Selling Cybersecurity Products in Jordan: Licensing and Contracts

By Jamal Hadidi, Managing Partner, Jamal Hadidi & Co.

A cybersecurity purchase often combines a product, a software licence and continuing support. For businesses supplying or buying these solutions in Jordan, the legal work should follow the entire arrangement: who is authorised to supply it, who keeps it working, what information it accesses, and how responsibilities are allocated when protection fails.

Jordan’s 2026 rules make product sales a specific regulatory concern. Suppliers need to connect their licensing position with their manufacturer arrangements and customer contracts. Buyers need a clear account of what protection and support they are purchasing.

Check the product-sales licensing requirements

The framework includes the Cybersecurity Law No. 16 of 2019, the Cybersecurity Service Providers Licensing Regulation No. 76 of 2024, and the Instructions for Licensing the Sale of Cybersecurity Products of 2026. The National Cyber Security Center announced their publication in Official Gazette No. 6039 on 19 March 2026, with effect from publication.

The product-sales instructions cover security software, hardware and solutions, and prescribe licensing conditions concerning the applicant, personnel and manufacturer relationships. They also address authenticity, updates, support and confidentiality. Suppliers should assess the conditions applicable to their proposed activities; company registration or reseller appointment alone does not resolve the cybersecurity licensing question.

The transitional position needs separate attention. Under the Center’s explanation of the Regulation, providers holding its prior approval before the Regulation took effect must regularise their position and apply for the necessary licence within a period not exceeding one year from issuance of the instructions governing the relevant service. A new entrant should not assume that it benefits from that treatment.

Identify the full scope of the offer

A proposal may bundle product supply with configuration, training, monitoring or incident response. The Center publishes separate licensing instructions for several cybersecurity services. Each component should therefore be mapped against the relevant requirements, rather than treating a product-sales licence as permission to undertake every cybersecurity activity.

For example, one company may sell the product while another operates the monitoring service. The proposal and contract should identify both parties, their tasks and the escalation route. This helps avoid a gap between a customer’s expectation of continuous monitoring and a subscription that supplies software with limited support.

A supplier’s regulatory status and a product’s suitability answer different questions. Buyers should examine the supplier’s licensing evidence alongside the product’s documented capabilities, manufacturer documentation and suitability for their systems. A licence should not be presented as a contractual guarantee of technical performance.

Align manufacturer and customer agreements

The distributor should establish its authority to supply the relevant products in Jordan, the permitted sales channels, and the arrangements for subscriptions, renewals, warranties and support. Customer commitments should be supported by enforceable obligations in the manufacturer agreement.

Exclusivity and sales targets should reflect the time needed for approvals and market development. Termination provisions should address outstanding orders, existing subscriptions, warranty claims and continuing access to updates. A distributor should avoid promising remedies that depend on manufacturer cooperation unless that cooperation is secured.

Make performance and support measurable

The customer agreement should identify the covered systems, subscription term, installation responsibilities and acceptance process. Support provisions should distinguish the time to acknowledge a problem from the time to investigate or resolve it.

Updates and product withdrawal also need attention. The parties should agree who installs patches, which versions remain supported, and what assistance is available when a product reaches the end of its supported life. Clear obligations provide a more useful basis for assessing performance than broad assurances of complete protection.

Review personal data and overseas access

Security tools may collect employee identifiers, access records or files submitted for threat analysis. Where those records contain personal data, Jordan’s Personal Data Protection Law No. 24 of 2023 must be considered alongside cybersecurity licensing.

The Law addresses permitted processing, confidentiality and controller and processor duties. Article 15 governs transfers outside Jordan and requires the controller to verify the overseas recipient’s level of protection before transfer. A cloud deployment should therefore be assessed against its actual data flows and the applicable transfer conditions.

The contract should identify storage locations, access rights, subcontractors, retention periods and permitted uses. Review whether information is used beyond delivering the customer’s security service, and agree how data will be returned or deleted when the arrangement ends.

Prepare for incidents and an orderly exit

Incident provisions should establish escalation contacts, evidence-preservation responsibilities and cooperation between the customer, distributor and manufacturer.

Under Article 20 of the Personal Data Protection Law, an infringement of data security and integrity capable of causing serious harm triggers duties to notify affected individuals within 24 hours of discovery and the competent Unit within 72 hours. Supplier notification commitments should give the customer enough time and information to meet those duties. Other applicable cybersecurity and sector requirements should also be checked.

Liability provisions should reflect the actual division of work, including support failures, confidentiality breaches and unauthorised access. Exit arrangements should cover export of relevant records, removal of privileged access, retained data and transition to a replacement supplier.

A sound transaction connects regulatory licensing with product evaluation and contractual responsibilities. That gives suppliers a workable route to market and buyers a clear basis for managing protection throughout the relationship.

Discuss your cybersecurity supply or procurement arrangements. Jamal Hadidi & Co. advises businesses on technology contracts, data protection and cybersecurity regulation, including distribution and customer agreements. Contact the firm to discuss your proposed arrangement.