Lebanon

Article 85 applies the data chapter to all use of personal data, by computer or by hand, except purely personal activity. It says the rights and duties it creates cannot be varied by agreement. Article 96(7) requires your declaration to state the identity and address of your representative where you live outside Lebanon. Article 98(4) republishes that address. Article 94 sets out the exemptions. They cover public bodies acting within their powers, non-profit membership registers, statutory public registers, schools handling pupil data, and employee and member records. They also cover the customer and counterparty records of commercial companies, unions, associations and the liberal professions. They cover anything the person agreed to in advance. And they cover work done under the 1999 interception law. There is no article saying plainly that the law applies even if you have no office in Lebanon, as there is in Europe or India. So the reach rests on the rules about representatives, not on a scope article.

Article 96(12) lists fourteen items your declaration must contain. One of them is 'where applicable, the transfer of personal data to another State in any form'. Article 98(8) republishes that item in the public register. Neither article makes the transfer conditional on anything. Industry by industry, checked 18 August 2026: BANKING and PAYMENTS are closed. Two rules require customer and transaction data to be stored in Lebanon. They are Article 7 of the central bank's rewritten Basic Decision 7548 and Article 27 of Basic Decision 13790. TELECOMS: we found no rule that data must stay in the country. The new Service Providers Licensing Regulation of December 2025 sets no data storage or privacy conditions. The only confidentiality article in the 2002 Telecommunications Law binds the regulator's own inspectors. HEALTH: we found no storage rule. But you cannot use health data at all without a licence from the Minister of Public Health. INSURANCE, SECURITIES, EDUCATION, GAMING, MAPPING, DEFENCE and GOVERNMENT CLOUD: we found no rule on any official site we could reach. That is a gap in our evidence, not proof that no rule exists.

There is no list of any kind. So there is nothing to fill in, and nothing that can be switched on by naming a country. The nearest thing to a lever is Article 94. It lets the Council of Ministers exempt more categories from the filing duty. That takes a decree proposed jointly by the Ministers of Justice and of Economy and Trade. That is a power to loosen, not to tighten. In the financial industry, Annex 3 of Basic Decision 13790 bans sharing customer personal data with any third party. The only exceptions are the central bank, the Banking Control Commission, the Special Investigation Commission and the judicial authorities. Before a supplier touches the data, the customer must be told and must give explicit written consent, limited to specific purposes.

The law hands out jobs rather than creating an authority. The Ministry of Economy and Trade receives declarations against a receipt (Article 95) and must publish the register (Article 98). Licences for the three restricted categories come from other ministers (Article 97). Internal and external state security needs a joint decision of the Ministers of National Defence and of Interior and Municipalities. Criminal offences and judicial proceedings need the Minister of Justice. Health, genetic identity or sexual life needs the Minister of Public Health. Silence for two months counts as a refusal. Enforcement is by criminal prosecution under Articles 106 to 108. Article 109 makes prosecution for unlawful disclosure, and for ignoring an access request, depend on a complaint by the injured party. That person can withdraw the complaint. The Article 98 register we downloaded on 18 August 2026 lists a single declaration. It is number 1931/2023 of 16 May 2023, by a United States software company acting through a Beirut law firm as its Lebanese representative. The spreadsheet's own last-modified stamp is 31 May 2023. By contrast, the Banque du Liban issued new electronic banking and payments decisions in January 2026. The Telecommunications Regulatory Authority received a new five-member board by Decree 1328 in September 2025 and issued a licensing regulation in December 2025.

Article 90 of Law 81/2018 limits how long you may keep personal data. It is the period stated in your declaration, or in the decision authorising the work. The data law itself sets no general maximum and no general minimum. Article 4(4) of Law 44/2015 sets a floor of at least five years. It covers copies of documents relating to all operations, plus customer information and identity documents. The ten-year billing record rule is Article 34 of the telecoms regulator's Consumer Affairs Regulation. The regulator's own website still lists that regulation among drafts. Where the five-year anti-money-laundering floor clashes with a shorter period you declared, the specific financial law wins. The data law has no rule for resolving the clash, which is itself a gap.

The law punishes the leak itself, not the failure to disclose it. Article 106 makes it an offence to disclose personal data you hold to people who are not authorised, even by accident. Article 107 sets a ten working day clock. But that is for answering a person's access or correction request, not for a breach. In the financial industry, Basic Circular 144 of 2017 requires banks to pass the Special Investigation Commission technical information about suspicious transfers. That includes the customer's internet address and internet provider. No reporting deadline is attached. The 48-hour clock sits in Basic Decision 13790 and applies to evidence of a freezing action. We could not confirm that Lebanon has a working national computer emergency team with a reporting duty. So a company suffering a breach in Lebanon has, unusually, nobody it is legally obliged to call.

Article 106 sets a fine of 1 to 30 million Lebanese pounds and imprisonment of three months to three years, or either. It applies to working with data without a declaration or a prior licence. It applies to breaking the rules on collecting and using data. And it applies to disclosing personal data to unauthorised people, even by accident. Article 107 adds a fine of 1 to 15 million pounds. That one applies if you refuse an access or correction request, or answer it wrongly or incompletely within ten working days. Article 108 raises repeat penalties by between a third and a half. The Banque du Liban published a rate of 89,500 pounds to the dollar on 14 August 2026. At that rate, those ceilings are roughly 335 and 168 US dollars. Article 91 bans collecting or using data that reveals health status, genetic identity or sexual life. There are four exceptions. The person made it public or expressly agreed. It is needed for medical diagnosis or treatment by a health professional. It is needed to establish or defend a right in court. Or you hold a licence under Article 97. Article 85 says the chapter cannot be set aside. No agreement, contrary clause or one-sided undertaking can be used against it. Basic Circular 146 of 13 September 2018 covers banks, finance companies and other supervised institutions. It required them to take measures in line with the European General Data Protection Regulation. They had to appoint a data protection officer from the compliance unit, name a European representative, and notify their procedures by 31 December 2018. External auditors verify this every year. Two further snags. A foreign company must name a Lebanese representative on the declaration. And the retention period you write on that declaration becomes the legal maximum you may keep the data.

Unused powers worth watching. One: Article 94 lets the Council of Ministers exempt more categories from the filing duty. That takes a decree on the joint proposal of the Ministers of Justice and of Economy and Trade. That is a power to loosen, with no consultation. Two: Article 97 licensing sits with three sets of ministers. Each can set conditions on state security, criminal and health data by its own decision. Three: the central bank amended Basic Circular 69 twenty-seven times between 2003 and 2026, and rewrote Articles 1 to 25 wholesale in January 2026. So the financial data rules can change by a single decision of the Governor. Four: the telecoms regulator's board approved its Consumer Affairs Regulation on 19 June 2009. The regulator's own site still lists it among draft regulations. Under its own Article 83 it would take effect on publication in the Official Gazette. It gives subscribers privacy rights, bans disclosing calling patterns without advance written consent, and imposes a ten-year billing record duty. It could be published without further consultation.