Processes personal data, in Egypt

Law No. 175 of 2018 on Anti-Cyber and Information Technology Crimes, Arts. 29, 42, 44 · Read the law's page

• This binds any person responsible for managing a website, private account, email account, or information system in Egypt, whether or not any personal data is involved.
• Do not intentionally expose a website, private account, email account, or information system you manage to the commission of a crime under this Law; doing so carries imprisonment of not less than one year, a fine of EGP 20,000 to 200,000, or both.
• Take the security precautions and measures the executive regulations of this Law prescribe. A negligent failure to do so that results in your website, private account, email account, or information system being exposed to a crime under this Law carries imprisonment of not less than six months, a fine of EGP 10,000 to 100,000, or both.
• No reachable source confirms whether the Prime Minister has issued the Executive Regulations Article 44 requires, or what specific security precautions and measures they define; WIPO Lex's own record of this Law lists no related implementing text, so treat the 'security precautions and measures' standard as unconfirmed rather than absent.

Law No. 175 of 2018, Art. 2 (First) (service providers' duty to secure data) · Read the law's page

• This binds a service provider, any natural or legal person who provides information and communication technology services to users, including one who processes or stores information directly or on behalf of others (Article 1; reached by declaring any activity that provides such a service to users).
• Secure the data and information you handle to ensure its confidentiality, prevent unauthorized access, and protect against damage (Article 2, First).

Law No. 175 of 2018, Art. 35 (duty to report a crime against an entity's system) · Read the law's page

• This binds any person responsible for the actual management of a legal entity whose designated website, account, email or information system is subjected to a crime stipulated in Law No. 175 of 2018, whether or not any personal data is involved.
• Report the crime to the competent authorities upon becoming aware of it (Article 35).

Law No. 151 of 2020 Promulgating the Personal Data Protection Law, general duties (annexed arts. 1-6, 8-11, 13 and 17-18) · Read the law's page

• Obtain the data subject's explicit consent before processing their personal data unless another lawful ground applies, such as performing a contract, complying with a legal obligation, or acting under a judicial order.
• Collect Personal Data only for legitimate, specific purposes that are transparent to the Data Subject, keep it correct, valid and secured, and do not retain it longer than that purpose needs.
• Adopt technical and regulatory procedures and the necessary standard criteria to protect Personal Data and keep it confidential, preventing any hack, damage, alteration or manipulation.
• Delete Personal Data once the purpose it was collected for is satisfied, or hold it in a form that does not allow the Data Subject to be identified, and correct any error immediately on being told of it or becoming aware of it.
• Maintain a record of the Personal Data in your possession, describing its categories, the persons it may be disclosed to, and the basis, duration, restrictions and scope of that disclosure.
• Appoint a Data Protection Officer, have the officer registered in the Center's register, and let the officer carry out the duties articles 9 and 13 set.
• Mark any electronic communication sent for direct marketing as articles 17 and 18 require, identifying its sender and giving the recipient a way to refuse it.

Law No. 151 of 2020, Article 12 (Sensitive Personal Data and a child's data) · Read the law's page

• Obtain a Personal Data Protection Center license before collecting, storing, transferring, or processing any Sensitive Personal Data, including a biometric, health, genetic, financial, religious, political, or criminal-record identifier, or any data relating to a child.
• Obtain a parent or legal guardian's consent before processing a child's personal data, and do not condition a child's participation in a game, competition, or activity on personal data beyond what participation requires.
• Obtain the Data Subject's explicit written consent before any dealing with their Sensitive Personal Data, outside the cases a law authorises, on top of the Center's licence.
• Treat any data relating to a child as Sensitive Personal Data in every case, whatever its subject matter.

Law No. 151 of 2020, Article 7 (Personal Data Infringement notification) · Read the law's page

• Notify the Personal Data Protection Center of any personal data breach within 72 hours of the breach, and notify immediately where the breach relates to national security protection concerns.
• Notify the Data Subject within 3 days of the date you notified the Center, telling them of the infringement and the procedures you have adopted about it.
• Be ready to give the Center a description of the infringement's nature, form and reasons and the approximate number of Personal Data and records affected, the Data Protection Officer's information, the potential consequences, the procedures followed and proposed to minimise the impact, and evidence documenting the infringement and the corrective actions taken.

Law No. 151 of 2020, Articles 14-16 (cross-border transfer of Personal Data) · Read the law's page

• Obtain a Center license or permit before transferring, storing, or sharing personal data outside Egypt, unless the destination country's protection level meets or exceeds Egypt's own, or the data subject has given explicit consent.
• Where you rely on the Data Subject's explicit consent instead of the minimum protection level, use only one of the seven cases article 15 lists.
• Before disclosing Personal Data to a Controller or Processor abroad, hold a Licence from the Center and satisfy yourself that your work or purpose corresponds, that there is a legitimate interest in the data, and that the legal and technical protection there is not below Egypt's own.

Law No. 151 of 2020, Articles 19-31 and 34-44 (the Center, judicial control and penalties) · Read the law's page

• Expect the Personal Data Protection Center to decide a complaint against you within thirty working days of its submission, and carry out its decision within seven working days of being told of it, telling the Center once you have.
• Expect the Center's employees, appointed by the Minister of Justice, to hold judicial control powers over violations of the Law.
• Expect the penalties to apply without prejudice to severer sanctions under any other law and without prejudice to an injured party's right to seek damages from you.
• Note that a legal representative of a juristic person is personally penalised for the person's failure to fulfil its obligations, and a Data Protection Officer for failing to carry out the article 9 duties.

Law No. 151 of 2020, Articles 2, 32 and 33 (rights of the Data Subject) · Read the law's page

• Give a Data Subject, on request, access to their own Personal Data you hold, and let them withdraw consent to its retention or processing, correct, edit, delete, add to or update it, limit the processing to a specified purpose, and object to the processing or its results where it contradicts their fundamental rights and freedoms.
• Reply to a request to exercise those rights within six working days of the day it was submitted.
• Do not charge a Data Subject more than the consideration the Center fixes for the service of exercising those rights, which may not exceed twenty thousand Egyptian pounds, and charge nothing at all for telling them of an infringement of their Personal Data.