Jordan

The law defines a Controller as any natural or legal person 'located inside or outside the Kingdom' who has the data in their custody, and applies the same definition to a Recipient. It also reaches back in time: it applies to data collected or processed before it came into force. The register instructions issued by the Council in 2025 include a specific field set for a controller who is not of Jordanian nationality, and the registration portal at pdp.gov.jo lists 'the controller (natural or legal person) outside the Hashemite Kingdom of Jordan' as one of the two beneficiary categories of the service. The only carve-out is a person handling their own data for purely personal purposes. There is no express requirement to appoint a local legal representative, but the data protection officer requirement effectively puts a Jordanian national in the loop whenever databases leave the country.

Headline rating: conditional. The rule is a quality test on the receiving end, not a ban and not a list of blessed countries. The law adds six escape hatches where the test does not have to be met, including judicial and police cooperation under treaties, sharing medical data where it is needed to treat the person, epidemic and public-health data, the person's own consent after being told the protection is not adequate, and banking operations and transfers of funds outside the Kingdom. Sector by sector, as checked on 18 August 2026: GOVERNMENT AND PUBLIC SECTOR - the hardest wall. Under the Cloud Policy of 2020, data classified Secret must be kept and processed 'within the Kingdom' in secure government data centres, and data classified Sensitive must also stay within the Kingdom; only the Private and Ordinary levels may sit abroad, and then only where the host country's privacy law matches Jordan's. Rating: closed for the top two levels. TELECOMS AND INFORMATION TECHNOLOGY, ENERGY, WATER, HEALTH, TRANSPORT - no storage ban found, but named companies in these five sectors sit on a critical-infrastructure list and cannot appoint a data protection officer until the Council approves the individual. Rating: conditional with an extra approval step. BANKING, PAYMENTS AND INSURANCE - the Central Bank of Jordan is named as the body that accredits the data protection officer for the firms it supervises, and the ministry states that Central Bank supervised entities are not exempt from registration, officer, security and breach duties. No banking or payment storage-localisation instruction was located on the Central Bank's own site during this run; the site blocked automated access for long stretches, so this is recorded as unconfirmed rather than as an absence. SECURITIES, EDUCATION, GAMING, MAPPING, DEFENCE - no sector-specific transfer or storage rule found, checked 18 August 2026, confidence medium.

Model: case-by-case self-assessment, not a government permit and not a published list. The law obliges the controller to verify the level of protection provided by the recipient outside the Kingdom before starting the transfer, and separately obliges the Council to issue and keep updated a list of countries, bodies and international or regional organisations recognised as offering an adequate level of protection. The ministry's own guidance still describes that list in the future tense ('the Council will issue a list'), and no list appears in the ministry's published library of instruments as at 18 August 2026, so the list is NOT populated. Two further requirements bite. First, the 2025 security instructions require a written Data Protection Impact Assessment whenever sensitive personal data is processed or data is transferred outside the Kingdom; it must be kept, updated at least once a year and handed to the regulator on request. Second, the law requires a data protection officer whenever databases are transferred outside the Kingdom. Contracts with processors and recipients must carry defined security measures, breach-notification channels, and a clause on how copies stored outside the Kingdom will be deleted at the end of processing. The law also lets the Council issue licences and permits for the storage, processing, profiling and transfer of data, but the Council of Ministers regulation that would define those licence types is not in the published library, so no transfer permit is being issued or demanded today.

The Council is fully constituted. Its published membership as at 18 August 2026: the Minister of Digital Economy and Entrepreneurship as chair (Sami Smairat), the Information Commissioner as deputy chair (Dr Nidal Al-Ahmad), the Commissioner General for Human Rights (Jamal Al-Shamayleh), the head of the National Cyber Security Centre (Mohammad Al-Samadi), a Central Bank of Jordan representative (Moataz Abu Zanad), two unnamed security-service representatives, and sector representatives for information technology, telecoms and banking plus one independent expert. That composition is itself a finding: the regulator is chaired by a government minister and includes two intelligence and security officials, so it is not independent in the European sense. The Directorate has four sections, including one dedicated to licences, permits and registers and one to public service. Observable activity: instructions on Council procedure, on the register and on security measures all issued in 2025; officer accreditation criteria and a named critical-infrastructure list published; consent, withdrawal and data-subject-request forms adopted by formal Council decision; a live register at pdp.gov.jo; complaints routed through the national government services portal; and a public log of awareness workshops delivered to named companies, universities and regulators running through 6 and 7 July 2026. What is missing is the other half: no published enforcement decision, no fine, and no use of the power to publish the violator's name at the violator's expense could be found on the ministry's site during this run. Rating: waking.

