On March 28, 2024, the Presidency of the Council of Ministers of the Syrian Arabic Republic announced that the President of the Syrian Arabic Republic, Bashar al-Assad, issued Law No. 12 regarding the protection of electronic personal data on the network (the Law), with the aim of preserving the privacy of citizen's data.

Purpose of the Law

In particular, the Law aims to:

• ensure the legal protection of individuals' personal data and protect their privacy;
• determine the rights and obligations of all parties regarding data collection and processing;
• obligate institutions, entities, and individuals that control or process personal data to appoint an official to protect personal data within their institutions and entities, in a way that guarantees the privacy of Syrian citizens’ data in its electronic form published on the network;
• regulate the mechanism for exchanging data locally, or across borders with countries with which mutual agreements are concluded under special conditions and with the consent of the data subject; and
• establish a mechanism for submitting requests and complaints by owners of data that has been violated without permission from its owner.

Data subject rights

Moreover, the Law provides data subjects the following rights:

• knowledge of the nature of their personal data that is the subject of processing, its purpose and methods, and the rights guaranteed to them by the Law;
• access, view, or obtain personal data held by any controller or processor;
• knowledge of the period of time for which personal data will be stored, or of the criteria used to determine it;
• refraining from prior consent to retain or process their personal data, without such withdrawal having a retroactive effect;
• correcting, amending, erasing, adding, or updating their personal data;
• allocating processing for specific purposes or within a specific scope;
• notify them of any breach of their personal data;
• object to the processing of personal data or its results if they violate the basic rights and freedoms of the data subject guaranteed by the Constitution of the Syrian Arabic Republic; and
• the right to file a complaint with the Personal Data Protection Authority (the Authority).

Authority and enforcement

The Law establishes the Authority responsible for enforcing the protection of personal data. Additionally, it mandates the publication of the Law in the Official Gazette of the Syrian Arab Republic, with effect from January 1, 2025.

You can read the Law, only available in Arabic, here.