Personal Data Protection in Palestine: Legal Accountability Under Decree-Law No. 24 of 2026
Palestine’s Data Protection Law: A New Regulatory Framework for Personal Data
The collection and use of personal information have become integral to the operations of businesses, financial institutions, public bodies, and nonprofit organizations. From employee records and customer databases to financial transactions and outsourced digital services, organizations routinely handle information whose collection, use, storage, and disclosure carry significant legal implications. In Palestine, these activities have previously been addressed through provisions across legislation governing e-commerce, electronic transactions, and other regulated activities.
The enactment of Decree-Law No. 24 of 2026 Concerning the Protection of Personal Data, published in Official Gazette No. 243 on October 27, 2026, introduces a comprehensive legal framework governing the processing and protection of personal information. The decree-law establishes principles for lawful processing, recognizes enforceable rights for individuals, defines responsibilities for parties handling personal data, and introduces regulatory oversight and penalties for noncompliance.
The decree-law also places legal responsibilities on organizations throughout the lifecycle of personal information, including how data is collected, the purposes for which it may be used, the circumstances under which it may be shared, and the responsibilities that arise when processing is entrusted to third parties. These developments have implications for organizational governance, contractual relationships, and the allocation of legal liability. They also raise important questions about the interaction between the new framework and existing legislation, particularly where data processing involves regulated sectors or crosses national borders.
Scope and Application: Who Falls Within the New Framework?
Decree-Law No. 24 of 2026 adopts a broad definition of personal data. Under Article 1, personal data encompasses information relating to an individual through which that person may be identified, directly or indirectly, whether the information is considered separately or in combination with other data. It also distinguishes sensitive personal data, including information relating to racial or ethnic origin, political affiliations, religious beliefs, health, and biometric or genetic characteristics.
The definition of processing is similarly extensive. It covers operations such as collection, recording, storage, modification, retrieval, use, disclosure, transfer, and deletion, whether conducted electronically or through non-electronic means. The law is consequently relevant to organizations maintaining conventional paper-based records as well as those relying on digital databases and automated systems.
Article 1 also distinguishes between data controllers, data processors, and data recipients. Their definitions encompass natural and legal persons, including public and private entities. The law therefore has implications for companies, banks, employers, healthcare providers, NGOs, professional service providers, and individual practitioners whose activities involve processing personal information. Their specific obligations depend on the nature of the processing and the role they perform.
Article 2 establishes a significant territorial dimension. The decree-law applies to controllers, processors, and recipients located within Palestine regardless of whether processing occurs domestically or abroad. It also extends to certain parties located outside Palestine where the data subject resides in Palestine or the processing concerns the provision of goods or services to a resident. This provision is particularly relevant to organizations operating through international service providers, foreign technology platforms, or cross-border contractual arrangements. Locating servers or outsourcing processing activities outside Palestine does not, by itself, place those activities beyond the decree-law’s scope. The breadth of Article 2 makes the territorial application of data protection obligations an important consideration in commercial arrangements involving more than one jurisdiction.
Allocating Responsibility: Data Controllers, Processors, and Recipients
One of the decree-law’s most consequential features is its allocation of responsibility among the parties involved in processing personal information.
Article 16 imposes extensive obligations on data controllers, including adopting organizational and technical measures, maintaining appropriate security procedures, managing risks, and establishing mechanisms through which individuals can exercise their rights. Article 17 separately regulates processors, requiring them to act in accordance with the controller’s instructions and their contractual arrangements, maintain appropriate safeguards, and refrain from unauthorized disclosure.
The distinction becomes particularly important where organizations rely on third parties to perform functions involving personal information. Businesses may outsource payroll processing, customer relationship management, database hosting, or other administrative and digital services. Similar arrangements are common among financial institutions, public bodies, and nonprofit organizations.
Under Article 19(2), a controller remains fully responsible toward the data subject for the processor’s activities concerning personal data. Accordingly, outsourcing a processing function does not necessarily transfer the associated legal responsibility away from the organization that controls the data.
Article 19(3) also addresses arrangements involving multiple processors. It requires their respective obligations, responsibilities, and roles to be documented; otherwise, the processors are treated as jointly liable for the obligations and responsibilities arising from processing. These provisions increase the legal importance of clearly structured agreements between organizations and their service providers. Article 26 adds a further dimension by imposing on data recipients the same obligations prescribed for controllers under the decree-law. This broad allocation of responsibility may be particularly relevant where information is shared between affiliated companies, financial institutions, service providers, or organizations implementing joint activities.
Lawful Processing, Consent, and the Limits of Data Sharing
The decree-law establishes substantive conditions governing when and how personal data may be processed.
Article 5 sets out principles including lawfulness, transparency, purpose limitation, data minimization, accuracy, confidentiality, and proportionality. These principles provide the foundation for the more detailed processing requirements established under subsequent provisions.
