The Personal Data Protection Law of 2023 was published Sunday in the official gazette, which will come into effect six months after publication. The provisions of the law apply to data, even if it was collected or processed before it entered into force, but do not apply to natural persons who process their data for personal purposes. The law stipulates the right of a natural person to protect his data, and it may not be processed except after obtaining the consent of the person concerned or in cases authorised by law. Information treatment is considered legal and legitimate and may be carried out without prior approval in cases of treatment carried out by a competent public body if preventive medical purposes must protect the life of the concerned person to prevent a suspected crime. The law would also allow information treatment for research, scientific, statistical purposes or national security requirements. The law stipulates that processed data shall not be retained after the purpose of processing has en
ded unless the law stipulates otherwise. The processing is preconditioned on a legitimate, specific and clear purpose to be consistent with the purposes for which the data was collected to be carried out legally and based on accurate and up-to-date data. The law specifies the responsibilities of those who carry out the processing and the tasks of the controller and the processor. The law considers the data that is processed to be confidential, and it is the responsibility of the administrator and the processor to maintain its confidentiality. According to the law, data may not be transferred or exchanged between officials and others, including the recipient, except with the consent of the person concerned. A council would be formed under the law under the name Personal Data Protection Council with a 4-year term.
Source: Jordan News Agency