EgyptEgypt Personal Data Protection Law, rights of the Data Subject
Law No. 151 of 2020, Articles 2, 32 and 33 (rights of the Data Subject)
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Data subject rights, Disclosure
- Audit expectation
- none
What it requires
- Give a Data Subject, on request, access to their own Personal Data you hold, and let them withdraw consent to its retention or processing, correct, edit, delete, add to or update it, limit the processing to a specified purpose, and object to the processing or its results where it contradicts their fundamental rights and freedoms.
- Reply to a request to exercise those rights within six working days of the day it was submitted.
- Do not charge a Data Subject more than the consideration the Center fixes for the service of exercising those rights, which may not exceed twenty thousand Egyptian pounds, and charge nothing at all for telling them of an infringement of their Personal Data.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 2, 32 and 33 give the Data Subject rights, a six-working-day reply duty on the Holder, Controller or Processor, and a complaint to the Center. None names a log or record of requests, and the Center's power to receive complaints is not a power to demand a record. The law is in Arabic; the English wording is the ILO NATLEX translation.
- Kind
- None
- As of
What this law does
Article 2 bars collecting, processing, disclosing or revealing Personal Data by any means except with the Data Subject's explicit consent or where a law permits it, and gives the Data Subject six rights: to know, review and obtain their own Personal Data held by any Holder, Controller or Processor; to withdraw prior consent to its retention or processing; to correct, edit, delete, add to or update it; to limit the processing to a specified purpose; to be notified of any infringement of their Personal Data; and to object to the processing or its results where it contradicts their fundamental rights and freedoms.
Except for the right to be notified of an infringement, the Data Subject pays a consideration for the service of exercising those rights, which the Center fixes and which may not exceed twenty thousand Egyptian pounds. Article 32 requires a Holder, Controller or Processor to reply to a request to exercise those rights within six working days of its submission.
Article 33 lets the Data Subject and any relevant person complain to the Center, without prejudice to judicial proceedings, where the right of Personal Data protection has been infringed, where the Data Subject has not been able to exercise their rights, or against a decision of the Data Protection Officer on a request made to them.
Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on , so these provisions have bound since .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .