API Marketplace

Solutions

Resources

Our Company

Book a Demo

← Back to Glossary

Personal Data Protection Law No. 24

Jordan

2023

AML/CFT

Overview

Personal Data Protection Law No. 24 of 2023 is Jordan's first comprehensive legislation on personal data protection. It was enacted to establish a clear legal framework for how data is collected, processed, stored, and transferred across sectors, aligning with global privacy standards.

The law applies to banks, telecommunication providers, digital platforms, healthcare organizations, insurance providers, and other businesses operating in Jordan that handle personal data. It introduces requirements such as data subject consent, purpose limitation, and cross-border transfer restrictions. Although the law is in force, full enforcement remains pending as the national Data Protection Authority has yet to be established.

Key Obligations

Obtain explicit consent from individuals before collecting or processing their data
Limit data use to clearly defined and lawful purposes
Provide individuals with rights to access, correct, erase, or restrict their data
Restrict cross-border data transfers to jurisdictions offering adequate protection

Adopt technical and organizational safeguards to ensure data security
Appoint data protection officers as required by forthcoming regulations
Comply with future rules issued by the national Data Protection Authority

Stay ahead of risk with Signzy

Explore tools that help you onboard, monitor, and verify with confidence

AML Screening

Screen users against Politically Exposed Persons (PEP), watchlists, sanctions lists, adverse media, and more through one-time screening and advanced monitoring.

Transaction Monitoring

Monitor transactions in real-time and analyse past behaviour to identify suspicious activities and ensure regulatory compliance across the user journey.

Identity Verification

Use facial match and liveness checks paired with government ID verification to validate users while onboarding.

FAQ

Is Jordan's Data Protection Authority operational?

Not yet. The law provides for its creation, but it has not been established as of 2025.

What is the status of enforcement?

The law is in effect, but full enforcement is delayed pending the issuance of executive regulations.

Who must comply with this law?

All public and private entities in Jordan that process personal data, regardless of sector.

Are international data transfers allowed?

Yes, but only to countries deemed to provide adequate protection, or under approved conditions.