers

• To third parties (Article 14): consent, a legitimate interest, telling the subject the recipient and purpose, and no marketing use without agreement. Transfers between competent public entities for legal duties are exempt.
• Outside Jordan (Article 15): prohibited where the recipient offers less protection, unless the transfer is for judicial cooperation, international crime-fighting, medical treatment, epidemics or public health, the subject consents after being told protection is inadequate, or it is a banking or fund transfer. The controller must verify the recipient's protection level first.
• Adequacy list: Article 17 empowers the Council to publish a list of countries with adequate protection, and to issue licences and permits for transfers.

Timeline and current status

MoDEE's 2025 materials list further instruments: regulations on data disclosure, licensing and permits, and the unit's procedures; instructions on the processing register and on security, technical and organisational measures; DPO accreditation standards; and guides on privacy policies, DPIAs and breach reporting. We could not confirm the issue date of each from the sources checked, so verify which are final on MoDEE's site before relying on them. As of November 2026 the law is in force and the alignment period has ended.

Enforcement and penalties

The Council, chaired by the Minister and including the Information Commissioner, the General Commissioner for Human Rights, the President of the National Cybersecurity Centre, a Central Bank representative, two security agency representatives and four sector experts (Article 16), imposes administrative measures on the unit's proposal. The unit receives complaints, monitors compliance and keeps the registry (Article 18).

What it means for AI agents and non-human identities

Most personal data in a modern organisation is read and moved by machines: integration accounts, ETL pipelines, API clients and AI agents. The law's security duty in Article 8, the breach detection duty in Article 14(E) and the transfer rules in Article 15 all reach those identities.

• Know which machine identities touch personal data: inventory service accounts, API keys and agent identities with access to personal or sensitive data, with an owner and a purpose for each. This is the evidence base for Article 8 security measures and Article 14(B) transfer records. See the NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments guide.
• Detect breaches through machine credentials: a leaked API key with read access to a customer database can start the 24-hour clock. Article 14(E) expects tools to detect and track breaches, so monitor machine identity behaviour, not just human logins. The Detection Engineering for Non-Human Identities Guide lists the signals.
• Agents and purpose limitation: an AI agent that retrieves personal data to answer a question is processing it. Scope its data access to the purpose consented to, and do not let it reuse data for a new purpose without fresh consent (Article 5(B)).
• Profiling notice: agents or models that infer preferences or behaviour are profiling. Disclose it in the Article 9 notice and support the right to object.
• Model and tool endpoints are transfers: sending personal data to an AI service hosted outside Jordan is a transfer under Article 15. Check the provider's location and protection level, and record the basis. Financial data is sensitive under this law, so a DPO is likely required too.

Compliance steps

1. Map data and flows: record personal and sensitive data, systems, processors, recipients and cross-border flows, including machine-to-machine flows.
2. Fix the lawful basis: for each processing activity, record consent or the Article 6 exception relied on, and rebuild consent forms to be explicit, documented and specific as to purpose and duration.
3. Publish notices: update privacy notices to cover every Article 9 item, including profiling and security controls.
4. Appoint a DPO where triggered: check every Article 11 trigger; register the controller and DPO with the unit.
5. Build rights handling: intake, identity verification, the eight rights, complaints, and the 2025 data subject rights regulation procedures.
6. Set up the breach clocks: define "discovery", assign who decides severe harm, pre-draft subject and unit notices, and rehearse the 24-hour path. See the Incident Response Plan Template.
7. Review transfers: verify recipient protection levels, check the Council's adequacy list, and record the Article 15 exception used.
8. Contract processors: bind processors to Article 12 duties: purpose, duration, deletion or return, confidentiality.
9. Run a DPIA for high-risk processing: MoDEE lists a DPIA guide; see the DPIA Guide for method.

Framework mapping

Measuring it

• Processing activities with a recorded basis: percentage with consent evidence or a named Article 6 exception.
• Breach exercise timing: hours from discovery to subject notice and to unit report, against 24 and 72.
• Rights requests closed within your internal target: NHI Mgmt Group suggests 30 days until the regulation sets a deadline you must meet.
• Machine identities with access to personal data that have an owner: percentage of service accounts, keys and agents.
• Cross-border flows with a recorded Article 15 basis: percentage of flows, including AI and SaaS endpoints.

Common failure patterns

• Copying a GDPR legitimate interests model: Jordan's law starts from consent with listed exceptions. Processing justified only by business interest may lack a basis.
• Missing the 24-hour notice to individuals: teams build for the 72-hour regulator clock and miss the shorter one.
• Treating financial data as ordinary: financial position is sensitive personal data here and triggers a DPO.
• Ignoring legacy data: Article 3(A) covers data collected before the law took effect.
• Unrecorded AI transfers: prompts and retrieved records sent to overseas model endpoints without a transfer assessment.
• Relying on the English text alone: the English and Arabic definitions appear to differ in places, so check the Arabic text for key terms.

Practitioner checklist

• Map personal and sensitive data, including machine-to-machine and AI flows.
• Record consent or the Article 6 exception for every processing activity.
• Update notices to cover every Article 9 item, including profiling.
• Appoint and register a DPO where any Article 11 trigger applies.
• Register with the MoDEE unit's controller registry.
• Rehearse the 24-hour subject notice and the 72-hour unit report.
• Inventory service accounts, API keys and AI agents with personal data access, with owners.
• Verify protection levels and record the Article 15 basis for every transfer.
• Bind processors to Article 12 duties by contract.
• Check MoDEE for final versions of regulations, instructions and guides.

Standards and references

• Ministry of Digital Economy and Entrepreneurship: Personal Data Protection Law No. 24 of 2023 (official English translation)
• Ministry of Digital Economy and Entrepreneurship: PDPL presentation 2025
• Jordan News Agency: Jordan approves Data Subject Rights Regulation for 2025
• Clyde and Co: Jordan issues first personal data protection law
• DLA Piper: Data Protection Laws of the World, Jordan
• Al Tamimi and Company: Jordan's new data protection law, safeguarding personal data

Related NHI Mgmt Group resources: Saudi Arabia PDPL Guide · UAE PDPL Guide · Qatar Data Protection Law Guide · Global Privacy Regulatory Map. This guide summarises Jordan's Personal Data Protection Law No. 24 of 2023 as published at the date above and is not legal advice.