EgyptEgypt Personal Data Protection Law, the Center, judicial control and penalties
Law No. 151 of 2020, Articles 19-31 and 34-44 (the Center, judicial control and penalties)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting, Licensing
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Personal Data Protection Center to decide a complaint against you within thirty working days of its submission, and carry out its decision within seven working days of being told of it, telling the Center once you have.
- Expect the Center's employees, appointed by the Minister of Justice, to hold judicial control powers over violations of the Law.
- Expect the penalties to apply without prejudice to severer sanctions under any other law and without prejudice to an injured party's right to seek damages from you.
- Note that a legal representative of a juristic person is personally penalised for the person's failure to fulfil its obligations, and a Data Protection Officer for failing to carry out the article 9 duties.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of not less than three months (or a fine of EGP 500,000 to 5,000,000, or both) for unauthorized processing or disclosure of Sensitive Personal Data (Art. 41); imprisonment of not less than six months (or a fine of EGP 200,000 to 2,000,000, or both) for an ordinary Personal Data violation committed for material or moral benefit or to endanger the data subject (Art. 36).
Penalty structure
This band (Art. 41) applies to unauthorized collection, disclosure, processing, storage, transfer, or making available of Sensitive Personal Data without the data subject's consent. Ordinary Personal Data violations carry a lower band under Art. 36: a fine of EGP 100,000 to 1,000,000, or, where committed for material or moral benefit or to endanger the data subject, imprisonment of not less than six months and/or a fine of EGP 200,000 to 2,000,000. A violation of the cross-border transfer conditions (Arts. 14-16) carries a separate band under Art. 42: imprisonment of not less than three months and/or a fine of EGP 500,000 to 5,000,000 (Art. 42). Recidivism doubles the sanctions of the chapter, minimum and maximum (Art. 48).
- Rule
- Fixed only
- As of
- Minimum
- 500,000
- Currency
- EGP
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Personal Data Protection Center (PDPC), established under the Ministry of Communications and Information Technology
Settledness
- As of
- Open questions
- What is the minimum fine under Article 37 for refusing, without legal justification, to enable a data subject to exercise the rights in Article 2, given that the English text states a minimum of "EGP 1,000,000 (One Hundred Thousand Egyptian Pounds)" and a maximum of EGP 1,000,000?
What it makes you log
Logging duty
These articles set up the Center, its licensing, complaint, inspection (Article 19) and judicial control powers (Article 34) and the penalties. The Center may inspect and supervise addressees, but no record is named, so the power is an on-request audit expectation and not a logging duty. A respondent must notify the Center that it has executed a complaint decision, which is a notice and not a log. Articles 38 to 40 penalise breach of the Article 4, 5, 7 and 9 duties without imposing them. The law is in Arabic; the English wording is the ILO NATLEX translation.
- Kind
- None
- As of
What this law does
Article 19 establishes the Personal Data Protection Center as a public economic authority, and articles 20 to 25 set its board, competences, meetings, chief executive, the confidentiality its members and employees owe, and its cooperation with counterpart authorities abroad. Articles 26 to 30 govern the Licences, Permits and Certifications the Center issues, how they are applied for, amended and cancelled, and article 31 the Center's budget.
Article 33 requires the Center to decide a complaint within thirty working days of its submission, to notify the complainant and the respondent of the decision, and requires the respondent to carry it out within seven working days of that notification and tell the Center it has done so. Article 34 gives the Center's employees, appointed by the Minister of Justice, judicial control powers over violations of the Law.
Article 35 opens the penalties without prejudice to severer sanctions under any other law and without prejudice to an injured party's right to seek damages.
Article 36 penalises collecting, processing, disclosing, making available or circulating Personal Data outside the Law, article 38 a Controller's or Processor's failure to perform its articles 4, 5 and 7 obligations, article 39 the legal representatives of juristic persons who do not fulfil theirs, and article 40 a Data Protection Officer who fails to carry out the article 9 duties.
Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on , so these provisions have bound since .
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .