Jordan Personal Data Protection Law No. 24 of 2023

The Jordan Personal Data Protection Law No. 24 of 2023 is the principal statute governing the processing of personal data in the Hashemite Kingdom of Jordan. It was enacted by Royal Decree, signed on 17 September 2023, and published in Official Gazette No. 5881 (page 4338) on the same date. The law's grace period for compliance ended on 17 March 2025.

The law sets out the legal basis for processing personal data, the rights of data subjects, the obligations of data controllers and data processors, the conditions for cross-border data transfers, and the supervisory authority's powers of enforcement and sanction. It applies to public and private sector entities that process personal data of individuals located in Jordan, regardless of where the controller or processor is established.

This page is maintained by Abdullah & Partners as a public legal resource. It is intended as a reference point for clients of the firm and the wider profession, alongside the Official Gazette as the authoritative source.

The law's principal subjects are:

• The lawful basis on which personal data may be collected and processed in Jordan.
• The rights of data subjects, including rights of access, rectification, erasure, and objection.
• The duties of data controllers and processors with respect to security, accuracy, and the retention of personal data.
• Conditions for the cross-border transfer of personal data outside Jordan.
• Notification obligations following a personal data breach.
• The role of the supervisory authority and its powers of investigation, enforcement, and sanction.
• Civil and administrative liability for non-compliance.

The full text of the law sets out the detailed provisions and definitions and remains the authoritative source. Practical interpretations and the firm's advisory work on the law are addressed in dedicated insights.