EgyptEgypt Personal Data Protection Law, cross-border transfer of Personal Data
Law No. 151 of 2020, Articles 14-16 (cross-border transfer of Personal Data)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Licensing
- Audit expectation
- none
What it requires
- Obtain a Center license or permit before transferring, storing, or sharing personal data outside Egypt, unless the destination country's protection level meets or exceeds Egypt's own, or the data subject has given explicit consent.NIST Privacy FrameworkCT.PO-P2
- Where you rely on the Data Subject's explicit consent instead of the minimum protection level, use only one of the seven cases article 15 lists.NIST Privacy FrameworkCT.PO-P2
- Before disclosing Personal Data to a Controller or Processor abroad, hold a Licence from the Center and satisfy yourself that your work or purpose corresponds, that there is a legitimate interest in the data, and that the legal and technical protection there is not below Egypt's own.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.DE-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 14 to 16 condition a transfer abroad on an adequate level of protection and a Center licence or permit, with consent-based exceptions in Article 15. They name no log or record. Article 4(9) separately makes a Controller's record include data relating to a Cross-Border Personal Data Transfer, but this row does not cite it. The law is in Arabic; the English wording is the ILO NATLEX translation.
- Kind
- None
- As of
What this law does
Article 14 permits the transfer of Personal Data collected or prepared for processing to a foreign country, or its storage or sharing there, only where the level of data protection or security in that country meets or exceeds this Law's requirements and a relevant Licence or Permit is obtained from the Center.
Article 15 lets a transfer, sharing, circulation or processing proceed without that minimum protection level where the Data Subject or their representative has given explicit consent and the case is one of seven the article lists: preserving the Data Subject's life and providing medical care, treatment or health-service management; proving, exercising or defending a right before the judiciary; concluding or executing an agreement between the Processor and a third party for the Data Subject's benefit; international judicial cooperation; legal necessity or an obligation to protect the public interest; transferring money to another country under that country's laws; and a bilateral or multilateral international agreement Egypt is party to.
Article 16 lets a Controller or Processor disclose Personal Data to another Controller or Processor outside Egypt under a Licence from the Center, provided their work or purpose corresponds, each of them or the Data Subject has a legitimate interest in the data, and the legal and technical protection abroad is not below Egypt's own.
Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on , so these provisions have bound since .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .