My company works in Jordan. What does the law ask of us when an AI agent reads our data?
The short answer
The Personal Data Protection Law, Law No. 24 of 2023, is in force, and companies that held data before it had until March 2025 to comply. Consent must be explicit and documented, unless one of the exemptions the law lists applies. Data may not go to someone abroad whose protection is lower than the law's, except in listed cases such as the person's consent after being told of that gap. Jordan's AI strategy and its AI ethics charter are not laws.
The law that applies
The Personal Data Protection Law, Law No. 24 of 2023, applies. The Ministry of Digital Economy and Entrepreneurship dates its issue to 17 September 2023. The law came into force six months after its publication in the Official Gazette, which the ministry gives as 17 March 2024. Entities that handled data before that had up to one year to bring their practices into line, which the ministry gives as 17 March 2025.
The law covers data collected or processed before it came into force too. It does not apply to a person who processes their own data for their own personal purposes.
Who enforces it
The law forms a Personal Data Protection Council, chaired by the minister. The Council issues licences and permits, approves the instructions that implement the law, and publishes the list of countries and bodies that data may be sent to. A regulatory unit for personal data protection in the ministry does the daily work, and it receives breach reports.
The law leaves many details to bylaws and instructions. The Cabinet approved the grounds for a draft bylaw on the unit’s mechanisms and procedures for 2025, in preparation for sending it to the Legislation and Opinion Bureau. The ministry also lists guides on privacy policies, impact assessment and breach reporting. I found no bylaw on transfers abroad as of October 2026.
Can the agent read personal data at all?
The default rule is consent. Consent must be explicit and documented, in writing or electronically. It is not valid if it rests on wrong information or a deceptive practice, or if the nature or purpose of the processing changes without new consent.
The law lists cases where consent is not needed. Among them are processing required or authorized by a law or a court ruling, processing needed for preventive medicine, diagnosis or healthcare, processing needed to protect the person’s life or vital interests, processing required for entities that the Central Bank of Jordan regulates, and data the person made public. Data must not be kept after the purpose of the processing is fulfilled.
Sensitive data in this law includes the person’s financial position, as well as health, genetic and biometric data.
Profiling
The law defines profiling as the automated processing of data to identify a person’s trends, preferences, choices or behaviour. A person has the right to object to processing and profiling if they are not necessary for the purpose, go beyond it, are discriminatory, or contradict the law. The controller must tell the person about profiling before the processing starts.
The model provider, and data sent abroad
When the agent sends text to a model run by a provider, the provider acts as your processor. The law says the processor must process data only within the law’s conditions, must not go beyond the specific purpose and duration of the processing, must erase the data at the end of the processing or hand it back, and must not make the data or its results available to others except as the law allows. You must take security, technical and organizational measures to protect the data.
Data may not be transferred to a person outside the Kingdom if the protection that person offers is less than the law’s. The exceptions include the person’s consent to the transfer after being told that the protection is not sufficient, judicial cooperation under agreements in force, medical data needed for treatment, and banking transactions and transfers of funds. Before any transfer, you must verify the level of protection the recipient abroad provides.
A controller must appoint a data protection officer in several cases. One of them is transferring databases outside the Kingdom. Others are processing sensitive data or financial data, or where processing personal data is the controller’s main activity.
When something goes wrong
If a breach is likely to cause the person severe harm, you must notify the affected people within 24 hours of discovering it. Within 72 hours you must report the source and mechanism of the breach to the unit. A controller who causes a gross fault or wilful misconduct must compensate the person.
If a violation continues after the unit’s warning, the Council, on the unit’s proposal, may impose a fine of up to 500 dinars for each day the violation continues, with the total capped at 3% of the previous year’s annual revenues. The courts may impose a fine of 1,000 to 10,000 dinars, doubled for a repeat offence.
What Jordan says about AI itself
The Ministry of Digital Economy and Entrepreneurship published the Jordanian AI Strategy and Implementation Plan 2023-2027, which the ministry described in March 2023 as recently approved by the Council of Ministers. The ministry also published a draft National Charter for the Ethics of AI for public consultation in 2022, and its AI page carries the charter. The strategy says the charter focuses on protecting privacy, among other things. Neither the strategy nor the charter is a law. I found no Jordanian AI law as of October 2026.
Sector rules
- Banks and financial firms. Processing that entities regulated by the Central Bank of Jordan need is exempt from consent, and banking transactions and transfers of funds abroad are exempt from the transfer restriction. Check the Central Bank’s own rules as well.
What this means for you
- Get explicit, documented consent for each purpose, unless you can point to an exemption the law lists.
- Before the agent sends data to a provider abroad, check the level of protection there, and appoint a data protection officer if you transfer databases outside Jordan.
- If the agent builds profiles of people, tell them before you start, and give them a way to object.
- Prepare to notify affected people within 24 hours and the unit within 72 hours if a serious breach happens.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- Ministry of Digital Economy and Entrepreneurship, Personal Data Protection Law No. 24 of 2023, official English translation
- Ministry of Digital Economy and Entrepreneurship, Personal Data Protection Law presentation, 2025
- Ministry of Digital Economy and Entrepreneurship, Cabinet Approves Draft Regulation on the Personal Data Protection Unit 2025
- Ministry of Digital Economy and Entrepreneurship, Jordan’s Artificial Intelligence Strategy and Implementation Plan 2023-2027
- Ministry of Digital Economy and Entrepreneurship, Ministry events on artificial intelligence
- Ministry of Digital Economy and Entrepreneurship, Artificial intelligence page
- Jordan Government portal, MODEE presents the draft of the national charter on the ethics of AI for general consultation