Jordan PDPL compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Jordan's Personal Data Protection Law and what is it used for?

The Personal Data Protection Law No. (24) of 2023 is Jordan's general law on personal data. It requires explicit consent unless an exception applies, notice before processing and a set of data subject rights, and it covers security measures, a responsible officer, registration, breach notification and tests before data goes abroad. The Security, Technical and Organizational Measures Instructions of 2025 turn the safeguards into concrete controls, from yearly technical checks to processor contract terms.

A Personal Data Protection Council chaired by the Minister of Digital Economy and Entrepreneurship regulates the Law, and a Directorate takes complaints and keeps a registry of controllers, processors and Data Protection Officers. The Law took effect on 17 March 2024, and Ministry materials show full legal compliance expected from 17 March 2025. The practical test: for any personal data you hold, could you show its basis, who was told, how it is protected and where it goes?

Current law. The Law took effect on 17 March 2024, and Ministry of Digital Economy and Entrepreneurship materials show full legal compliance expected from 17 March 2025. The 2025 instructions, the Data Disclosure Regulation, a Data Protection Impact Assessment guideline and the request and consent forms fill in the detail. An official English translation of the Law is available; confirm current requirements with the Directorate and your legal advisers.

Who it is for

Who needs to comply with the Jordan PDPL?

The Law applies to any controller or processor, inside or outside the Kingdom, that handles the personal data of people in Jordan, whatever its size. Organisations usually come to Sterling for a structured programme from one of four directions:

• You must appoint a Data Protection Officer. An officer is required where the primary activity is processing personal data, or the processing covers sensitive data, the data of persons lacking legal capacity, financial information or transfers of databases abroad.
• You are a bank, fintech or payment firm. You hold financial information, which triggers the officer duty, and the Law lets processing needed by Central Bank-supervised entities proceed without prior consent as the Bank determines.
• You process data for others. Processors must follow the Law, stay within the purpose and duration and erase or return data, and the 2025 instructions require written contracts covering breach reporting and sub-processors.
• You handle health information. Hospitals, clinics, laboratories and insurers hold sensitive personal data, and the Law has a specific route for preventive medicine, diagnosis and care by licensed practitioners.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Jordan PDPL requirements?

Strip away the vocabulary and Jordan's Personal Data Protection Law asks a business to comply in six areas of personal data handling. The list below puts each one in business terms; the Law and the regulator's guidance give the full wording and exceptions.

• Processing rests on consent and notice: personal data is processed on valid consent or another basis the Law allows, and people are told clearly what is collected and why.
• People can use their data rights: requests to access, correct, withdraw consent or object to processing are received, tracked and answered across every system.
• Data is secured by set measures: physical, technical and organisational measures protect personal data, with impact assessments in the cases the instructions set.
• Responsibility is assigned and recorded: a responsible officer is named, registration duties are followed, and records show how the Law is applied in practice.
• Breaches are notified: personal data breaches are detected, assessed and reported to the people and bodies the Law requires.
• Processors and transfers are controlled: contracts bind processors, and personal data leaves Jordan only under the Law's transfer rules.

Compliance route

How do you achieve Jordan PDPL compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the Personal Data Protection Council if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, patients, staff and suppliers: what is collected, on which basis, where it is stored, who processes it and whether it leaves Jordan.
2. 02
   Gap analysis: compare current practice with the Law.Each area of the Law reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Update consent wording and notices, put the 2025 security measures in place, appoint the officer where required, prepare registry entries and forms, sign processor contracts and agree a breach procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents, run the yearly technical check, review transfers, refresh training and follow the Council's and the Directorate's instructions as they are issued.

Check the route before you sign. The Law creates no certificate of conformity, so treat any offer of a "PDPL certificate" with suspicion. The Ministry publishes an accreditation form for Data Protection Officers, which concerns the individual officer, not the organisation. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation directly with the accreditation body concerned.

Cost

How much does Jordan PDPL compliance cost?

The cost of a Jordan PDPL programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Jordan PDPL compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Jordan PDPL engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Law, and the Law creates no certificate of compliance; the Personal Data Protection Council supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Consent wording, notices, request, security, impact assessment and breach procedures and processor contract terms, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Data Protection Officer support

  Guidance for the Data Protection Officer on requests, complaints, registry entries, transfers and breach decisions.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Personal Data Protection Council, chaired by the Minister, regulates the Law; its Directorate takes complaints and keeps the registry.

Often combined with

Standards organisations pair with Jordan PDPL

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.