Law: Law No. 24 of 2023 Personal Data Protection Law (only available in Arabic here) 

Regulator: Personal Data Protection Directorate

Summary: On September 17, 2023, Law No. 24 of 2023 Personal Data Protection Law (the Law) was published in the Official Gazette, and will enter into effect in six months, i.e. on March 17, 2024. Importantly, the Directorate confirmed that all entities dealing with personal data are required, upon the law's enforcement, to align their conditions with the law's provisions within a period not exceeding one year, ending on March 16, 2025 (only available in Arabic here).

The provisions of the Law will apply to any personal and sensitive information processing of natural persons, whether such data was collected or processed before or after the effectiveness of the Law within Jordan, and applies to controllers who are also based outside of Jordan. The Law also applies to both domestic and international data transfers. In addition, the Law outlines several rights for individuals, namely the right to be informed, to access and obtain held data by the data controller, to object and withdraw consent, to correct, amend, add or update data, to restrict data processing, to be forgotten, to ensure data is erased, and to data portability. Furthermore, the Law includes obligations regarding the notification of data infringements and breaches to individuals.