Circular No. 10/2/2025 on Accrediting Personal Data Protection Commissioners for Banks in Jordan

No.: 10 / 2 / Date: / / 1447 AH Corresponding to: / / 2025 AD Circular to Banks Operating in the Kingdom No. ( /2025)

Greetings,

In light of the issuance of Personal Data Protection Law No. (24) of 2023, the approval of the Personal Data Protection Commissioner's accreditation document by the Personal Data Protection Council, and based on the provisions of paragraph (b) of Article (17) of the aforementioned Law, we confirm the following:

1. The necessity of compliance with the aforementioned Law and Document.
2. Adherence to the attached accreditation mechanism and other requirements stipulated in the aforementioned Document regarding the appointment of a Personal Data Protection Commissioner.
3. Providing the Central Bank of Jordan – Banking Supervision Department with the attached declaration, duly authenticated, within a maximum period of the end of the third quarter of 2025.

Attached is the mechanism for accrediting the Personal Data Protection Commissioner for banks operating in the banking sector. Attached is the Personal Data Protection Commissioner's declaration.

Please accept our highest regards,

The Governor Dr. Adel Al-Sharkas

Mechanism for Accrediting the Personal Data Protection Commissioner for Banks Operating in the Banking Sector:

First: Appointment: The Bank must notify the Central Bank of Jordan of the appointment of an internal Personal Data Protection Commissioner from its staff before commencing their work, with an undertaking to facilitate the Commissioner's work and protect their independence in accordance with Article (5) of the Personal Data Protection Document. We emphasize the necessity of attaching the following: a recommendation from the relevant committee emanating from the Board of Directors, the Board of Directors' decision approving the appointment of the Commissioner, and documents reinforcing the candidate Commissioner's specialized knowledge in data protection (academic qualification certificate/professional certificate/experience certificates) and integrity (certificate of no criminal record).

Second: Independence: The Personal Data Protection Commissioner is linked to the Bank's Board of Directors through one of the relevant committees emanating from the Board of Directors.

Third: Separation: The Bank must notify the Central Bank of Jordan before the separation of the Personal Data Protection Commissioner from their work (whether by resignation or termination of services), specifying the date of the end of their work and the reasons for it. We emphasize the necessity of ensuring that this position does not remain vacant.

Fourth: Responsibility for Verifying the Continued Suitability of the Personal Data Protection Commissioner: The relevant committee emanating from the Bank's Board of Directors is responsible for verifying, initially and continuously, the suitability of the Personal Data Protection Commissioner for the Bank.

We note that the tasks of the aforementioned relevant committee and Board of Directors fall upon the Audit Committee of the foreign bank's branch.

Personal Data Protection Commissioner's Declaration

Commissioner's Personal Information: Commissioner's Name: National ID Number: Permanent Residence: Phone Number: Email Address: Date and Place of Birth:

2. Details of the Commissioner's academic qualifications and/or professional certificates and/or experience certificates: ......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

3. I, ............................, Personal Data Protection Commissioner for ............................ Bank, hereby certify the accuracy of the above data and that I have not previously been/ do not currently have: A conviction for a misdemeanor involving honor, morality, public decency, or honesty, or any felony. Dismissal from any position due to dishonesty or breach of assigned duties. Any conflict of interest between the Bank and myself.

Signature: ............................................. Date: ..............................................

Bank Authentication