EgyptLaw No. 151 of 2020 Promulgating the Personal Data Protection Law
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Consent, Security, Retention, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Obtain the data subject's explicit consent before processing their personal data unless another lawful ground applies, such as performing a contract, complying with a legal obligation, or acting under a judicial order.NIST Privacy FrameworkCT.PO-P1
- Collect Personal Data only for legitimate, specific purposes that are transparent to the Data Subject, keep it correct, valid and secured, and do not retain it longer than that purpose needs.NIST Privacy FrameworkGV.PO-P1
- Adopt technical and regulatory procedures and the necessary standard criteria to protect Personal Data and keep it confidential, preventing any hack, damage, alteration or manipulation.NIST Privacy FrameworkPR.DS-P5
- Delete Personal Data once the purpose it was collected for is satisfied, or hold it in a form that does not allow the Data Subject to be identified, and correct any error immediately on being told of it or becoming aware of it.NIST Privacy FrameworkCT.DM-P5NIST Privacy FrameworkCT.DM-P3
- Maintain a record of the Personal Data in your possession, describing its categories, the persons it may be disclosed to, and the basis, duration, restrictions and scope of that disclosure.NIST Privacy FrameworkID.IM-P4
- Appoint a Data Protection Officer, have the officer registered in the Center's register, and let the officer carry out the duties articles 9 and 13 set.NIST Privacy FrameworkGV.PO-P3
- Mark any electronic communication sent for direct marketing as articles 17 and 18 require, identifying its sender and giving the recipient a way to refuse it.NIST Privacy FrameworkCT.PO-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P3Data elements can be accessed for alteration.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does annexed Article 4, which makes the Controller "obtain a License or Permit from the Center to handle Personal Data", apply to a Controller outside Egypt that has appointed a representative under the same Article, and on what conditions does the Center issue that License or Permit?
- Does Article 2 of the promulgating law, which reaches "a non-Egyptian outside the Arab Republic of Egypt provided that the act is punishable under any legal form in the country where it occurred", bind a foreign operator whose processing is lawful in the country where it takes place?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Consent or opt-out state
Log retention
Article 18(3): the consent record is kept for three years from the date of the last Electronic Marketing communication.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Article 4(9) requires a Controller to maintain a record of the Personal Data it holds, showing the categories, the persons to whom it is disclosed or made available with the basis, duration, restrictions and scope, the mechanisms for deleting or modifying it, anything relating to Cross-Border Personal Data Transfer and the technical and regulatory procedures for Data Security. Article 5(9) requires a Processor to prepare a record of its Processing activities. Article 9(6) has the Data Protection Officer follow the registration and updating of both records. Article 18(3) requires the sender of direct Electronic Marketing to keep electronic records evidencing the Data Subject's consent, and any amendments, for three years from the last communication, which is the only period the cited articles set for a record. The registers hold categories and recipients, which are not log entries; only the consent record is kept as evidence of events. Article 3(4) limits how long Personal Data is retained and is not a log retention. The territorial scope clause is Article 2 of the promulgating law: it reaches an offender who is an Egyptian anywhere or a non-Egyptian in Egypt, and a non-Egyptian abroad where the data subject is an Egyptian or a foreigner residing in Egypt. Only the data-subject limb has a vocabulary value; the offender-nationality limb is left out. The law is in Arabic; the English wording is the translation republished by the ILO NATLEX database, the Arabic text being a scan that could not be read.
- Kind
- Explicit
- As of
- Provision
- Annexed Article 4(9) (a Controller maintains a record of Personal Data) and Article 5(9) (a Processor prepares a record of Processing activities), with Article 18(3) (electronic records evidencing consent to Electronic Marketing) and Articles 4(12) and 5(10) (means to prove abidance and to enable the Center to inspect)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
Article 3 sets the conditions for collecting, processing and retaining Personal Data: it must be collected for legitimate, specific purposes transparent to the Data Subject, be correct, valid and secured, be processed legitimately and in compliance with the purposes it was collected for, and not be retained longer than that purpose needs.
Article 4 lists the Controller's obligations, among them obtaining the Data Subject's consent before receiving the data, ensuring its validity and sufficiency for the purpose, adopting technical and regulatory procedures to protect it and prevent any hack, damage, alteration or manipulation, deleting it once the purpose is satisfied or holding it in a form that no longer identifies the Data Subject, correcting an error immediately on becoming aware of it, and maintaining a record of the Personal Data in its possession.
Article 5 lists the Processor's obligations. Article 6 fixes when electronic processing is legitimate. Articles 8, 9 and 13 require a Data Protection Officer, register the officer with the Center and set the officer's duties. Article 10 governs a request to disclose Personal Data and article 11 gives digital evidence derived from Personal Data its evidentiary weight. Articles 17 and 18 govern electronic communication for direct marketing.
Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on , so these provisions have bound since .
When LexLint raises it
When your app profile says your app sends automated outreach or processes personal data.
Back to the example · Lint your app
Page updated .