Employers Data Privacy obligations, Jordan
By setting precise guidelines for the collection, processing, and protection of personal data, the Jordanian Personal Data Protection Act 2023 (JPDPA) represents a significant advancement in the protection of privacy rights in Jordan. This is Jordan's first comprehensive data protection law, bringing the nation into compliance with international privacy norms like the GDPR of the EU.
Implementation
The Jordanian Personal Data Protection Act (Law No. 24 of 2023) was published in the Official Gazette on September 17, 2023.
It officially came into force on March 17, 2024, six months after publication, with a one-year grace period for full compliance that ended on March 17, 2025.
Key Provisions
Scope:
Covers any personal information handled in Jordan, including information gathered prior to the law's passage. Individuals who process their own data for private purposes are exempt.
Definitions:
Personal Data – Any information that may be used to directly or indirectly identify a specific person (e.g., name, family status, location).
Sensitive Personal Data – Includes racial or ethnic origin, political views, religious convictions, financial standing, health, biometric/genetic information, and criminal histories.
Oversight Bodies:
The Ministry of Digital Economy and Entrepreneurship oversees implementation.
A Personal Data Protection Council and a dedicated regulatory unit were established to enforce compliance.
Controllers & Processors:
Controllers (entities deciding how data is used) and processors (entities handling data on behalf of controllers) must comply with strict obligations.
Consent Requirement: Data processing generally requires explicit consent from the data subject, unless otherwise permitted by law.
Compliance and Penalties
Organizations must adopt data protection policies, ensure secure storage and processing, and respect individuals’ rights to access, correct, or delete their data.
Violations can lead to severe financial penalties and other sanctions, reinforcing the seriousness of compliance.
The law applies retrospectively, meaning even data collected before March 2024 must meet the new standards.
