Dr. Hamza Alakaleek

The recent 2025 Cloud Computing Policy, issued by the National Cybersecurity Center (NCSC), marks a strategic shift in data governance and localization for Jordan. This policy establishes a comprehensive framework that goes beyond simply protecting the Kingdom's information assets from external threats. This is not just another security document; it's a statement of national intent. The policy is designed to ensure complete national sovereignty over data, a crucial step that will dramatically enhance trust in Jordan's digital environment. By moving beyond traditional security measures, we are opening up new horizons for innovation and growth.

The new policy creates a comprehensive framework for managing the cybersecurity risks that come with cloud services, whether they're public, private, or a mix of both. It's designed to keep up with international security standards and align with Jordan's own Personal Data Protection Law of 2023. The goal is to strike a balance between being secure and fostering digital innovation, ensuring one doesn't come at the cost of the other.

One of the most important aspects of the policy is its focus on data localization. This means that cloud service providers who operate in Jordan are now required to store sensitive data within the country's borders. The policy uses a tiered system to classify data by sensitivity, from "Highly Confidential" to "Public." For example, "Class A" data—like information about defense or critical infrastructure—must be kept in domestic data centers under full national control. This is a huge move toward protecting vital national interests and ensuring digital sovereignty.

This approach is similar to what other countries like Saudi Arabia and the European Union have done to protect their data from external threats. What's unique about Jordan's policy is how it combines cybersecurity, data privacy, and legal requirements into one cohesive and forward-thinking model.

The NCSC is taking a smart, phased approach to rolling out the policy, giving service providers clear timelines for compliance. This is similar to how Singapore handles its cybersecurity regulations, offering guidance while also maintaining a risk-based oversight.

Beyond just creating regulations, the NCSC is also focused on building a stronger cybersecurity workforce. They're training professionals in both the public and private sectors on cloud security standards. They're also developing a national platform for real-time monitoring of cloud incidents to ensure they can respond quickly to any threats. The NCSC is even looking to partner with big global cloud providers like Microsoft Azure and Amazon Web Services to make sure Jordanian data sovereignty is always protected.

These efforts build on earlier national initiatives, including the 2019 National Cybersecurity Policy and the 2022–2027 National Cybersecurity Strategy, all of which aim to make cybersecurity a cornerstone of national security and economic stability.

This new policy is expected to bring some great benefits. It'll boost investor confidence by showing that Jordan has clear and enforceable data protection standards. It'll also reduce cyber risks and improve crisis management, especially in critical sectors like banking and healthcare.

However, there are still some challenges to overcome. Jordan needs to build stronger local infrastructure to support advanced cloud operations, close the technical skills gap, and create more legislation that supports integrating artificial intelligence into cybersecurity governance.

Looking ahead, the NCSC plans to focus on using AI to predict and neutralize threats. There's also a long-term vision of turning Jordan into a regional hub for cloud security excellence. Another potential step is creating a national accreditation system for cloud service providers, similar to Germany and Canada, to ensure only certified and secure entities operate in the market.

Ultimately, this new policy is more than just a document—it's a bold statement about Jordan's commitment to digital sovereignty and a secure, prosperous digital future. Cybersecurity isn't just a technical defense anymore; it's a key driver of economic growth and digital trust.