Article 6 identifies several circumstances in which processing is lawful. Consent is one such ground, but the law also recognizes processing necessary to fulfill legal or contractual obligations, comply with judicial decisions, perform specified public functions, or pursue a legitimate interest established before processing. Other grounds address circumstances including healthcare, emergencies, research, and certain legally accessible or anonymized information.
Consent is not the exclusive legal basis for processing personal information. Organizations must identify the applicable legal justification in light of the purpose and circumstances of the processing. Where processing is based on consent, Articles 9 and 10 establish additional safeguards. Consent must be clear, express, freely given, documented, and obtained before processing. Individuals may also withdraw or modify consent, with Article 9 requiring controllers to implement such requests within three working days of receiving written or electronic notification.
The decree-law further establishes rights that affect how organizations manage information after collection. Article 7 recognizes rights relating to information, access, correction, restriction, deletion, and data portability. It also addresses automated decisions producing legal effects, subject to the exceptions and safeguards established under Article 8. Article 15 governs requests for deletion, requiring controllers to act within seven days in the specified circumstances. However, the right is subject to important exceptions, including information retained to fulfill legal obligations, certain government records, health-related information, and other categories identified by the law.
A further distinction arises between the legal basis for processing information and the conditions governing its disclosure or transfer to another party. Article 24 establishes separate requirements for data sharing and transfers, including documented consent or written authorization from the supervisory authority, legitimate interests of the transferring and receiving parties, notification of the data subject, and appropriate security measures. It also requires controllers to assess the recipient’s level of protection, define the parties’ obligations, and maintain records of transfers. Article 25 provides exceptions to specified consent and notification requirements. These include transfers necessary to fulfill certain legal or contractual obligations, exchanges involving regulatory authorities, judicial cooperation, and specified banking, credit, and financial transactions.
The new framework must also be considered alongside existing sector-specific legislation. For example, Article 18 of Decree-Law No. 21 of 2025 on Electronic Commerce already establishes data protection responsibilities for electronic suppliers, including requirements concerning consumer consent, data minimization, confidentiality, and restrictions on the use and sharing of customer information.
Data Protection as an Organizational Governance and Compliance Obligation
The obligations introduced by the decree-law are relevant to internal governance as well as the contractual relationships through which information is processed. Article 16 requires controllers to establish technical, organizational, and security measures designed to protect personal information. These include adopting an accessible privacy policy, maintaining records concerning sensitive personal data, classifying information according to applicable standards, conducting periodic assessments, and providing mechanisms for receiving and addressing complaints. The provision also introduces annual reporting obligations relating to compliance, risks, data protection, and breaches. Several technical requirements, including classification criteria and assessment procedures, are to be developed further by the supervisory authority.
An important element of Palestine’s data protection law is the requirement to appoint a Data Protection Officer (DPO) in specified circumstances. Article 20 requires controllers to appoint a DPO where, among other circumstances, they are public bodies, their principal activity involves data processing, they process financial or health data, or their processing involves automated operations. Additional grounds concern high-risk activities, large-scale processing, and circumstances determined by the supervisory authority. These criteria could bring a substantial range of organizations within the appointment requirement, depending on their activities. The DPO may be an employee or an externally contracted professional. Under Article 21, the DPO’s responsibilities include monitoring compliance, advising the organization, reviewing safeguards, facilitating the exercise of data subjects’ rights, and coordinating with the supervisory authority.
Articles 18 and 23 further develop the framework through data breach reporting and data protection impact assessments. Article 18 requires controllers to take appropriate measures upon becoming aware of a qualifying data breach and to notify the supervisory authority in accordance with procedures and deadlines to be determined. It also addresses notification to affected individuals, subject to specified exceptions and further regulatory instructions. Processors must inform controllers immediately upon becoming aware of a breach. Article 23 requires data protection impact assessments before processing in circumstances designated by the supervisory authority. The above obligations place data protection within the broader structure of organizational risk management. Their implementation will require coordination between legal, management, human resources, information technology, and other functions responsible for handling personal information.
The Palestinian Framework in the Context of the EU GDPR
Palestine’s data protection law reflects several principles also found in the European Union’s General Data Protection Regulation (GDPR), particularly lawful and transparent processing, purpose limitation, individual rights, organizational accountability, and the distinction between controllers and processors.
Nevertheless, similarities in underlying principles should not obscure differences in their legal application. For example, the Palestinian decree-law establishes relatively broad circumstances requiring the appointment of a DPO, including the processing of financial or health data and automated processing. Article 37 of the GDPR adopts a more specifically defined approach, including requirements linked to certain large-scale processing and monitoring activities.
