It is reported that the Telecommunications Regulatory Commission (TRC), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Art. 15 of the Personal Data Protection Law provides that any cross-border transaction of personal information must be transferred to a party that has a sufficient level of data protection. The level of protection afforded to a data recipient is equivalent to that imposed by Jordanian laws and regulations, except in the following cases: judicial cooperation is established under international conventions and treaties; international cooperation in the field of combating crimes; data exchange is essential for patient treatment; data exchange is related to epidemiological and health disasters or public health related to Jordan; the data subject has approved the transfer of data after being made aware that the level of protection outside the jurisdiction is not equivalent to the level imposed by Jordanian laws and regulations; and transfer of funds abroad.

Jordan has not joined any agreement with binding commitments to open transfers of data across borders.

Law No. 24 provides a comprehensive regime of data protection in Jordan. The provisions of the Law are applicable to any personal and sensitive information processing of natural persons, whether such data was collected or processed before or after the effectiveness of the Law within Jordan, and apply to controllers who are also based outside of Jordan. The Law also applies to both domestic and international data transfers. In addition, the Law outlines several rights for individuals, namely the right to be informed, to access and obtain held data by the data controller, to object and withdraw consent, to correct, amend, add or update data, to restrict data processing, to be forgotten, to ensure data is erased, and to data portability. Furthermore, the Law includes obligations regarding the notification of data infringements and breaches to individuals.

The Instructions of Anti-Money Laundering and Counter-Terrorist Financing For Electronic Payments and Money Transfer Companies No. 12/2018, issued under the Payment and Transfer of Money Regulation No. 111/2017, introduces a data retention requirement of five years for transaction data and system logs (Art. 13).

Art. 11.a of the Personal Data Protection Law provides that the controller shall be committed to appointing a DPO in the following instances:
- If the main business of the controller is the processing of personal data;
- They process sensitive personal data;
- They process the personal data of natural individuals who do not have legal capacity;
- Processing includes financial information;
- The responsible person transfers personal data outside Jordan;
- Any other case for which the Council decides to oblige the controller to appoint a DPO.
Pursuant to Art. 11.b.2 of the Personal Data Protection Law, one of the duties of the controller is to carry out a periodic assessment and evaluation of the database, data processing systems, and systems, preserving the security and safety of data. The controller must document the outcomes of such assessment, issue the necessary recommendations for protecting the data, and implement such recommendations alongside monitoring procedures adopted for protecting data and documenting compliance with the law and relevant legislation.

Art. 5 of the Regulation Regulating the Transportation of Passengers through Smart Applications provides that the Land Transport Regulatory Commission has the discretion to request from an operator of ride-hailing apps the information it holds in its database, specifically relating to the service provider, the vehicle, the passenger and ride.
It is reported that as a result of this regulation, the Ministry of Transportation, as well as judicial and security bodies, can access the companies’ servers and databases without a court order.

A basic legal framework on intermediary liability for copyright infringement is absent in Jordan's law and jurisprudence.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Jordan's law and jurisprudence.

Jordan’s SIM registration framework mandates that mobile network operators collect and retain users’ personal data alongside verifiable proof of identity. In addition, it is reported that the regulatory regime stipulates the implementation of biometric authentication procedures, specifically requiring the capture of fingerprints.

The Press and Publication Law No. 8 of 1998, as amended by Law No. 32 of 2012 on Press and Publication, imposes liability on intermediaries for the content posted on news sites, leaving outlets potentially responsible for readers’ comments. Art. 49 of the Law states that both the editors-in-chief and the owners of online publications are legally responsible for all content posted to their sites, resulting in a monitoring requirement. Moreover, websites must refrain from publishing any “untruthful” or “irrelevant” comments.

The government periodically blocks websites and social media platforms, sometimes without clear justification. Since 2015, authorities have routinely restricted access to messaging apps during the days when secondary school students sit for their national exams (Tawjihi). In December 2022, TikTok was blocked amid protests by truck drivers over fuel price increases; although described as a “temporary ban,” the app reportedly remained inaccessible until the end of 2024. In 2024, hundreds of news websites were reportedly blocked for failing to obtain a license. In August 2023, the LGBT+ dating app Grindr was also reportedly blocked and remained inaccessible through the end of 2024. Widely used VPN services—such as ExpressVPN, Proton VPN, NordVPN, and TunnelBear—were blocked shortly after the social media app Clubhouse became inaccessible in March 2021, and many of these VPNs remained inaccessible as of June 2024. VPNs that allow users to bypass censorship have been targeted repeatedly. According to the Telecommunications Regulatory Commission (TRC), by 2023 the total number of blocked websites and apps had reached 300, with several of these blocks reportedly enacted at the request of the Land Transport Regulatory Commission to restrict access to unlicensed rideshare apps.

Internet shutdowns are rare in Jordan, although they have occurred in the past. During 2024, authorities reportedly conducted internet shutdowns amid protests and continued their annual practice of disrupting access to messaging applications during high school exams.
In addition, the indicator "7.2.4 - Government Internet shut down in practice" of the V-Dem Dataset, which measures whether the government has the technical capacity to actively make internet service cease, thus interrupting domestic access to the internet or whether the government has decided to do so, has a score of 3 in Jordan for the year 2024. This corresponds to "Rarely but there have been a few occasions throughout the year when the government shut down domestic access to Internet."

Art. 15.b of the Government Procurement Regulation No. 8 of 2022 establishes a preference for domestic bidders or price preferences. Moreover, Art. 8.7 grants priority to domestic products over a foreign product if the bids are equivalent. The article stipulates that preference is given to local products determined by the Council of Ministers, provided that they fulfil the requirements stipulated in the purchase documents, and grants priority in terms of price only.

Jordan is not a party to the World Trade Organization (WTO) Agreement on Government Procurement (GPA). However, the country has been an observer of the WTO GPA since 2000.