CVs and recruitment
Trace applications from a form or mailbox to HR systems and suppliers. Define access, purpose, retention and a workable process for responding to applicants.
All frameworks & requirements
Ministry of Digital Economy & Entrepreneurship
Jordan Personal Data Protection Readiness
Translate Jordan's Personal Data Protection Law into practical ownership, processing records, rights handling, safeguards and supplier governance.
Personal Data Protection Law No. 24 of 2023 and applicable supporting instrumentsSources reviewed: 4 November 2026
Understand the requirement. Connect it to operations.
Jordan's Personal Data Protection Law No. 24 of 2023 establishes a national regime for personal-data processing. The Ministry of Digital Economy and Entrepreneurship publishes the law, guidance, forms and supporting instruments through its personal-data protection resources. This is a separate legal regime from Saudi PDPL.
Readiness begins with actual processing activities: recruitment, employee administration, customer support, sales, security monitoring, outsourcing and AI. A website privacy statement cannot show who accesses information, how requests are handled or whether copies remain beyond their purpose.
Confirm applicability before choosing controls.
Assess data, processing activities and parties using the law and applicable instructions. Confirm controller/processor roles, processing basis, statutory exceptions and any DPO or registration requirements with qualified owners. A consent exception is not an exemption from every obligation.
Map international services and transfers under Jordan's own rules. Do not copy Saudi localization language or European templates without checking the legal basis. Review current MoDEE publications, including the listed 2025 security/organizational instructions and disclosure regulation, where relevant.
Turn requirements into implementation and evidence.
| Focus area | Implementation examples | Evidence to maintain |
|---|---|---|
| Inventory and accountability | Map data, purposes, systems, processors and owners. | Processing records, data flows and approved responsibilities. |
| Transparency and lawful use | Align notices and consent or applicable exceptions with processing. | Approved notices, decisions and relevant consent records. |
| Rights and retention | Connect requests, identity checks, retention and deletion to systems. | Request log, retention schedules and validation results. |
| Technical safeguards | Review access, encryption, sharing and monitoring proportionately. | Access reviews, configuration evidence and incident procedures. |
| Suppliers and transfers | Review contracts, destinations, support access and disclosures. | Supplier records, transfer decisions and safeguards. |
What this looks like in practice.
An AI assistant
Check submitted prompts, connected repositories, provider access and retained logs. An internal deployment still needs approved purposes, access boundaries and lifecycle controls.
From readiness assessment to working controls.
Agree the scope, responsible owners and acceptance criteria before work begins. The approach is tailored to your systems, suppliers, operating constraints and existing evidence.
Assess and prioritize
Review applicability, current controls and evidence. Identify gaps and dependencies, distinguish design from operating effectiveness, and prioritize actions with accountable owners.
Design the improvements
Translate approved requirements into architecture, policies, processes and technical changes. Reuse effective controls while keeping national and sector mappings distinct.
Implement and validate
Configure agreed safeguards, document procedures and validate representative workflows within authorized access and change windows. Record exceptions and residual risks.
Handover and sustain
Organize evidence, transfer operating knowledge and define a review cadence. Track corrective actions as systems, services, suppliers and requirements change.
Agree concrete deliverables.
- A scope and applicability record with assumptions and responsibilities.
- A gap/risk register and prioritized remediation roadmap.
- Control mapping, architecture recommendations and operating procedures.
- An evidence register, agreed validation results and handover material.
Deliverables, depth, access and timing depend on the statement of work. This is readiness and implementation support; it does not include a promise of regulator acceptance or formal certification.
Common questions.
Is Jordan's law the same as Saudi PDPL?
No. They differ in scope, legal conditions, institutional arrangements and supporting rules. Maintain distinct legal mappings even when technical controls are shared.
Is consent always the only basis?
The law provides specific exceptions and conditions. Record the basis for each activity with qualified advisers; a blanket consent form does not replace analysis.
Does every organization need the same DPO arrangement?
Review the cases in Article 11 and current official requirements, including relevant qualification or accreditation arrangements. Another jurisdiction's appointment rules do not automatically apply.
Can personal data be transferred abroad?
Assess transfers under Jordanian law and applicable rules, including the conditions in Articles 14 and 15. A cloud contract alone does not establish that the arrangement is permitted.
What should we prepare first?
Bring system and supplier lists, data flows, notices, contracts, policies, retention rules and request processes. Use anonymized examples during initial scoping.
Start with the official sources.
Read the linked authority publications for the binding scope, wording and applicable updates. The implementation examples on this page are practical recommendations, not a reproduction of every regulatory requirement.
- MoDEE: Law and supporting instruments ↗
- MoDEE: Personal data protection FAQs ↗
- MoDEE: Official law translation ↗
General readiness and technology information, not a legal opinion, regulator endorsement or guarantee of compliance. Confirm applicability, current versions and sector directions with the competent authority and qualified advisers.
Related frameworks and requirements
Define the right scope for your organization.
Bring your services, systems, supplier dependencies and existing findings. We will help turn them into a practical assessment and implementation scope.
Discuss your readiness