Articles 20-21 of the Jordan PDPL govern cross-border transfers of personal data closely modelled on EU GDPR Chapter V. (1) Article 20 General Prohibition: Cross-border transfer prohibited unless one of these grounds applies (a) Adequacy Determination by Council; (b) Appropriate Safeguards approved by Council; (c) Specific Derogations; (d) Council Authorisation. (2) Adequacy Determinations: (a) Council determines third country provides adequate level of protection; (b) Consideration includes (i) rule of law + respect for human rights; (ii) data protection legislation + enforcement; (iii) supervisory authority independence; (iv) international commitments; (v) Convention 108+ accession; (c) Council has discretion + may issue partial or sectoral adequacy; (d) Emerging Jordan adequacy assessment process + EU EDPB engagement (Jordan as Adequacy candidate); (e) GCC Gulf Cooperation Council coordination - UAE PDPL + Saudi PDPL + Bahrain PDPL + Kuwait DPL adequacy assessments. (3) Appropriate Safeguards per Article 21 + emerging regulations: (a) Standard Contractual Clauses (SCCs) approved by Council; (b) Binding Corporate Rules (BCRs) approved by Council; (c) Code of Conduct approved + binding; (d) Certification mechanism approved; (e) Legally binding instrument between public authorities; (f) Ad hoc contractual clauses authorised by Council. (4) Specific Derogations for individual transfers: (a) Explicit consent of data subject (informed of risks); (b) Necessary for performance of contract with data subject; (c) Necessary for conclusion + performance of contract in data subject's interest; (d) Important reasons of public interest; (e) Establishment + exercise + defence of legal claims; (f) Vital interests where data subject incapable of consent; (g) Public register transfers (limited); (h) Compelling legitimate interests (limited scope + Council notification). (5) Council Approval Process: (a) Application to Council with transfer details; (b) Risk assessment + legal review; (c) Public consultation for material transfers; (d) Decision within 30-90 days; (e) Conditions may be attached; (f) Periodic review + revocation power; (g) Public register of approved mechanisms. (6) US-Specific Transfer Concerns: (a) Post-Schrems II considerations; (b) US surveillance laws (FISA Section 702 + Executive Order 12333) impact on transfers; (c) EU-US Data Privacy Framework reference; (d) Transfer Impact Assessment (TIA) recommended; (e) Jordan + US bilateral arrangements emerging. (7) GCC Regional + Arab Coordination: (a) Gulf Cooperation Council data flow easements emerging; (b) Bilateral arrangements between Arab states; (c) UAE-Jordan-Saudi-Kuwait-Bahrain coordination; (d) League of Arab States Data Protection Framework discussions; (e) Arab Convention on Combatting Information Technology Offences. (8) Cloud-Based Processing: (a) Hyperscaler cloud (AWS + Azure + GCP) with data residency in Jordan/Gulf region increasingly available; (b) Data export to processor in adequacy jurisdiction; (c) Sub-processor chain transparency required; (d) Council awareness + approval for material cloud arrangements. (9) Transfer Impact Assessment (TIA): (a) Risk assessment for each transfer destination; (b) Legal regime evaluation; (c) Supplementary measures (encryption + pseudonymisation + access restriction); (d) Periodic review; (e) Council consultation for high-risk. (10) Penalties for Unlawful Transfers: (a) Article 22-23 administrative penalties; (b) Disclosure penalty intersection; (c) Civil compensation per Article 23; (d) Injunctive relief; (e) Cessation Orders + Reinstatement. (11) Sectoral Considerations: (a) Banking + Central Bank of Jordan regulations; (b) Health data cross-border to GCC; (c) Insurance data; (d) Telecommunications data; (e) Government data sovereignty considerations. Coordinates with EU GDPR Chapter V Articles 44-50 + UAE PDPL Articles 21-22 + Saudi PDPL Articles 21-22 + Convention 108+ Article 14 + GCC Gulf Cooperation Council + League of Arab States + Arab Convention on Cybercrime + Jordan Central Bank + Telecommunications Regulatory Commission + Ministry of Health + Sanad National Digital ID + Department of Civil Status. Jordan PDPL Cross-Border + Articles 20-21 apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.