CEILING. The 2025 security instructions require the controller to build internal mechanisms that erase data when the processing period ends, unless legislation in force says otherwise, and to erase or hide data on request of the person or the regulator. When erasing, the controller must notify anyone it disclosed the data to, and must erase all stored copies and backups, 'including making sure the processor and the recipient erase databases stored outside the Kingdom', with that duty written into the contract. Results of processing may be kept after the period ends only if everything identifying the person has been erased. The ministry states the general rule plainly: personal data may not be kept after the purpose of processing has ended unless legislation provides otherwise. FLOORS. The ministry itself gives two worked examples: medical committees must keep their records and registers for at least five years under the Medical Reports and Committees Regulation, and telecommunications record-keeping is governed by separate instructions on retaining communications records. A data protection impact assessment must be kept and refreshed at least annually. Register entries must be kept accurate and updated within fifteen days of any change. CONFLICT RULE. The law resolves it in favour of the floor: the erasure duty is expressly subject to any other legislation in force. Tax, company and anti-money-laundering minimum retention periods were not verified against their own regulators' sites during this run.

The trigger is a breach of the security and integrity of data that could cause serious harm to the person. Within twenty-four hours of discovering it, the controller must notify the affected people and tell them what to do to avoid the consequences. Within seventy-two hours of discovering it, the controller must notify the Personal Data Protection Directorate of the source of the breach, how it happened, who was affected and any other available information. A controller who caused the breach through gross fault or trespass owes compensation to the person. The 2025 security instructions add a contractual clock: processors and recipients must notify the controller immediately on discovering any breach, leak or cyber incident, and controllers must handle incidents in line with measures issued by the National Cyber Security Centre. That is the third clock, and its own deadlines could not be verified: the National Cyber Security Centre's website was unreachable from this network during the run. Financial firms have a fourth potential channel through the Central Bank's financial-sector incident response team, JO-FinCERT, whose reporting deadlines were not verified.

1. THE OFFICER MUST BE JORDANIAN. The Council's accreditation criteria require the data protection officer to hold Jordanian nationality, to be of good conduct with no criminal or dishonesty conviction, and never to have been dismissed for a data protection failure. The officer can be an employee or an outside contractor, and one outside officer may serve several organisations. 2. YOU NEED AN OFFICER MORE OFTEN THAN YOU THINK. The law requires one where processing personal data is your main activity, where you process sensitive data, where you process data of people without legal capacity, where the data includes financial information, and where you transfer databases outside the Kingdom. That last trigger means almost any company using a foreign cloud service needs a Jordanian officer. 3. CRIMINAL LIABILITY, NOT JUST FINES. On top of administrative penalties, a court can impose a criminal fine of one thousand to ten thousand Jordanian dinars, roughly one thousand four hundred to fourteen thousand United States dollars, doubled for a repeat, and can order the destruction of the database that was the subject of the conviction. 4. THIRTY DAYS TO REGISTER. The register instructions give the controller thirty days from the start of actual processing to fill in the register, fifteen days to reflect any change, fourteen days to produce documents the regulator asks for, and five working days to answer a request for extra information. 5. CONSENT IS FORMAL AND SO ARE THE FORMS. Consent must be explicit, documented in writing or electronically, and limited by both duration and purpose, and the Council has formally adopted model consent, withdrawal and data-subject-request forms. Requests from individuals must be answered within fifteen working days. 6. THE ACCREDITED-OFFICER LIST NAMES YOU BY NAME. The critical-infrastructure list is not a description of sectors, it is a list of companies: the three mobile operators, three electricity distributors, three water companies, more than twenty named hospitals and laboratories, and delivery and ride-hailing firms including Uber, Talabat, Careem, FedEx, DHL and Aramex. If you are on it, the Council must approve your officer before you appoint them, and approval lasts two years.

DORMANT SWITCHES, in order of how much they would hurt. 1. LICENCES AND PERMITS. The law empowers the Council to issue licences and permits for the storage, processing, profiling and transfer of data, and instructs the Council of Ministers to make a regulation setting out the types of licence, their conditions and when they can be suspended or cancelled. No such regulation appears in the ministry's published library as at 18 August 2026, and the Directorate already has a standing section for licences, permits and registers. If that regulation lands, cross-border transfer moves overnight from self-assessment to permission. 2. THE ADEQUACY LIST. The Council is under a standing duty to publish and periodically update a list of countries and organisations with adequate protection. Publishing it would help exporters to listed countries and immediately expose exporters to unlisted ones. 3. SENSITIVE-DATA EXPANSION. The Council can declare any further category of information sensitive where disclosure or misuse would harm the person; sensitive data triggers a mandatory impact assessment and an officer. 4. THE NAMED-COMPANY LIST. The Council may add or update any case where an accredited officer is required, so the critical-infrastructure list can grow without consultation. 5. NAMING AND SHAMING. The Directorate may publish a statement of proven violations at the violator's expense. It has not used this power yet, which is exactly why the first use will be newsworthy. Nothing found suggests an amendment to the law itself in the next twelve months, checked 18 August 2026.