Articles 22-24 of the Jordan PDPL establish the comprehensive penalty + enforcement framework. (1) Article 22 Administrative Violations - Standard: (a) Violations of general processing obligations; (b) Privacy Notice failures; (c) ROPA failures; (d) Lawful basis missing or inadequate; (e) Penalty range JOD 1,000 to JOD 50,000 per violation; (f) Considerations - nature + gravity + duration + intentional/negligent + mitigation + responsibility + previous + cooperation + categories of data + harm. (2) Article 23 Severe Violations - Heightened: (a) Processing of sensitive personal data without legal basis; (b) Violation of children's data protections; (c) Cross-border transfer without authorisation; (d) Failure to notify breach; (e) Failure to enable data subject rights; (f) Repeated standard violations; (g) Willful or grossly negligent conduct; (h) Penalty range JOD 50,000 to JOD 100,000 per violation; (i) Public naming permitted. (3) Article 24 Repeat + Aggravated Violations: (a) Doubled penalty for repeat of same violation within 2 years; (b) License revocation for licensed activities; (c) Operational suspension; (d) Public naming + sector blacklisting; (e) Personal liability for directors + officers; (f) Referral for criminal prosecution. (4) Civil Compensation per Article 23: (a) Right to compensation for damages caused by violation; (b) Material damage (financial loss + property + medical); (c) Non-material damage (distress + anxiety + reputational); (d) Joint and several liability of joint controllers + controller-processor; (e) Limitation period 3 years from awareness; (f) Class action possible per Civil Procedure Code. (5) Criminal Penalties: (a) Willful unauthorised disclosure + use - up to 3 years imprisonment + JOD 100,000 fine; (b) Gross negligence causing material harm - up to 1 year imprisonment + JOD 50,000 fine; (c) Concealment + destruction of evidence - up to 2 years imprisonment + JOD 50,000 fine; (d) Personal criminal liability for directors + officers; (e) Reasonable Care defence available. (6) Reasonable Care Defence per Articles 22-23: (a) Person took all reasonable precautions and exercised all due diligence; (b) Burden on accused; (c) Corporate due diligence systems essential; (d) Documentation of training + policies + procedures; (e) Compliance audit + internal review records. (7) Director + Officer Liability: (a) Corporate offences attributable to director + officer who consented + connived + neglected; (b) Personal criminal liability for material violations; (c) Corporate veil pierced; (d) D and O insurance considerations; (e) Indemnification limits; (f) Personal financial exposure. (8) Training + Awareness Requirements: (a) Mandatory data protection training for all personnel; (b) Annual refresher training; (c) Role-based specialised training; (d) DPO + privacy team specialised certifications; (e) Customer service training on rights; (f) Vendor training requirements via contract; (g) Documentation of training completion. (9) Council Investigation + Enforcement Procedure: (a) Complaint receipt + admissibility check; (b) Preliminary investigation; (c) Formal investigation + evidence gathering; (d) Interim measures; (e) Provisional findings + right to respond; (f) Final decision + reasoning; (g) Penalty determination + proportionality; (h) Appeal to Administrative Court then Supreme Administrative Court. (10) Cumulative Penalty Exposure: (a) Administrative + criminal + civil typically separate; (b) Double jeopardy considerations for criminal; (c) Administrative penalty does not bar civil claim; (d) Settlement strategies; (e) Reputational damages typically uninsurable. (11) Board + Senior Management Accountability: (a) Tone-at-the-top; (b) Risk Appetite Statement + Privacy Risk Tolerance; (c) Quarterly Privacy Reporting to Board; (d) Annual Privacy Risk Review; (e) Audit Committee oversight; (f) ESG reporting including privacy; (g) Investor + Lender + Insurer scrutiny. Coordinates with EU GDPR Articles 82-84 + UAE PDPL Article 26 + Saudi PDPL Articles 32-37 + Jordan Constitution + Civil Procedure Code + Companies Act Director Duties + Insurance Act + FSC Cybersecurity Guidelines + Risk Management ISO 31000 + Crisis Management + Communications Strategy + Administrative Court + Supreme Administrative Court + Council of Ministers. Jordan PDPL Penalty + Articles 22-24 apply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.