The two frameworks also differ in their treatment of international data transfers. Articles 24 and 25 of the Palestinian decree-law establish conditions and exceptions governing data sharing and transfers, while the GDPR provides a distinct international transfer regime under Articles 44–49, including adequacy decisions and appropriate safeguards. These differences are relevant to organizations operating across jurisdictions. Depending on their activities, Palestinian businesses may need to assess their obligations under the local framework alongside the GDPR’s separate territorial and substantive requirements. The GDPR therefore offers a useful comparative reference, particularly concerning accountability and international data governance. Its provisions should not, however, be treated as substitutes for the requirements established under Palestinian legislation.
Enforcement, Liability, and the Path to Compliance Under Palestine's Data Protection Law
The decree-law establishes a regulatory and enforcement framework intended to give practical effect to its obligations.
Article 1 identifies the Supervisory Authority for Trust Service Providers as the competent authority under the decree-law. Article 3 assigns it responsibilities including supervision, inspection, determining technical standards, receiving complaints, and taking corrective measures. The law therefore extends data protection oversight through an identified regulatory institution, while leaving numerous operational details to subsequent regulations and instructions.
Under Article 27, the authority may impose corrective measures, including warnings requiring violations to be remedied, cancellation of certification and conformity marks, financial penalties, and publication of established violations at the violator’s expense.
Article 28 separately establishes financial penalties for specified violations. Processing contrary to the lawful grounds established under Article 6 carries a fine ranging from JOD 20,000 to JOD 40,000. Other specified violations, including breaches of certain controller and processor obligations, may attract fines ranging from JOD 10,000 to JOD 20,000. The decree-law provides for penalties to be doubled in cases of repetition.
These sanctions operate alongside potential liability for damages. Article 19 establishes circumstances in which controllers are responsible for compensating individuals, while Article 27 preserves the possibility of criminal accountability and claims for compensation. Article 29 further permits the competent court, following a final conviction, to order the destruction of data or cancellation of the database concerned. The consequences of noncompliance may therefore extend beyond regulatory fines, particularly where an infringement results in harm to individuals or affects an organization’s ability to continue particular processing activities.
The timetable for implementation is equally important. Under Article 35, the decree-law enters into force 30 days after its publication in the Official Gazette, making its effective date November 26, 2026. Article 32 requires entities subject to the decree-law to bring their practices into compliance within 12 months of publication, establishing an initial adjustment deadline of October 27, 2027. The Council of Ministers may extend that period by a further 12 months.
Organizations must therefore begin assessing their practices against obligations already established by the decree-law while anticipating further requirements that may affect the procedures through which compliance is demonstrated. The significance of Decree-Law No. 24 of 2026 lies in the legal responsibilities it establishes throughout the processing of personal information. For individuals, it provides a clearer framework of rights and remedies. For businesses and institutions, it creates obligations that extend across internal operations, contractual arrangements, and third-party relationships.
As the implementing framework develops, the central challenge will be translating these statutory obligations into practices that are both legally compliant and suited to the nature of each organization’s activities. Kurdi & Co. assists businesses and institutions in navigating these requirements, including assessing compliance obligations, reviewing privacy policies and data-processing agreements, and advising on governance and liability risks. Contact our team to discuss how the new framework applies to your organization and the steps needed to ensure compliance.
FAQs
Yes. Decree-Law No. 24 of 2026 Concerning the Protection of Personal Data was published in Official Gazette No. 243 on October 27, 2026. It establishes a comprehensive framework governing personal data processing, individual rights, organizational responsibilities, regulatory oversight, and penalties. The law enters into force on November 26, 2026.
The law applies to individuals and organizations handling personal data, including businesses, financial institutions, employers, public bodies, NGOs, and professional service providers. Under Article 2, its scope also extends to certain entities operating outside Palestine, particularly where processing concerns individuals residing in Palestine or goods and services provided to residents.
No. Article 6 recognizes several lawful grounds for processing personal data, including consent, legal or contractual obligations, specified public functions, and legitimate interests established before processing. Where consent is the applicable legal basis, Articles 9 and 10 impose additional conditions concerning how it must be obtained, documented, and withdrawn.
Under Article 19(2), data controllers remain responsible toward data subjects for processing activities performed by processors. Outsourcing functions such as payroll, database management, or digital services therefore does not automatically transfer legal responsibility to the service provider. Article 19(3) also requires clearly documented responsibilities where multiple processors are involved.
Yes, in specified circumstances. Article 20 requires the appointment of a Data Protection Officer (DPO) for certain organizations and processing activities, including public bodies, organizations whose principal activity involves data processing, and entities processing financial or health data. Other grounds include automated processing, large-scale processing, and high-risk activities.
The law enters into force on November 26, 2026, under Article 35. However, Article 32 provides a 12-month adjustment period from the publication date, establishing an initial compliance deadline of October 27, 2027. The Council of Ministers may extend this period by another 12 months. Additional implementing regulations and instructions are also anticipated.
This Article was researched and written on November 4th, 2026 by KurdiLaw.
