My company works in Lebanon. What does the law ask of us when an AI agent reads our data?
The short answer
Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data applies. Unless an exemption applies, you must declare your processing to the Ministry of Economy and Trade, and processing of health, genetic or sexual life data, crimes and court cases, or state security needs a licence. No judicial or administrative decision that assesses a person's conduct may rest only on automated processing. The law has no separate rule for sending data abroad, but your declaration must say if you transfer data to another country.
The law that applies
Law No. 81 of 10 October 2018 on Electronic Transactions and Personal Data applies. It came into force three months after its publication in the Official Gazette. Its fifth part covers personal data. It applies to all automated and non-automated processing of personal data, but not to processing a person does only for their own personal needs.
I found no independent data protection authority in the law. The Ministry of Economy and Trade receives declarations and publishes the list of declared and licensed processing. Each licence comes from the minister responsible for that kind of data.
Can the agent read personal data at all?
The law does not make consent the general basis for processing. It says personal data must be collected fairly, for legitimate and specific purposes, and must not be used for purposes that do not match the declared aims, except for statistics, history or scientific research. Data may be kept only for the period stated in the declaration or the licence. You must tell the people you collect data from who you are, why you process it, and who will receive it.
A person may object, for legitimate reasons, to the collection and processing of their data. This right does not apply where the law obliges you to collect the data, or where the person agreed to the processing.
Collecting or processing data that reveals a person’s health, genetic identity or sexual life is forbidden. The ban does not apply where the person made the data public or agreed to it explicitly, unless a legal bar exists, where it is needed for medical diagnosis or treatment by a health professional, where it is needed to prove or defend a right in court, or where a licence was obtained.
Decisions made by machine
The law gives every person the right to see, and to object to, the information and analysis used in automated processing that concerns them and is used against them. No judicial or administrative decision that requires assessing a person’s conduct may rest only on automated processing that aims to define the person’s traits or assess parts of their personality.
Declaration or licence
Unless an exemption applies, anyone who wants to collect and process personal data must inform the Ministry of Economy and Trade by a declaration, against a receipt. The law exempts several cases. Among them are processing about a company’s employees or members, and about its clients, within the limits and needs of its lawful activity, and processing the person agreed to in advance, unless a legal bar exists.
Processing of data on the internal and external security of the state, on crimes and court cases, and on health, genetic identity or sexual life needs a licence. The licence comes from a joint decision of the Ministers of National Defence and of Interior and Municipalities for state security, from the Minister of Justice for crimes and court cases, and from the Minister of Public Health for health, genetic and sexual life data. If no decision comes within 2 months of the request, the request counts as refused.
The model provider, and data sent abroad
The law has no separate article on transfers abroad. But the declaration must state, where relevant, any transfer of personal data to another country, and any subcontractor. The ministry’s public list shows, where relevant, the data meant to be sent to a foreign country.
You must take all measures, given the nature of the data and the risks of the processing, to keep the data safe and to stop it being distorted, damaged, or reached by people who are not authorized to see it.
When something goes wrong
I found no duty in the law to report a data breach. A person may go to the competent courts, including the urgent matters judge, to enforce their rights.
The law punishes processing without a declaration or a licence, collecting or processing data without following its rules, and disclosing personal data, even by negligence, to people not authorized to see it, with a fine of 1 million to 30 million Lebanese pounds, prison from 3 months to 3 years, or one of the two.
What Lebanon says about AI itself
The rule on automated decisions above is the part of the law closest to AI. I found no Lebanese AI law as of October 2026.
What this means for you
- Check whether your processing is exempt. If it is not, file a declaration with the Ministry of Economy and Trade before the agent starts.
- If the agent reads health or genetic data, or data on crimes and court cases, get the licence first.
- State in your declaration that data goes to a provider abroad, and name the provider as a subcontractor.
- If the agent helps a court or a public body assess a person’s conduct, keep a human decision in the loop.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.