Does an Egyptian privacy policy need consent for everything?

Article 2 of the Personal Data Protection Law issued by Law No. 151 of 2020 prohibits collecting, processing, disclosing or revealing personal data by any means without the express consent of the data subject or in cases authorised by law. Article 6 then sets out four situations in which electronic processing is lawful, which include consent but also necessity for a contract or legal disposition, compliance with a legal obligation or a court or investigative order, and enabling the controller to perform obligations or exercise legitimate rights without conflicting with the data subject's fundamental rights and freedoms.

How quickly must a data breach be reported in Egypt?

Article 7 of the Personal Data Protection Law issued by Law No. 151 of 2020 requires the controller and the processor to notify the Personal Data Protection Centre of a breach or infringement within seventy-two hours of becoming aware of it, and immediately where the breach relates to national security considerations. The same article requires the data subject to be notified within three working days of that reporting, together with what has been done about it.

Does the Egyptian data protection law apply to a company outside Egypt?

Article 4(11) of the Personal Data Protection Law issued by Law No. 151 of 2020 obliges a controller established outside the Arab Republic of Egypt to appoint a representative for it in Egypt in the manner set out in the executive regulations, and Article 5(12) imposes the same duty on a processor established outside Egypt. Article 2 of the issuing law also extends the criminal provisions to acts committed abroad in defined circumstances where the data belongs to Egyptians or to foreigners resident in Egypt.

Privacy Policy in Egypt

Egypt's Personal Data Protection Law was issued by Law No. 151 of 2020 and applies to personal data processed electronically, in whole or in part, by any holder, controller or processor. Consent is the default gate: personal data may not be collected, processed, disclosed or revealed by any means without the express consent of the data subject or in cases authorised by law. Two obligations have no European equivalent, a licence or permit from the Personal Data Protection Centre before dealing with personal data at all, and a mandatory local representative for any controller established abroad.

Download the Egypt drafting checklist (.docx)Where to read Egypt law

Governing law

Personal data processed electronically is governed by the Personal Data Protection Law annexed to Law No. 151 of 2020. Under Article 7 of the issuing law it came into force three months after the day following its publication in the Official Gazette on 15 July 2020.

Law No. 151 of 2020 issuing the Personal Data Protection Law, Arts. 1 and 7 of the issuing law (Official Gazette No. 28 (bis)(e), 15 July 2020, Arabic, published by the Ministry of Communications and Information Technology)

What a privacy policy has to contain in Egypt

Personal data may not be collected, processed, disclosed or revealed by any means except with the express consent of the data subject or in the cases authorised by law.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 2
The data subject has the rights to know about and access his data held by any holder, controller or processor, to withdraw prior consent to its retention or processing, to have it corrected, amended, erased, added to or updated, to confine processing to a defined scope, to be informed of any breach, and to object to processing or its results where it conflicts with his fundamental rights and freedoms.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 2
Collecting, processing and retaining personal data is subject to four conditions: it is collected for a legitimate, specified purpose declared to the data subject, it is correct, sound and secured, it is processed lawfully and in a manner appropriate to the purposes it was collected for, and it is not retained for longer than the period needed to fulfil that purpose.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 3
Electronic processing is lawful in four situations: consent for one or more specific purposes, necessity to perform a contractual obligation or legal disposition, to conclude or perform a contract in the data subject's favour or to bring or defend legal claims, implementation of an obligation imposed by law or an order of the competent investigating authorities or a court judgment, and enabling the controller to perform its obligations or exercise its legitimate rights without conflicting with the data subject's fundamental rights and freedoms.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 6
The controller and the processor must notify the Personal Data Protection Centre of any breach or infringement of the personal data they hold within seventy-two hours of becoming aware of it, immediately where the breach concerns national security considerations, and must notify the data subject within three working days of that notification.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 7
Data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious beliefs, political opinions or security status is sensitive personal data, and children's data is sensitive in all cases.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 1

Form, notarisation and registration

The controller must obtain a licence or a permit from the Personal Data Protection Centre in order to deal with personal data, must keep a dedicated data register describing the categories of data it holds, who may access them, retention periods, erasure mechanisms and cross-border transfers, and must appoint a representative in Egypt if it is established abroad.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 4(9), (10) and (11)
A register of personal data protection officers is kept at the Centre, and every legal person acting as a controller or processor must appoint a competent employee within its legal entity and staffing structure as the officer responsible for personal data protection, register that person in the Centre's register and announce the appointment.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 8
Those addressed by the Law must bring their position into line with the annexed law and its executive regulations within one year of the date those regulations are issued, the regulations themselves being the responsibility of the minister concerned with communications and information technology.
Law No. 151 of 2020 issuing the Personal Data Protection Law, Arts. 4 and 6 of the issuing law

What catches drafters out

Six categories fall outside the annexed law, among them personal data held by natural persons for personal use, data processed for official statistics or under a legal text, data processed exclusively for media purposes where it is true and accurate, data held by national security bodies, and personal data at the Central Bank of Egypt and the entities under its supervision other than money transfer and exchange companies.
Law No. 151 of 2020 issuing the Personal Data Protection Law, Art. 3 of the issuing law
Except for the right to be told about a breach, the data subject pays the controller or processor a charge for exercising his rights that corresponds to the cost of the service provided, and the Centre issues the decisions fixing that charge at not more than twenty thousand Egyptian pounds.
Personal Data Protection Law issued by Law No. 151 of 2020, Art. 2
Offences committed in breach of the annexed law fall within the jurisdiction of the Economic Courts, not the ordinary criminal courts.
Law No. 151 of 2020 issuing the Personal Data Protection Law, Art. 5 of the issuing law