Jordan PDPL Compliance Guide
Everything you need to know about Jordan's Personal Data Protection Law — consent-first by default, with penalties tied to a percentage of annual revenue.
Mar 2024
In Force Since
3% of Revenue
Administrative Cap
All Sectors
Applies To
Overview
Law No. 24 of 2023 was published in Jordan's Official Gazette on 17 September 2023 and took effect on 17 March 2024, with a one-year grace period that closed on 17 March 2025. It is Jordan's first dedicated personal data protection law, and oversight sits with the Personal Data Protection Council established within the Council of Ministers. The law is consent-first: Article 4/A requires the data subject's prior consent to process their personal data unless the processing falls within a case the law itself permits. Consent must be clear, in writing, tied to a specified purpose and period, and presented in an intelligible and easily accessible form using plain language. What makes the penalty regime distinctive is its shape rather than its ceiling — administrative fines accrue daily and are capped as a percentage of annual revenue, which scales the exposure to the size of the business.
Key Requirements
Prior Consent by Default
Obtain the data subject's consent before processing, unless the law provides a specific alternative basis. Consent is the default position, not one option among equals.
Written, Purpose-Bound Consent
Consent must be in writing, name a specific purpose, and state a period. Open-ended consent to unspecified future processing does not meet the standard.
Plain, Accessible Language
Present the request in an intelligible and easily accessible form using clear language. A dense legal notice is not an accessible form.
Data Subject Rights
Provide access, correction, objection and erasure rights, with a workable route for individuals to use them.
Lawful Basis Documentation
Where you rely on something other than consent, be able to point to the provision that permits it. The Council can ask.
Security and Accountability
Apply appropriate safeguards and be able to evidence compliance — the administrative track begins with a warning, and what you can show at that point matters.
Penalties for Non-Compliance
Jordan runs two tracks: administrative measures that escalate daily, and judicial fines. The administrative cap is proportionate to revenue.
Daily Administrative Fines
After a prior warning, up to JOD 500 for each day the violation continues.
Capped at 3% of Revenue
Accrued administrative fines are capped at 3% of the entity's total annual revenue for the previous fiscal year — exposure scales with the size of the business.
Judicial Fines
A court may impose a fine between JOD 1,000 and JOD 10,000, doubled for repeat offences.
Licence and Data Orders
The authority may suspend or revoke a licence, and a court may order the destruction of the data or cancellation of the database.
How Arqam360 Helps
Consent Before Processing
Trackers are blocked until the visitor chooses, so processing does not begin before the consent Article 4/A requires exists.
Purpose-Scoped and Recorded
Consent is captured per category rather than as a single blanket yes, with a timestamped record of exactly what was agreed and when.
Plain Language, Both Languages
Arabic and English text written to be read rather than to satisfy a lawyer, which is what the intelligible-and-accessible standard is asking for.
Evidence When Asked
An exportable audit trail of consent decisions, so a warning from the Council can be answered with records rather than assurances.
Enforcement Timeline
Law Published
Law No. 24 of 2023 is published in the Official Gazette on 17 September — Jordan's first dedicated personal data protection law.
Law Takes Effect
The PDPL enters into force on 17 March 2024, opening a one-year grace period for organisations to align existing processing.
Grace Period Closes
The one-year grace period ends on 17 March 2025 and the law becomes fully operational, with the Personal Data Protection Council overseeing enforcement.
Check Your Jordan PDPL Compliance
Scan your site free. See which trackers process visitor data before consent exists, and what a regulator would find.
Run a Free ScanLast updated:
Sources
- 1.DLA Piper, Data Protection Laws of the World — Jordan
- 2.DataGuidance — Jordan data protection overview
- 3.Regulation (EU) 2016/679 (GDPR), consolidated text — EUR-Lex
- 4.Albesher, Alsaad & Alhussain (2026) — cookie consent usability and privacy compliance in Saudi Arabia, PeerJ Computer Science 12:e3701
Regulations
Compliance guides for GDPR, PDPL, and moreSaudi PDPL Compliance Guide
UAE PDPA Compliance Guide
Qatar PDPPL Compliance Guide
Bahrain PDPL Compliance Guide
Kuwait Data Protection Compliance Guide
GCC Privacy Laws Overview
GDPR Compliance Guide
CCPA Compliance Guide
Jordan PDPL FAQ
Common questions about Jordan's Personal Data Protection Law.
It was published on 17 September 2023 and took effect on 17 March 2024. A one-year grace period followed, closing on 17 March 2025, after which the law became fully operational.
Get Jordan PDPL Compliant
Consent before processing, recorded per purpose, in Arabic and English. Free forever on one domain.