Articles 4-6 of the Jordan PDPL establish the Personal Data Protection Council (Majlis Himayat al-Bayanat al-Shakhsiyya مجلس حماية البيانات الشخصية) as the primary regulatory authority. (1) Article 4 Establishment: (a) Council established as independent regulatory body; (b) Affiliated with Ministry of Digital Economy and Entrepreneurship (MoDEE); (c) Legal personality + independent budget; (d) Authority over public + private sector controllers and processors; (e) Reports annually to Prime Minister and House of Representatives. (2) Article 5 Composition: (a) Chair appointed by Council of Ministers on Prime Minister recommendation; (b) Term 4 years renewable; (c) Members include - Government representatives (Justice + Interior + Foreign Affairs); (d) Private sector representation; (e) Academic representation; (f) Civil society representation; (g) Technical experts (cybersecurity + ICT); (h) Legal experts; (i) Total 9-13 members typical; (j) Independence requirements + conflict of interest rules. (3) Article 6 Functions: (a) Issue regulations + guidance + codes of conduct; (b) Monitor compliance + sector inspection; (c) Receive + investigate complaints; (d) Issue administrative penalties; (e) Cooperate with foreign data protection authorities; (f) Public education + awareness; (g) Annual report to Government; (h) Maintain register of controllers (where required); (i) Approve cross-border transfer mechanisms; (j) Advise on data protection legislative developments; (k) Issue licensing for certain data processing activities (subject to regulations). (4) Investigation Powers per Article 6 + 19: (a) Initiate investigation on own motion or based on complaint; (b) Access controllers/processors information + premises; (c) Require production of documents + records; (d) Interview personnel; (e) On-site inspection; (f) Forensic examination; (g) Witness statements under oath; (h) Subpoena power; (i) Cooperation requirement of controllers + processors. (5) Administrative Penalties per Article 22-23: (a) Article 22 standard violations - JOD 1,000 to JOD 50,000; (b) Article 23 severe violations (sensitive data + repeat + willful) - JOD 50,000 to JOD 100,000; (c) Penalty doubled for further repeat; (d) Considerations - nature + gravity + duration + intentional/negligent + mitigation + responsibility + previous infringements + cooperation + categories of data + harm; (e) Appeal procedures via Administrative Court. (6) Compliance Notice + Corrective Orders: (a) Council may issue Compliance Notice requiring specific actions within specified time; (b) Cessation Orders for ongoing violations; (c) Reinstatement Orders for affected data subjects; (d) Public Naming for serious violations; (e) License Revocation for licensed processing activities; (f) Industry-wide Guidance for sector violations. (7) International Cooperation: (a) Bilateral Memorandum of Understanding with foreign DPAs; (b) Mutual assistance in cross-border investigations; (c) Information sharing within legal frameworks; (d) Adequacy assessments + recognition (Jordan emerging Adequacy candidacy with EU); (e) Council of Europe Convention 108+ accession process; (f) Arab League Data Protection coordination. (8) Coordination with Other Jordan Bodies: (a) Cybersecurity National Centre - cyber incidents + critical infrastructure; (b) Central Bank of Jordan - financial sector; (c) Telecommunications Regulatory Commission - telecom; (d) Jordan Securities Commission - capital markets; (e) Sanad National Digital ID system + data; (f) Department of Civil Status and Passports - identity data; (g) Ministry of Health - health data; (h) Ministry of Education - student data; (i) Ministry of Justice - judicial coordination; (j) Anti-Money Laundering Unit - AML/CFT. (9) Industry Self-Regulation: (a) Code of Conduct approval by Council; (b) Industry Codes for specific sectors (banking + healthcare + retail + telecom); (c) Privacy Mark + Certification mechanisms; (d) Industry Association coordination (Jordan Banks Association + Jordan Insurance Federation + etc.). (10) Capacity Building: (a) Council technical + legal capacity building; (b) Personnel training + certification; (c) International exchanges; (d) Donor support (EU + USAID + UNDP); (e) Industry awareness programs; (f) Public education campaigns. Coordinates with MoDEE Ministry of Digital Economy and Entrepreneurship + Cybersecurity National Centre + Central Bank of Jordan + Telecommunications Regulatory Commission + Jordan Securities Commission + Sanad + Department of Civil Status + Ministry of Health + Ministry of Education + Ministry of Justice + Anti-Money Laundering Unit + Administrative Court + Council of Europe Convention 108+ + EU EDPB + Arab Convention on Cybercrime + UNDP + EU Twinning + USAID + ISO/IEC 27701. Jordan PDPL Personal Data Protection Council + Articles 4-6 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.