Jordan

The law covers any person or organisation 'located inside or outside the Kingdom' who has the data in their custody. It uses the same wording for anyone receiving the data. The law also reaches back in time. It applies to data you collected or used before it came into force. The register rules issued by the Council in 2025 include a set of fields for a company that is not Jordanian. The registration portal at pdp.gov.jo lists a company based outside the Hashemite Kingdom of Jordan as one of the two groups the service is for. The only exception is a person handling their own data for purely personal reasons. There is no express requirement to appoint a local legal representative. But the data protection officer rule puts a Jordanian national in the loop whenever databases leave the country.

The rule is a test on the receiving end. It is not a ban, and it is not a list of blessed countries. The law adds six exceptions where the test does not have to be met. They include court and police cooperation under treaties. They include sharing medical data where it is needed to treat the person. They include epidemic and public health data. They include the person's own consent, after being told the protection is not good enough. And they include banking operations and transfers of money out of the Kingdom. Here is what we found sector by sector on 18 August 2026. Government and the public sector are the strictest. Under the Cloud Policy of 2020, data classified Secret must be kept and used 'within the Kingdom' in secure government data centres. Data classified Sensitive must also stay within the Kingdom. Only the Private and Ordinary levels may sit abroad, and then only where the host country's privacy law matches Jordan's. The top two levels are closed. Telecoms and information technology, energy, water, health and transport. We found no ban on storing data abroad. But named companies in these five sectors sit on a critical-infrastructure list. They cannot appoint a data protection officer until the Council approves the individual. So there is an extra approval step. Banking, payments and insurance. The Central Bank of Jordan is named as the body that approves the data protection officer for the firms it supervises. The ministry says firms supervised by the Central Bank still have to register, appoint an officer, meet the security rules and report breaches. We found no rule on the Central Bank's own site requiring data to stay in Jordan. But we could not read that site in full, so treat this as unconfirmed rather than settled. Securities, education, gaming, mapping and defence. We found no rule about where data may be stored or sent. We checked on 18 August 2026 and our confidence is medium.

You judge each case yourself. There is no government permit and no published list. The law makes you check how well the recipient outside the Kingdom protects the data, before you start sending. Separately, the law makes the Council publish a list of countries and organisations that are recognised as protecting data well enough. The Council must keep that list updated. The ministry's own guidance still talks about that list in the future tense. It says the Council will issue a list. No list appears in the ministry's published library as at 18 August 2026, so the list is empty. Two further requirements matter. First, the 2025 security rules require a written data protection impact assessment whenever you handle sensitive personal data, or send data outside the Kingdom. You must keep it, update it at least once a year, and hand it to the regulator on request. Second, the law requires a data protection officer whenever databases are sent outside the Kingdom. Your contracts with suppliers and recipients must set out the security measures. They must say how a breach gets reported to you. And they must say how copies stored outside the Kingdom will be deleted when the work ends. The law also lets the Council issue licences and permits for storing, using, profiling and transferring data. But the Council of Ministers regulation that would define those licence types is not in the published library. So no transfer permit is being issued or demanded today.

The Council is fully set up. Here is its published membership as at 18 August 2026. The Minister of Digital Economy and Entrepreneurship chairs it (Sami Smairat). The Information Commissioner is deputy chair (Dr Nidal Al-Ahmad). Then come the Commissioner General for Human Rights (Jamal Al-Shamayleh) and the head of the National Cyber Security Centre (Mohammad Al-Samadi). There is also a Central Bank of Jordan representative (Moataz Abu Zanad). There are also two unnamed security-service representatives. Finally there are industry members for information technology, telecoms and banking, plus one independent expert. That mix is itself worth knowing. A government minister chairs the regulator, and two intelligence and security officials sit on it. It is not independent in the way European regulators are. The Directorate has four sections. One handles licences, permits and registers. One handles public service. What it has actually done. It issued rules on Council procedure, on the register and on security measures, all in 2025. It published the criteria for approving data protection officers, and a named critical-infrastructure list. It adopted model consent, withdrawal and request forms by formal Council decision. It runs a live register at pdp.gov.jo. It routes complaints through the national government services portal. It publishes a log of awareness workshops given to named companies, universities and regulators, running through 6 and 7 July 2026. What is missing is the other half. We found no published enforcement decision, no fine, and no use of the power to publish a violator's name at the violator's expense.

