Cybersecurity law & regulation in Jordan (2026)

The National Cybersecurity Center disclosed that it handled 6,758 incidents in 2024 (up from 2,455 in 2023), issuing 6,922 alerts and detecting 97% of incidents before significant harm occurred. The spike, attributed to digital transformation and regional geopolitical tensions, prompted the concurrent adoption of a new multi-year strategy.

Jordan's National Cybersecurity Council formally adopted the 2025-2028 National Cybersecurity Strategy, backed by an execution plan of 42 programmes across 51 projects structured around four strategic priorities: security and reliability, cyber resilience, cyber transformation, and cooperation and partnerships. This is Jordan's third dedicated national cybersecurity strategy and introduces a performance-indicator-driven implementation framework overseen by the NCSC.

Jordan's NCSC released the National Cybersecurity Framework: Detailed Capabilities Explanation alongside a standalone 2025-2028 Energy Sector Cyber Security Strategy, extending binding cybersecurity capability requirements beyond government networks to critical infrastructure operators for the first time. These documents form the compliance architecture that organisations must now map against.

Published in Official Gazette No. 5881 on 17 September 2023, Law No. 24 of 2023 entered into force on 17 March 2024 with full enforcement beginning 17 March 2025. It imposes data-controller obligations, breach-notification requirements, and proportionality standards across private and public sectors, directly complementing the cybersecurity legal framework.

Published in the Official Gazette on 13 August 2023 and effective 13 September 2023, Law No. 17 of 2023 repealed Law No. 27 of 2015 and expanded Jordan's cybercrime statute from 17 to 41 articles, criminalising a wider range of intrusion offences, financial fraud, and online speech; it imposes new compliance obligations on digital service providers and hefty penalties for violations.

Pursuant to Cybersecurity Law No. 16 of 2019, Jordan stood up both the National Cybersecurity Council (policy body chaired by the Prime Minister) and the NCSC (operational authority) in early 2021; in its first full year the NCSC countered approximately 800 cyber attacks on government networks. These two institutions became the central regulatory and incident-response pillars of Jordan's framework.

Endorsed by Parliament on 30 July 2019 and promulgated as Law No. 16 of 2019, this is Jordan's foundational cybersecurity legislation: it mandated creation of the National Cybersecurity Council and NCSC, defined critical-infrastructure protection obligations, and authorised the NCSC to issue binding cybersecurity standards for public and private entities. All subsequent institutional architecture rests on this law.

Jordan's Ministry of Digital Economy and Entrepreneurship published its second national cybersecurity strategy, structuring objectives across governance, technical capability, legal reform, capacity building, and international partnerships over a five-year horizon. It directly preceded and informed the drafting of the 2019 Cybersecurity Law and the institutional structures that followed.

Jordan and NATO jointly inaugurated the Jordan Computer Emergency Response Team (JoCERT) as an operational unit under what would become the NCSC, formalising a national incident-response capability with direct NATO technical backing; JoCERT subsequently became a member of FIRST, integrating Jordan into the global CERT network.

Jordan replaced its 2010 cybercrime law with the more comprehensive Law No. 27 of 2015, consolidating offences covering unauthorised access, electronic financial fraud, privacy violations, and online speech crimes, and increasing penalties. It governed digital misconduct for eight years until superseded by the 2023 Cybercrime Law.

Jordan's Ministry of ICT published the inaugural NIACSS, establishing a five-pillar framework (organisation, technical, legal, capacity building, partnerships) and calling for a central national information-assurance authority and a national CERT; the document was registered in the ITU's National Strategies Repository. It anchored all subsequent legislative and institutional development.