Compliance and legal risk
Personal Data Protection for Companies in Jordan: An Initial Compliance Checklist
A practical starting point for companies collecting or using people’s data in Jordan, with a reminder that compliance is not completed by one document.
Updated: 10 September 2026
Prepared and reviewed by: Ashraf Al-Khawaja
Start with a clear data map
Map the data the company collects, its source, purpose, retention period, access rights, and the providers or recipients involved. The Law defines personal data as information relating to a natural person that can identify them directly or indirectly, with additional sensitivity around financial, health, biometric, and other sensitive data. Collect only what is needed and do not assume that the compliance-adjustment period is still open; the Ministry states that Law No. 24 of 2023 entered into force on 17 March 2024 and that the period ended on 16 March 2025.
Make the legal basis and notice understandable
Do not use the word “consent” as a universal solution. Document the basis for each purpose and make the notice clear about the data, purpose, period, participants, and the person’s rights. Build a workable channel for access, correction, updating, withdrawal, erasure, or restriction requests where applicable, and verify identity without collecting unnecessary extra data. Consent forms and notices, especially for marketing, sensitive data, or children’s data, merit legal review before launch.
Control vendors, security, and incident response
Review cloud, payroll, and call-centre contracts and define purpose, duration, access, retention, deletion or return, sub-processors, and breach reporting. Apply proportionate access controls, secure backups, and encryption or encoding, and keep records of processing, training, and incidents. When processing sensitive data or transferring it outside Jordan, assess the impact and the recipient’s level of protection before implementation. Also confirm whether a Data Protection Officer is required and prepare breach-response steps under the current Law and Instructions.
Sources and references
- وزارة الاقتصاد الرقمي والريادة – وحدة حماية البيانات الشخصية
- قانون حماية البيانات الشخصية رقم (24) لسنة 2023 – المصدر الرسمي
- تعليمات التدابير الأمنية والتقنية والتنظيمية لسنة 2025
Verify the official text and latest amendments before relying on this material professionally.