Jordan PDP Law

Jordan Personal Data Protection Law (2023) - controller obligations, data subject rights, cross-border.


Short name	JO PDP
Region	Middle East & Africa
Country or scope	Jordan
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers JO PDP

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for JO PDP.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for JO PDP and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`JO-PDP-SEC` Technical and Organisational Safeguards	Controllers must apply appropriate technical and organisational measures to protect personal data from loss, alteration or unauthorised access, which includes verifiable integrity of the software processing the data (Law No. 24/2023 controller security obligations)	Scan
`JO-PDP-BREACH` Breach Notification Readiness	Data breaches must be notified to the supervisory authority and affected data subjects, which requires the ability to identify precisely which processing components were affected (Law No. 24/2023 breach notification obligation)	Scan
`JO-PDP-PROC` Processor Engagement Duties	Controllers remain responsible when engaging processors and must ensure processors provide adequate protection guarantees, extending to visibility over software component suppliers (Law No. 24/2023 processor obligations)	Scan
`JO-PDP-ACC` Accountability for Processing Means	Controllers must be able to demonstrate lawful processing to the Personal Data Protection Council, which presumes documented knowledge of the systems and components performing the processing (Law No. 24/2023 accountability and oversight provisions)	Scan
`JO-PDP-TRANS` Documented Processing Transparency	Data subjects must be informed about processing and its purposes, part of a documentation duty that is supported by identifiable, timestamped records of the processing environment (Law No. 24/2023 transparency and notice obligations)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`JO-4`	Lawfulness, Fairness & Transparency
`JO-6`	Purpose, Minimisation & Storage Limitation
`JO-9`	Consent Requirements
`JO-12`	Sensitive Data Processing
`JO-13`	Data Subject Rights Implementation
`JO-21`	Controller Accountability Measures
`JO-27`	Cross-Border Data Transfer Safeguards
`JO-31`	Data Protection Officer Appointment
`JO-32`	Breach Notification Obligation

Policy templates

Written for JO PDP:

Jordan PDP Cross-Border Data Transfer Policy
Jordan PDP Breach Notification Procedure

And 22 from the standard set, adapted to JO PDP.