How long you may keep data. The 2025 security rules make you build internal systems that erase data when the work you collected it for ends. The only exception is where a law in force says otherwise. You must also erase or hide data when the person or the regulator asks. When you erase, you must tell anyone you gave the data to. You must erase all stored copies and backups, 'including making sure the processor and the recipient erase databases stored outside the Kingdom'. That duty has to be written into your contract. You may keep the results of the work after the period ends, but only if you have erased everything that identifies the person. The ministry states the general rule plainly. You may not keep personal data after the purpose you collected it for has ended. The only exception is where a law says otherwise. How long you must keep data. The ministry gives two worked examples. Medical committees must keep their records and registers for at least five years under the Medical Reports and Committees Regulation. Keeping telecoms records is covered by separate rules. Two other clocks run as well. A data protection impact assessment must be kept and refreshed at least once a year. Your register entry must be kept accurate and updated within fifteen days of any change. Which rule wins. The minimum keeping time wins. The duty to erase is expressly subject to any other law in force. We did not check the minimum keeping periods under tax, company and anti-money-laundering law against those regulators.

The trigger is a breach of the security or integrity of data that could seriously harm the person. Within twenty-four hours of finding out, you must tell the people affected. You must also tell them what to do to avoid the consequences. Within seventy-two hours of finding out, you must tell the Personal Data Protection Directorate. Tell it where the breach came from, how it happened, who was affected, and anything else you know. If the breach happened through your gross fault or trespass, you owe the person compensation. The 2025 security rules add a contract clock. Your suppliers and anyone receiving the data must tell you immediately when they discover any breach, leak or cyber incident. You must handle incidents in line with the measures issued by the National Cyber Security Centre. That is a third clock, and we could not confirm its own deadlines. Financial firms may have a fourth route, through the Central Bank's incident response team for the financial sector, JO-FinCERT. We could not confirm its reporting deadlines either.

1. The officer must be Jordanian. The Council's approval criteria require the data protection officer to hold Jordanian nationality. The officer must be of good conduct, with no conviction for a crime or for dishonesty. And the officer must never have been dismissed for a data protection failure. The officer can be an employee or an outside contractor. One outside officer may serve several organisations. 2. You need an officer more often than you think. The law requires one if handling personal data is your main activity. It also requires one if you handle sensitive data, or data about people without legal capacity, or data that includes financial information. It requires one if you transfer databases outside the Kingdom. That last trigger means almost any company using a foreign cloud service needs a Jordanian officer. 3. Criminal liability, not just fines. On top of the penalties the regulator can impose, a court can impose a criminal fine. It runs from one thousand to ten thousand Jordanian dinars. That is roughly one thousand four hundred to fourteen thousand United States dollars. The fine doubles for a repeat. The court can also order the destruction of the database the conviction was about. 4. Thirty days to register. The register rules give you thirty days from the day you actually start handling data to fill in the register. You get fifteen days to reflect any change. You get fourteen days to produce documents the regulator asks for. And you get five working days to answer a request for extra information. 5. Consent is formal, and so are the forms. Consent must be explicit, written down on paper or electronically, and limited by both time and purpose. The Council has formally adopted model consent, withdrawal and request forms. You must answer a request from an individual within fifteen working days. 6. The list of companies that need an approved officer names you by name. The critical-infrastructure list is not a description of sectors. It is a list of companies. It names the three mobile operators, three electricity distributors and three water companies. It names more than twenty hospitals and laboratories. And it names delivery and ride-hailing firms including Uber, Talabat, Careem, FedEx, DHL and Aramex. If you are on it, the Council must approve your officer before you appoint them. Approval lasts two years.

Powers the government already holds, in order of how much they would hurt. 1. Licences and permits. The law lets the Council issue licences and permits for storing, using, profiling and transferring data. It tells the Council of Ministers to make a regulation. That regulation would set out the types of licence, their conditions, and when they can be suspended or cancelled. No such regulation appears in the ministry's published library as at 18 August 2026. The Directorate already has a standing section for licences, permits and registers. If that regulation lands, sending data abroad changes overnight from your own judgement to needing permission. 2. The list of approved countries. The Council has a standing duty to publish and update a list of countries and organisations that protect data well enough. Publishing it would help anyone sending data to a listed country. It would also immediately expose anyone sending data to an unlisted one. 3. More types of sensitive data. The Council can declare any further category of information sensitive, where disclosure or misuse would harm the person. Sensitive data means you must do an impact assessment and appoint an officer. 4. The list of named companies. The Council may add to or update any case where an approved officer is required. So the critical-infrastructure list can grow without consultation. 5. Naming and shaming. The Directorate may publish a statement of proven violations at the violator's expense. It has not used this power yet, so the first use will be news. We found nothing suggesting a change to the law itself in the next twelve months, checked 18 August 2026.