Articles 16-19 of the Jordan PDPL establish comprehensive data subject rights closely modelled on EU GDPR + UAE PDPL + with Arabic legal tradition adaptation. (1) Article 16 Right to Information: (a) Information at point of collection - Privacy Notice content per Article 11; (b) Information about processing throughout lifecycle; (c) Information about rights and how to exercise; (d) Plain Arabic language + accessible; (e) Free of charge for initial information; (f) Just-in-time notice for material changes. (2) Article 17 Right of Access: (a) Right to confirmation whether personal data being processed; (b) Right to copy of personal data; (c) Right to supplementary information (purposes + categories + recipients + retention + rights + sources + automated decision-making); (d) Response within 30 calendar days; (e) Extension up to 60 days for complex requests with notification; (f) Free for first request per year; (g) Reasonable fee for additional or excessive; (h) Refusal grounds limited - manifestly unfounded + excessive frequency + threat to others' rights; (i) Refusal must be reasoned + appealable to Council. (2) Article 18 Right of Correction (Rectification) + Right of Erasure + Right of Restriction: (a) Right to correct inaccurate data; (b) Right to complete incomplete data; (c) 30-day response timeline; (d) Notification to recipients of correction; (e) Right of Erasure (Right to be Forgotten) on grounds of (i) no longer necessary; (ii) consent withdrawn; (iii) objection upheld; (iv) unlawful processing; (v) legal obligation; (vi) child consent revocation; (f) Right of Restriction where accuracy contested + processing unlawful but data subject opposes erasure + controller no longer needs but data subject requires for legal claims + objection pending review; (g) Reasoned refusal + appealable; (h) Restrictions per legal preservation + public interest + freedom of expression. (3) Article 19 Right to Data Portability: (a) Right to receive personal data in structured + commonly used + machine-readable format; (b) Right to transmit to another controller; (c) Applies where processing based on consent or contract + carried out by automated means; (d) Does NOT apply to processing for public interest task; (e) Not to the right or freedoms of others; (f) Technically feasible direct transmission preferred. (4) Right to Object per Article 16-17 (combined with Right of Access framework): (a) Right to object to processing including profiling for public interest task or legitimate interests; (b) Controller MUST stop unless compelling legitimate grounds OR for establishment/defence of legal claims; (c) Absolute right to object to direct marketing including profiling; (d) Absolute right to object to scientific/historical research/statistical that does not involve public interest task. (5) Automated Decision-Making Rights (similar to EU GDPR Article 22): (a) Right not to be subject to decision based solely on automated processing including profiling which produces legal effects or significantly affects; (b) Exceptions - explicit consent + contract performance + legal authorisation with safeguards; (c) Mandatory safeguards including human intervention + ability to express views + ability to contest decision; (d) NO solely automated decisions based on sensitive data (Article 6) except explicit consent or substantial public interest; (e) Emerging Jordan AI Strategy alignment. (6) Subject Rights Mechanism Requirements: (a) DSAR portal + identity verification proportionate to risk; (b) Workflow + ticketing + SLA tracking; (c) Audit trail of requests + decisions + actions; (d) Downstream propagation to recipients + sub-processors; (e) DPO oversight + escalation; (f) Council appeal; (g) Court action under Article 23 for compensation. (7) Children's Specific Rights: (a) Article 8 enhanced rights; (b) Parental + guardian intervention; (c) Age-appropriate communication; (d) Right of erasure for childhood consent given when adult. (8) Refusal Grounds + Limitations: (a) National security + defence; (b) Crime prevention + investigation + prosecution; (c) Public economic + financial interests; (d) Judicial independence + proceedings; (e) Breaches of ethics for regulated professions; (f) Monitoring + inspection + regulatory functions; (g) Data subject protection + others; (h) Enforcement of civil law claims; (i) Manifestly unfounded + excessive frequency. (9) Penalties for Rights Violations: (a) Article 22-23 administrative penalties for failure to enable rights; (b) Council escalation; (c) Civil compensation per Article 23; (d) Reputational + customer trust damage. (10) Practical Implementation: (a) DSAR portal in Arabic + English; (b) Identity verification - National Number + Sanad + biometric option; (c) 30-day response SLA tracking; (d) DPO oversight + escalation; (e) Customer service surge handling; (f) Council reporting + transparency report. Coordinates with EU GDPR Articles 12-22 + UAE PDPL Articles 13-20 + Saudi PDPL Articles 13-19 + Convention 108+ Article 9 + ISO/IEC 27701 + Jordan Constitution + Sanad National Digital ID + National Number + Department of Civil Status + Telecommunications Regulatory Commission + Central Bank of Jordan + Ministry of Health. Jordan PDPL Data Subject Rights + Articles 16-19 apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.