'Most Innovative Startup 2020' by RSA - Watch the videoLearn More
With emerging technology and the world becoming more digital, countries all over the world are drafting comprehensively data privacy regulations. Joining the global movement, the government of Egypt has passed its first-ever Personal Data Protection Law (PDPL), which is very much in line with the requirements of the global best practice, the EU’s General Data Protection Regulation (GDPR). The PDPL came into effect on 14 October 2020.
The PDPL protects data processed electronically. It applies to both data controllers and processors that process personal data belonging to Egyptian residents, whether or not the organizations are based in Egypt.
Under the PDPL, data subjects have the following rights:
Under the PDPL, no personal information can be collected, processed, or disclosed unless there exists a legal basis to do so. Legal basis includes explicit consent of the concerned data subject, the legitimate interest of the data controller or any relevant third-party, performance of a contract, commencement of a legal action, or compliance with a legal obligation. However, where it involves the processing of sensitive personal information, the PDPL requires data controllers to obtain the explicit consent of the concerned data subject even if there is a legitimate interest to process such sensitive personal information.
Under the PDPL, organizations have the following responsibilities
For the purposes of enforcement of the law, Egypt will set up the Personal Data Protection Center. All organizations that wish to carry out the processing activities must obtain a license from the Personal Data Protection Center.
Organizations must appoint a Data Protection Officer, who shall be licensed and approved by the Personal Data Protection Center. The Data Protection Officer shall notify the Personal Data Protection Center of any personal data breach.
Data controllers and processors must report any cyber-attacks or personal data breaches to the Personal Data Protection Center as well as to the concerned data subject within 72 hours after having become aware of the breach. Where any personal data breach threatens the national security, companies must report to the relevant authorities and concerned data subjects immediately.
Under the PDPL, personal information can be transferred outside Egypt only if the destination country provides equivalent or comparable data protection standards and is authorized by the Personal Data Protection Center. In exceptional cases, the transfer of personal information outside Egypt must take place only after the explicit consent of the concerned data subject, for which certain conditions shall be fulfilled.
Organizations must maintain updated records of their processing activities.
Organizations shall have a grace period of around 21 days to comply with the requirements of the law. A violation of the requirement of the PDPL may result in severe criminal penalties or costly administrative fines. The maximum fine that can be awarded under the law is 5 million Egyptian pounds and imprisonment of up to three year where prison sentences apply.
Egypt's Personal Data Protection Law aims to protect people’s personal information by granting them several rights and protections. Organizations are encouraged to undertake reasonable and appropriate technical measures in line with the requirements introduced by the law.
The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.Get the Book
“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”
- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc
SECURITI.ai offers an automated solution to enable organizations to comply with the requirements of Egypt’s Personal Data Protection Law, in addition to other applicable privacy regulations, with ease and efficiency. The award-winning solution revolves around the concept of PrivacyOps, which utilizes artificial intelligence and robotic automation to streamline compliance tasks, freeing up crucial resources for other areas of business.
SECURITI.ai helps organizations discover data over a wide range of internal and external systems, build a People Data Graph to link personal data to each individual, automate data subject requests, assessments, consent management and more.
To learn how SECURITI.ai can help your business efficiently implement privacy management, request a demo today.