LexLint.ioBeta

Know the law your code answers to.

Law / Egypt

Egypt Personal Data Protection Law, Personal Data Infringement notification

Law No. 151 of 2020, Article 7 (Personal Data Infringement notification)

In force since .

A breach notification rule binding public and private bodies.

Obligation class
Breach notice, Reporting
Audit expectation
on_request
Who audits it
Regulator

What it requires

  • Notify the Personal Data Protection Center of any personal data breach within 72 hours of the breach, and notify immediately where the breach relates to national security protection concerns.NIST Privacy FrameworkCM.AW-P7
  • Notify the Data Subject within 3 days of the date you notified the Center, telling them of the infringement and the procedures you have adopted about it.NIST Privacy FrameworkCM.AW-P7
  • Be ready to give the Center a description of the infringement's nature, form and reasons and the approximate number of Personal Data and records affected, the Data Protection Officer's information, the potential consequences, the procedures followed and proposed to minimise the impact, and evidence documenting the infringement and the corrective actions taken.NIST Privacy FrameworkCM.AW-P7NIST Privacy FrameworkPR.PO-P7

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
  • PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
NIST CSF 2.0
  • RS.CO-02Internal and external stakeholders are notified of incidents
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Who may demand the log

Regulator

Logging duty

Article 7 is chiefly a duty to notify the Center within 72 hours and the Data Subject within three days. It does not say in terms that the Controller or Processor keeps a breach register; it lists, among what is supplied to the National Security Authorities within 72 hours, evidence of documenting the infringement and the corrective actions, and any documents the Center requests, which cannot be produced without a record. The duty is therefore implicit. The Controller's record duty in Article 4(9) is not cited by this row. The law is in Arabic; the English wording is the ILO NATLEX translation.

Kind
Implicit
As of
Provision
Annexed Article 7, items 5 and 6 (evidence of documenting each Personal Data Infringement and the corrective actions, and any documents the Center requests)
Trigger
security_incident

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 7 requires the Controller and the Processor, as the case may be, to notify the Personal Data Protection Center of any Personal Data Infringement within seventy-two hours of the infringement, and to notify immediately where the infringement relates to national security protection concerns.

The Center then notifies the National Security Authorities immediately and, within seventy-two hours of becoming aware of the infringement, supplies them with a description of its nature, form and reasons and the approximate number of Personal Data and records affected, the Data Protection Officer's information, the potential consequences, a description of the procedures followed and proposed to minimise the negative impacts, evidence documenting the infringement and the corrective actions taken, and any further documents the Center requests.

In all events the Controller or Processor must notify the Data Subject within three days from the date it notified the Center, with the infringement and the procedures adopted about it. The Executive Regulations determine the procedures for that duty to notify and inform.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on , so these provisions have bound since .

When LexLint raises it

When your app profile says your app runs an essential service or processes personal data.

Back to the example  ·  Lint your app

Page updated .