Data protection & privacy law in Palestine (2026)
Data protection in Palestine: proposed.
The State of Palestine has no comprehensive, GDPR-style data-protection statute in force; the right to privacy rests on Article 32 of the 2003 Amended Basic Law and Palestine's accession to the ICCPR. A dedicated Personal Data Protection Law by Decree has been drafted since 2016, with its third reading dated 15 June 2022, but remains stuck in cabinet/ministerial review and has not been issued. No independent data-protection supervisory authority currently exists.
Legal framework
No comprehensive personal-data-protection law in force. A 'Personal Data Protection Law by Decree' has been in draft since a committee was formed in 2016; the version under review (third reading) is dated 15 June 2022 and has not been enacted. In the interim, privacy is protected constitutionally by Article 32 of the 2003 Amended Basic Law and partially via the 2018 Cybercrime Law by Decree (No. 10 of 2018).
Key points: data & privacy in Palestine
No comprehensive law in force
Palestine has not enacted a comprehensive data-protection law. UNCTAD classifies it among the small minority of countries that have only draft legislation, none of which has been adopted.
Draft Personal Data Protection Law by Decree
A drafting committee was assigned in 2016; the latest reviewed version is the third reading dated 15 June 2022, which has been referred repeatedly back to ministries and never issued.
Constitutional privacy protection
Article 32 of the 2003 Amended Basic Law prohibits arbitrary or unlawful interference with a person's privacy, family, home or correspondence; Palestine has also acceded to the ICCPR (Article 17).
Sectoral / criminal-law provisions
The Cybercrime Law by Decree No. 10 of 2018 contains limited privacy-relevant provisions (e.g., court-authorized interception of communications, capped at three months) but is widely criticized for enabling surveillance rather than protecting personal data.
No supervisory authority
There is no operational independent data-protection authority. 7amleh's 2023 analysis warns that the draft decree's proposed oversight board lacks defined qualifications and independence guarantees.
GDPR-aligned draft principles
The draft decree is modeled on international standards, incorporating principles such as lawfulness, fairness, transparency and rules on collection, processing and storage of personal data, but these take effect only if and when the law is issued.
Sources
- 7amleh.org/post/privacy-and-personal-data-protection-in-palestine
- 7amleh.org/post/position-paper-personal-data-protection-draft-law-by-decree-from
- business-humanrights.org/en/latest-news/palestine-grassroots-organization-7amla-seeks-to-prote
- security-legislation.ps/latest-laws/the-amended-basic-law-of-2003/
- security-legislation.ps/latest-laws/law-by-decree-no-10-of-2018-on-cybercrime/
- arab-reform.net/publication/policing-the-digital-sphere-the-impact-of-palestines-cybe
Next for Palestine: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026