Securiti launches Gencore AI, a holistic solution to build Safe Enterprise AI with proprietary data - easily

View
Contact Us See a demo

What is Egypt’s Data Protection Law

egypt data protection law banner
By Anas Baig | Reviewed By Maria Khan
Published August 9, 2023 / Updated December 13, 2023

Listen to the content

With emerging technology and the world becoming more digital, countries all over the world are drafting comprehensively data privacy regulations. Joining the global movement, the government of Egypt has passed its first-ever Personal Data Protection Law (PDPL), which is very much in line with the requirements of the global best practice, the EU’s General Data Protection Regulation (GDPR). The PDPL came into effect on 14 October 2020.

The PDPL protects data processed electronically. It applies to both data controllers and processors that process personal data belonging to Egyptian residents, whether or not the organizations are based in Egypt.

egypt dpl dsr

Data subjects’ rights

Under the PDPL, data subjects have the following rights:

What is Egypt’s Data Protection Law

Right to Access

What is Egypt’s Data Protection Law

Right to withdraw consent

What is Egypt’s Data Protection Law

Right to delete

What is Egypt’s Data Protection Law

Right to correct and/or update

What is Egypt’s Data Protection Law

Right to limit the processing

What is Egypt’s Data Protection Law

Right to object to processing

What is Egypt’s Data Protection Law

Right to be notified of any breach

Processing principles

Under the PDPL, no personal information can be collected, processed, or disclosed unless there exists a legal basis to do so. Legal basis includes explicit consent of the concerned data subject, the legitimate interest of the data controller or any relevant third-party, performance of a contract, commencement of a legal action, or compliance with a legal obligation. However, where it involves the processing of sensitive personal information, the PDPL requires data controllers to obtain the explicit consent of the concerned data subject even if there is a legitimate interest to process such sensitive personal information.

Obligations of Organizations:

Under the PDPL, organizations have the following responsibilities

What is CCPA

Authorization from the Personal Data Protection Center

For the purposes of enforcement of the law, Egypt will set up the Personal Data Protection Center. All organizations that wish to carry out the processing activities must obtain a license from the Personal Data Protection Center.

What is CCPA

Appointment of the Data Protection Officer

Organizations must appoint a Data Protection Officer, who shall be licensed and approved by the Personal Data Protection Center. The Data Protection Officer shall notify the Personal Data Protection Center of any personal data breach.

What is CCPA

Breach notification requirement

Data controllers and processors must report  any cyber-attacks or personal data breaches to the Personal Data Protection Center as well as to the concerned data subject within 72 hours after having become aware of the breach. Where any personal data breach threatens the national security, companies must report to the relevant authorities and concerned data subjects immediately.

What is CCPA

Cross-border data transfer

Under the PDPL, personal information can be transferred outside Egypt only if the destination country provides equivalent or comparable data protection standards and is authorized by the Personal Data Protection Center. In exceptional cases, the transfer of personal information outside Egypt must take place only after the explicit consent of the concerned data subject, for which certain conditions shall be fulfilled.

What is CCPA

Record of processing activities

Organizations must maintain updated records of their processing activities.

What's Next?

Organizations shall have a grace period of around 21 days to comply with the requirements of the law. A violation of the requirement of the PDPL may result in severe criminal penalties or costly administrative fines. The maximum fine that can be awarded under the law is 5 million Egyptian pounds and imprisonment of up to three year where prison sentences apply.

Egypt's Personal Data Protection Law aims to protect people’s personal information by granting them several rights and protections. Organizations are encouraged to undertake reasonable and appropriate technical measures in line with the requirements introduced by the law.

Privacy ops blue ebook banner

Automating privacy operations across your organization

The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.

Get the Book

“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”

- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc

Egypt Data Protection Compliance

Automating Compliance

securiti.ai offers an automated solution to enable organizations to comply with the requirements of Egypt’s Personal Data Protection Law, in addition to other applicable privacy regulations, with ease and efficiency. The award-winning solution revolves around the concept of PrivacyOps, which utilizes artificial intelligence and robotic automation to streamline compliance tasks, freeing up crucial resources for other areas of business.

securiti.ai helps organizations discover data over a wide range of internal and external systems, build a People Data Graph to link personal data to each individual, automate data subject requests, assessments, consent management, and more.

To learn how securiti.ai can help your business efficiently implement privacy management, request a demo today.

Frequently Asked Questions (FAQs)

What is the new data protection law in Egypt?

Egypt introduced the Law on the Protection of Personal Data ('the Data Protection Law') issued under Resolution No. 151 of 2020. The law provides data subjects with the right to be informed, right to access, right to rectification, right to erasure, right to object/opt-out, right to data portability, and the right not to be subject to automated decision-making. It also imposes a maximum fine of up to EGP 5 million for violating its provision.

Does GDPR apply to Egypt?

GDPR applies to organizations that process the personal data of individuals within the European Union (EU). Egypt is not part of the EU, so GDPR's direct applicability is limited. However, GDPR might indirectly apply if an Egyptian organization processes the data of EU residents.

Do we have laws regulating IT and cyberspace in Egypt?

Yes, Egypt has regulations related to IT and cyberspace. The "Anti-Cyber and Information Technology Crimes Law" and other legislation govern aspects of online activities, data protection, and cybersecurity within the country.

Join Our Newsletter

Get all the latest information, law updates and more delivered to your inbox

Share

More Stories that May Interest You

View More

December 4, 2024

What is Classified as Sensitive Data, and How to Classify It?

Learn about sensitive data classification, its importance, and how to effectively classify sensitive data to protect your organization's sensitive information.

Data Security View More

December 3, 2024

Data Security: Meaning, Importance, Best Practices, and Solutions

Learn what is data security, its importance, best practices, solutions, risks, and how to stay compliant with data security regulations.

Data Regulations in India's Financial Sector View More

November 20, 2024

Data Regulations in India’s Financial Sector: Navigating Compliance and Security

Discover key insights into data regulations in India's financial sector, including data privacy and security obligations and governance frameworks for financial institutions. Stay informed...

What's
New