Jordan's Personal Data Protection Law: Erasure Rights and Privacy

The phrase “right to be forgotten” describes a legal debate about requests to erase personal data, conceal it or limit its availability when it is inaccurate, no longer necessary for its original purpose, or processed unlawfully, The details vary between legal systems.

The concept does not create an absolute right to remove every accurate fact or erase past events from public records, Any assessment may involve privacy, freedom of expression, the public's interest in information, public interest and legal duties to retain data.

The Jordanian Constitution provides a general framework for privacy, Article 7 states that personal freedom is inviolable and that violations of public rights and freedoms or the private life of Jordanians are offences punishable by law.

Article 18 protects the confidentiality of postal, telegraphic, telephone and other communications, and permits monitoring, inspection, suspension or seizure only by judicial order and in accordance with the law, These are general constitutional safeguards; the Personal Data Protection Law provides more specific rules for data processing and data-subject rights.

Article 4 of Jordan's Personal Data Protection Law No. 24 of 2023 recognises every natural person's right to the protection of their data, Subject to Article 6, it lists data-subject rights including knowing about, accessing and obtaining data held by the controller; withdrawing prior consent; correcting or updating data; restricting processing; and requesting erasure or concealment in accordance with the Law.

The listed rights also include objecting to certain processing or profiling, transferring a copy of data to another controller, and being informed of a breach affecting data security and integrity, Article 4 further provides that exercising these rights does not itself entail financial or contractual consequences, without prejudice to the controller's rights.

Article 4 makes data protection the general rule: processing requires prior consent or a case permitted by law, Article 5 requires consent to be explicit and documented, specific as to purpose and duration, and requested in clear, simple, non-misleading language, Consent is not valid if obtained through incorrect information or misleading practices, or if the nature, type or purpose of processing changes without consent.

Article 6 lists cases in which processing may be lawful without prior consent or notice, within the limits of each case, Examples include a competent public body's lawful functions, specified medical purposes, protecting life or vital interests, crime prevention or prosecution by a competent authority, carrying out legislation or a court ruling, and certain research, statistical, national-security or public-interest purposes.

Article 6 also provides that data must not be retained after the purpose of processing has been fulfilled unless legislation provides otherwise, A legal retention duty or another lawful basis can therefore affect an erasure request.

Article 7 requires processing to serve a legitimate, specific and clear purpose, remain consistent with the purpose for which data was collected, use lawful means, and rely on true, accurate and updated data, It also requires confidentiality and integrity and prohibits processing that harms the data subject or prejudices their rights.

Article 8 requires controllers to protect data, establish and publish mechanisms for processing and complaints, respond to complaints, and provide ways for data subjects to exercise their rights, Before processing begins, Article 9 generally requires notice of the data, purpose and duration of processing, other processors involved, security controls and profiling information, subject to statutory exceptions.

Article 13 treats processed data as confidential and requires controllers and processors to maintain confidentiality, Article 14 regulates transfers and exchanges, including legitimate interests, notice of the recipient and intended use, and consent for transfers intended to market products or services.

Article 10 governs requests for erasure or concealment, The listed circumstances include processing for a purpose different from the one for which data was collected or inconsistent with consent; withdrawal of the consent on which processing depended unless other legislation provides otherwise; processing contrary to the Law or its implementing rules; and a circumstance connected with performing a legal or contractual obligation, The provision should be read in the context of the full Arabic text and the facts.

Article 10 expressly excludes from its erasure and concealment provisions processing conducted under Article 6, A request alone therefore does not establish that data must be erased; the purpose, consent, legal basis, exceptions and any statutory retention rule must be assessed.

Regulation No. 68 of 2025 for the Organization of Data Subject Rights sets out the request procedure: a data subject submits a request to the controller, which must verify the applicant's identity and respond within 15 working days, A justified extension is permitted if the data subject is told about the extension and its reasons.

Article 4 addresses data previously transferred to a recipient or processor: the controller must consider whether it can be deleted, ensure the recipient erases it, or notify the applicant and provide the recipient's contact information if deletion cannot be ensured.

The Regulation also addresses complaints to controllers, Article 8 requires a complaint mechanism and a response within 10 working days; if there is no response, the matter may be escalated to the competent authority without prejudice to judicial remedies.

The Ministry of Digital Economy and Entrepreneurship states that a complaint about a data-protection violation should first be submitted to the entity concerned, and may then be escalated to the Personal Data Protection Directorate through the announced government channels if appropriate action is not taken.

Article 18 assigns the competent regulatory unit responsibilities that include receiving notices and complaints about violations of the Law and its implementing rules, investigating them and submitting recommendations to the Personal Data Protection Council, The Ministry publishes practical complaint channels and procedures.

Where a data-security breach is likely to cause severe harm, Article 20 requires the controller to notify affected data subjects within 24 hours of discovery and notify the Unit within 72 hours with the information specified by the Law, A controller that causes gross fault or wilful misconduct is liable to compensate the data subject.

Articles 21 and 22 provide measures and penalties for violations, without prejudice to any stricter penalty under another law, and preserve the injured person's right to claim civil compensation, The requirements and competent authority differ by measure; these provisions do not mean that every complaint automatically results in compensation or a penalty.

Erasing data held by an organisation and removing a search-engine result are different matters, Content may remain on its original website even if its visibility is challenged elsewhere, and the availability of a request depends on applicable law, where data is processed, the content and the public interest.

Article 17 of the European Union's General Data Protection Regulation is a comparative example of a statutory right to erasure, but it does not automatically apply to every situation in Jordan, The theoretical label alone cannot establish that a link or page must be removed.

Jordan's Personal Data Protection Law classifies data concerning a criminal record as sensitive personal data, That classification does not, by itself, erase a judgment or remove an entry from a judicial or official register; those are distinct legal questions and procedures.

A request to erase data held by a controller must be distinguished from correcting an official entry, seeking legal rehabilitation or removing a legal consequence where legislation permits it, The type of record, the body holding it and any specific rules on access or amendment must be identified.

Digital forgetting raises a difficult balance between privacy and data correction on one side, and the public's interest in access to information on the other, Relevant considerations may include accuracy, age, publication purpose, the data subject's role, the legal basis for retention and the potential harm of continued availability.

It is therefore more accurate to treat digital forgetting as a discussion of specific rights and legal balancing, not as a promise to delete every digital trace or past record.