Data protection & privacy law in Jordan (2026)

Legal framework

Personal Data Protection Law No. 24 of 2023 (PDPL), administered by the Personal Data Protection Council and the Personal Data Protection Directorate (Unit) housed within the Ministry of Digital Economy and Entrepreneurship (MoDEE)

Key points: data & privacy in Jordan

1. 01Primary law in force

   Personal Data Protection Law No. 24 of 2023 was published in the Official Gazette in September 2023, entered into force 17 March 2024 with a 12-month transition period, and became fully enforceable on 17 March 2025.

   modee.gov.jo clydeco.com

2. 02Supervisory authority

   Article 16 PDPL establishes a Personal Data Protection Council that sets standards, issues codes/licenses, and reviews complaints; day-to-day supervision, registration, and investigations are carried out by the Personal Data Protection Directorate housed within MoDEE rather than by an independent commission.

   modee.gov.jo modee.gov.jo

3. 03Data subject rights

   The PDPL grants rights of access, rectification, erasure, restriction of processing, data portability, and withdrawal of explicit consent at any time; consent must be informed, granular, and documented (no pre-ticked boxes or silence).

   dlapiperdataprotection.com securiti.ai

4. 04Controller/processor obligations

   Controllers must implement technical and organisational safeguards, notify breaches, and appoint a Data Protection Officer when core activities involve sensitive data, data of minors/incapacitated persons, financial data, or cross-border transfers; processors are bound by written contracts with controllers.

   dlapiperdataprotection.com securiti.ai

5. 05Cross-border transfers

   Transfers to third countries are prohibited where the destination provides a lower level of protection than the PDPL, unless an exception applies (explicit informed consent, international judicial/criminal cooperation, medical or public-health data exchange, fund transfers, or other narrow grounds).

   dlapiperdataprotection.com securiti.ai

6. 06Penalties

   Administrative fines range from JOD 1,000 to 10,000 (doubled for repeat offences), with continuing-violation penalties up to JOD 500/day capped at 3% of prior-year annual revenue; the Directorate may suspend or revoke licences, and courts may, on final conviction, order destruction of the offending database.

   modee.gov.jo securiti.ai

Timeline of decisions

1. 17 Mar 2025Enforcement · official
   PDPL Compliance Grace Period Expires — Full Enforcement Active

   The one-year transition window under Jordan's Personal Data Protection Law closed, requiring all public and private entities handling personal data to be fully compliant. From this date the Personal Data Protection Council may impose fines of JOD 1,000–10,000 (doubled for repeat offences), though implementing bylaws and formal Council constitution remained pending as of mid-2025.

   Ministry of Digital Economy and Entrepreneurship (MODEE)

2. 17 Sept 2023Law
   Personal Data Protection Law No. 24 of 2023, Jordan's First Data-Protection Statute

   Published in Official Gazette No. 5881 on 17 September 2023, Law No. 24 of 2023 entered into force on 17 March 2024 with full enforcement beginning 17 March 2025. It imposes data-controller obligations, breach-notification requirements, and proportionality standards across private and public sectors, directly complementing the cybersecurity legal framework.

   Dentons (citing Official Gazette No. 5881)

3. 1 Jan 2015Law · official
   Cybercrime Law No. 27 of 2015 Enacted — First Digital Privacy Penalties

   Jordan's first comprehensive cybercrime statute criminalised unauthorised access to information systems, data interception, and online privacy violations, providing the primary legal protection for personal data in digital environments for nearly a decade until superseded in 2023.

   Council of Europe Octopus Cybercrime Community

4. 1 Sept 2011Law
   Constitutional Amendments Enshrine Privacy as a Fundamental Right (Article 18)

   Sweeping 2011 amendments to Jordan's 1952 Constitution strengthened Article 18, making explicit that all postal, telegraphic, telephonic, and other communications are secret and may not be intercepted except by judicial order — giving privacy a firm constitutional footing that anchored all subsequent data-protection legislation.

   Constitute Project (University of Texas / comparative constitutions)

5. 1 Jan 1995Law · official
   Telecommunications Law No. 13 of 1995 — Earliest Statutory Communications Privacy

   Jordan's foundational telecommunications statute declared all phone calls and private communications confidential under legal liability, barred service providers from sharing subscriber data with third parties, and prohibited subscriber tracking — establishing the earliest statutory data-privacy protection in Jordanian law.

   WIPO Lex

Sources

1. 1.modee.gov.jo/ebv4.0/root_storage/en/eb_list_page/pdpl.pdf
2. 2.modee.gov.jo/EN/Pages/False
3. 3.dlapiperdataprotection.com/?t=law&c=JO
4. 4.clydeco.com/en/insights/2023/10/jordan-issues-first-personal-data-protection-law
5. 5.securiti.ai/jordan-personal-data-protection-law-of-2023/
6. 6.dataguidance.com/jurisdictions/jordan