How fast must a data breach be reported in Jordan?

Under Article 20 of Law No. 24 of 2023, a serious breach that could cause significant harm is reported to the people affected within 24 hours of its discovery, and to the Ministry's personal data protection unit within 72 hours. Individuals hear first, so the notice to them has to be ready almost at once.

Both clocks start at discovery, so a business needs to know who decides that a breach has happened and who writes the notices. Gross negligence makes the controller liable to compensate the people affected.

Reviewed by Taha, our privacy expert · Last reviewed 6 November 2026