Lebanon

Article 85 applies the data chapter to all automated and non-automated processing except purely personal activity, and says the rights and duties it creates cannot be varied by agreement. Article 96(7) requires the declaration to state the identity and address of the controller's representative where the controller is resident outside Lebanese territory, and Article 98(4) republishes that address. Article 94 exempts public bodies acting within their powers, non-profit membership registers, statutory public registers, schools handling pupil data, employee and member records, customer and counterparty records of commercial companies, unions, associations and the liberal professions, anything the person consented to in advance, and processing under the 1999 interception law. There is no express extraterritoriality clause of the kind found in Europe or India, so the reach rests on the representative provisions rather than on a scope article.

Article 96(12) lists, among the fourteen items a declaration must contain, 'where applicable, the transfer of personal data to another State in any form'. Article 98(8) republishes that item in the public register. Neither article makes the transfer conditional on anything. Sector by sector, checked 18 August 2026: BANKING and PAYMENTS are closed - Article 7 of the central bank's rewritten Basic Decision 7548 and Article 27 of Basic Decision 13790 both require customer and transaction data to be stored in Lebanon. TELECOMS: no localisation found; the new Service Providers Licensing Regulation of December 2025 contains no data storage or privacy conditions, and the 2002 Telecommunications Law's only confidentiality article binds the regulator's own inspectors. HEALTH: no storage rule found, but health data cannot be processed at all without a licence from the Minister of Public Health. INSURANCE, SECURITIES, EDUCATION, GAMING, MAPPING, DEFENCE and GOVERNMENT CLOUD: no rule found on any official site we could open, which is a gap in our evidence rather than proof of absence.

Because there is no list of any kind, there is nothing to be populated and nothing that can be switched on by naming a country. The nearest thing to a lever is Article 94, which lets the Council of Ministers, by decree proposed jointly by the Ministers of Justice and of Economy and Trade, exempt further categories of processing from the filing regime - a loosening power, not a tightening one. In the financial sector, Annex 3 of Basic Decision 13790 forbids sharing customer personal data with any third party except the central bank, the Banking Control Commission, the Special Investigation Commission and the judicial authorities, and requires the customer to be told and to give explicit written consent, limited to specific purposes, before a processor touches the data.

The law hands out functions rather than creating an authority. The Ministry of Economy and Trade receives declarations against a receipt (Article 95) and must publish the register (Article 98). Licences for the three restricted categories come from other ministers: internal and external state security from a joint decision of the Ministers of National Defence and of Interior and Municipalities, criminal offences and judicial proceedings from the Minister of Justice, and health, genetic identity or sexual life from the Minister of Public Health (Article 97). Silence for two months is a refusal. Enforcement is by criminal prosecution under Articles 106 to 108, and Article 109 makes prosecution for unlawful disclosure and for ignoring an access request depend on a complaint by the injured party, which the complainant can withdraw. The Article 98 register we downloaded on 18 August 2026 lists a single declaration, number 1931/2023 of 16 May 2023, by a United States software company acting through a Beirut law firm as its Lebanese representative; the spreadsheet's own last-modified stamp is 31 May 2023. By contrast the Banque du Liban issued new electronic banking and payments decisions in January 2026, and the Telecommunications Regulatory Authority received a new five-member board by Decree 1328 in September 2025 and issued a licensing regulation in December 2025.

Article 90 of Law 81/2018 provides that keeping personal data is lawful only during the period stated in the declaration of the processing, or in the decision authorising it. There is no general statutory maximum and no general minimum in the data law itself. Article 4(4) of Law 44/2015 requires copies of documents relating to all operations, and information and identity documents of customers, to be kept for at least five years. The ten-year billing record rule is Article 34 of the telecoms regulator's Consumer Affairs Regulation, which its own website still lists among draft regulations. Where the five-year anti-money-laundering floor and a shorter self-declared retention period collide, the specific financial statute prevails in practice; the data law contains no conflict rule, which is itself a gap.

What the law punishes is the leak itself rather than the failure to disclose it: Article 106 makes it an offence to disclose personal data under processing to unauthorised persons, even negligently. Article 107 sets a ten working day clock, but for answering a person's access or correction request, not for a breach. In the financial sector, Basic Circular 144 of 2017 requires banks to pass the Special Investigation Commission technical information about suspicious transfers, including the customer's internet address and internet provider, but attaches no reporting deadline. The 48-hour clock is in Basic Decision 13790 and applies to evidence of a freezing action. Because Lebanon has no operating national computer emergency team with a reporting duty that we could verify, a company suffering a breach in Lebanon has, unusually, nobody it is legally obliged to call.

Article 106 sets a fine of 1 to 30 million Lebanese pounds and imprisonment of three months to three years, or either, for processing without a declaration or without a prior licence, for breaking the collection and processing rules, and for disclosing personal data to unauthorised persons even by negligence. Article 107 adds a fine of 1 to 15 million pounds for refusing, or answering wrongly or incompletely within ten working days, an access or correction request. Article 108 raises repeat penalties by between a third and a half. At the Banque du Liban's own published rate of 89,500 pounds to the dollar on 14 August 2026, those ceilings are roughly 335 and 168 US dollars. Article 91 bans collecting or processing data revealing health status, genetic identity or sexual life, with exceptions only where the person made it public or expressly agreed, where it is needed for medical diagnosis or treatment by a health professional, where it is to establish or defend a right in court, or under an Article 97 licence. Article 85 makes the chapter non-derogable and says no agreement, contrary clause or unilateral undertaking can be relied on against it. Basic Circular 146 of 13 September 2018 required banks, finance companies and other supervised institutions to take measures in line with the European General Data Protection Regulation, to appoint a data protection officer from the compliance unit, to designate a European representative and to notify their procedures by 31 December 2018, with annual external audit verification. Two further snags: a foreign controller must name a Lebanese representative on the declaration, and the retention period you write on that declaration becomes the legal maximum you may keep the data.

Dormant switches worth watching. One: Article 94 lets the Council of Ministers, by decree on the joint proposal of the Ministers of Justice and of Economy and Trade, exempt further categories of processing from the filing regime - a power to loosen with no consultation. Two: Article 97 licensing sits with three sets of ministers who can each set conditions on state security, criminal and health data processing by their own decision. Three: the central bank amended Basic Circular 69 twenty-seven times between 2003 and 2026 and rewrote Articles 1 to 25 wholesale in January 2026, so the financial data rules can change by a single decision of the Governor. Four: the telecoms regulator's Consumer Affairs Regulation, approved by its board on 19 June 2009 and still listed on its own site among draft regulations, would take effect on publication in the Official Gazette under its own Article 83; it grants subscribers privacy rights, bans disclosing calling patterns without advance written consent and imposes a ten-year billing record duty, and it could be published without further consultation.