Compliance and legal risk
Personal Data Protection for Companies in Jordan: An Initial Compliance Checklist
A practical starting point for companies collecting or using people’s data in Jordan, with a reminder that compliance is not completed by one document.
Companies and partners
Compliance and legal risk
Updated: 10 September 2026
General editorial legal material published on the firm’s website.
Smart reading summary
Understand and share the study quickly
A practical starting point for companies collecting or using people’s data in Jordan, with a reminder that compliance is not completed by one document.
Key points
- Start with a clear data map
- Make the legal basis and notice understandable
- Control vendors, security, and incident response
Useful for: Useful for initial reading and identifying questions that may need legal review.
This automatic summary is based on the published text. It is not legal advice and does not replace checking official sources and reviewing the facts with a qualified lawyer.
AI generation is optional and subject to Gemini usage limits. Do not send client data or attachments from this card.
Start with a clear data map
Map the data the company collects, its source, purpose, retention period, access rights, and the providers or recipients involved. The Law defines personal data as information relating to a natural person that can identify them directly or indirectly, with additional sensitivity around financial, health, biometric, and other sensitive data. Collect only what is needed and do not assume that the compliance-adjustment period is still open; the Ministry states that Law No. 24 of 2023 entered into force on 17 March 2024 and that the period ended on 16 March 2025.
Make the legal basis and notice understandable
Do not use the word “consent” as a universal solution. Document the basis for each purpose and make the notice clear about the data, purpose, period, participants, and the person’s rights. Build a workable channel for access, correction, updating, withdrawal, erasure, or restriction requests where applicable, and verify identity without collecting unnecessary extra data. Consent forms and notices, especially for marketing, sensitive data, or children’s data, merit legal review before launch.
Control vendors, security, and incident response
Review cloud, payroll, and call-centre contracts and define purpose, duration, access, retention, deletion or return, sub-processors, and breach reporting. Apply proportionate access controls, secure backups, and encryption or encoding, and keep records of processing, training, and incidents. When processing sensitive data or transferring it outside Jordan, assess the impact and the recipient’s level of protection before implementation. Also confirm whether a Data Protection Officer is required and prepare breach-response steps under the current Law and Instructions.
Frequently asked questions
Start with a clear data map?
Map the data the company collects, its source, purpose, retention period, access rights, and the providers or recipients involved. The Law defines personal data as information relating to a natural person that can identify them directly or indirectly, with additional sensitivity around financial, health, biometric, and other sensitive data. Collect only what is needed and do not assume that the compliance-adjustment period is still open; the Ministry states that Law No. 24 of 2023 entered into force on 17 March 2024 and that the period ended on 16 March 2025.
Make the legal basis and notice understandable?
Do not use the word “consent” as a universal solution. Document the basis for each purpose and make the notice clear about the data, purpose, period, participants, and the person’s rights. Build a workable channel for access, correction, updating, withdrawal, erasure, or restriction requests where applicable, and verify identity without collecting unnecessary extra data. Consent forms and notices, especially for marketing, sensitive data, or children’s data, merit legal review before launch.
Control vendors, security, and incident response?
Review cloud, payroll, and call-centre contracts and define purpose, duration, access, retention, deletion or return, sub-processors, and breach reporting. Apply proportionate access controls, secure backups, and encryption or encoding, and keep records of processing, training, and incidents. When processing sensitive data or transferring it outside Jordan, assess the impact and the recipient’s level of protection before implementation. Also confirm whether a Data Protection Officer is required and prepare breach-response steps under the current Law and Instructions.
Sources and references
- وزارة الاقتصاد الرقمي والريادة – وحدة حماية البيانات الشخصية
- قانون حماية البيانات الشخصية رقم (24) لسنة 2023 – المصدر الرسمي
- تعليمات التدابير الأمنية والتقنية والتنظيمية لسنة 2025
Verify the official text and latest amendments before relying on this material professionally.
Study collection
Companies, contracts, and investment
Browse the other studies in this subject through its dedicated topical section.
Open study collectionA related service path
Corporate, governance, and investment advice
If this study is close to your matter, review the service scope and contact the firm to discuss the facts and documents.
Review the related serviceRelated Jordanian-law guides
Contextual links to related public guide routes; they remain limited to Jordanian law and do not replace matter review.