Article 7 of the Jordan PDPL establishes the lawful basis requirement for all processing of personal data. (1) Lawful Basis Categories per Article 7: (a) Consent of data subject (freely given + specific + informed + unambiguous); (b) Necessary for performance of contract to which data subject is party + or for steps requested prior to contract; (c) Necessary for compliance with legal obligation to which controller is subject; (d) Necessary to protect vital interests of data subject or another natural person (life/limb); (e) Necessary for performance of task in public interest or exercise of official authority; (f) Necessary for legitimate interests of controller or third party (except where overridden by fundamental rights of data subject). (2) Consent Requirements: (a) Freely Given - not bundled with non-essential conditions; (b) Specific - to defined purposes; (c) Informed - data subject understands implications; (d) Unambiguous - clear affirmative action; (e) Withdrawable - data subject right to withdraw without detriment; (f) Documented - audit trail of consent + version; (g) For children under 16 - parental consent required (lower threshold may apply for ICT services per regulation); (h) Refresh consent for material new purposes; (i) Pre-ticked boxes + silence + inactivity do NOT constitute consent. (3) Contract Performance Basis: (a) Necessary for performance of contract to which data subject is party; (b) Necessary for pre-contractual steps requested by data subject; (c) Limited to data actually needed for contract performance; (d) Not applicable to processing beyond contract scope; (e) Used for banking + insurance + utilities + employment + commercial transactions. (4) Legal Obligation Basis: (a) Compliance with Jordanian law obligations; (b) Anti-Money Laundering + Counter Terrorism Financing; (c) Tax compliance + Income Tax Department; (d) Employment law compliance + Social Security Corporation; (e) Health regulations + reporting obligations; (f) Court orders + judicial proceedings; (g) Regulatory compliance (financial + telecom + insurance). (5) Vital Interests Basis: (a) Life-threatening + serious physical danger; (b) Emergency medical care; (c) Unable to give consent (unconscious + minor + incapacity); (d) Last resort basis. (6) Public Interest Basis: (a) Statutory authority for public sector; (b) Public task definition; (c) Necessary + proportionate; (d) Census + public health emergency + statistical purposes; (e) National security + defence (subject to safeguards per Article 3). (7) Legitimate Interests Basis: (a) Three-step test - identify legitimate interest + necessity + balancing against data subject rights; (b) Compelling commercial interests of controller; (c) Third party interests; (d) Public interest considerations; (e) Not applicable to processing of children's data + special categories; (f) Reasonable expectations of data subject; (g) Privacy Impact Assessment recommended. (8) Privacy Notice + Transparency: (a) Privacy Notice required at point of collection per Article 11; (b) Identity of controller + DPO + purposes + lawful basis + categories + recipients + retention + rights + transfer information; (c) Plain Arabic language + accessible to data subject; (d) Update + change notification + version control; (e) Multiple stakeholder versions (executive + employee + customer + supplier). (9) Special Conditions for Sensitive Data per Article 6: (a) Processing of Sensitive Personal Data prohibited unless one of these conditions applies; (b) Explicit consent (specific to sensitive data + informed of consequences); (c) Employment law obligations including occupational health; (d) Vital interests where data subject incapable of consent; (e) Non-profit body (political/religious/philosophical) for own membership; (f) Public health + occupational medicine + healthcare provision; (g) Legal claims + judicial proceedings + court orders; (h) Substantial public interest with safeguards; (i) Archive + research + statistics with safeguards. (10) Children's Data per Article 8: (a) Enhanced protection for personal data of children under 16; (b) Parental + guardian consent for processing of children's data; (c) Age verification mechanisms; (d) Reasonable steps to verify parental consent; (e) Child-friendly Privacy Notice; (f) No behavioural advertising or profiling for marketing to children; (g) Prohibition on detrimental processing. Coordinates with EU GDPR Articles 5 + 6 + 7 + 8 + 9 + UAE PDPL Article 5 + Saudi PDPL Article 6 + Bahrain PDPL Article 4 + Convention 108+ + EDPB Guidelines on Consent + Jordan Anti-Money Laundering Act 2007 + Jordan Children's Protection Bill + Jordan Code of Personal Status + Sharia law considerations + Jordan Social Security Corporation + Income Tax Department + Central Bank of Jordan + Ministry of Health + Telecommunications Regulatory Commission. Jordan PDPL Standard 1 + Article 7 applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.