Egypt

Article 7 requires the Controller and the Processor, as the case may be, to notify the Personal Data Protection Center of any Personal Data Infringement within seventy-two hours of the infringement, and to notify immediately where the infringement relates to national security protection concerns.

The Center then notifies the National Security Authorities immediately and, within seventy-two hours of becoming aware of the infringement, supplies them with a description of its nature, form and reasons and the approximate number of Personal Data and records affected, the Data Protection Officer's information, the potential consequences, a description of the procedures followed and proposed to minimise the negative impacts, evidence documenting the infringement and the corrective actions taken, and any further documents the Center requests.

In all events the Controller or Processor must notify the Data Subject within three days from the date it notified the Center, with the infringement and the procedures adopted about it. The Executive Regulations determine the procedures for that duty to notify and inform.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.

Article 3 sets the conditions for collecting, processing and retaining Personal Data: it must be collected for legitimate, specific purposes transparent to the Data Subject, be correct, valid and secured, be processed legitimately and in compliance with the purposes it was collected for, and not be retained longer than that purpose needs.

Article 4 lists the Controller's obligations, among them obtaining the Data Subject's consent before receiving the data, ensuring its validity and sufficiency for the purpose, adopting technical and regulatory procedures to protect it and prevent any hack, damage, alteration or manipulation, deleting it once the purpose is satisfied or holding it in a form that no longer identifies the Data Subject, correcting an error immediately on becoming aware of it, and maintaining a record of the Personal Data in its possession.

Article 5 lists the Processor's obligations. Article 6 fixes when electronic processing is legitimate. Articles 8, 9 and 13 require a Data Protection Officer, register the officer with the Center and set the officer's duties. Article 10 governs a request to disclose Personal Data and article 11 gives digital evidence derived from Personal Data its evidentiary weight. Articles 17 and 18 govern electronic communication for direct marketing.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.

Article 14 permits the transfer of Personal Data collected or prepared for processing to a foreign country, or its storage or sharing there, only where the level of data protection or security in that country meets or exceeds this Law's requirements and a relevant Licence or Permit is obtained from the Center.

Article 15 lets a transfer, sharing, circulation or processing proceed without that minimum protection level where the Data Subject or their representative has given explicit consent and the case is one of seven the article lists: preserving the Data Subject's life and providing medical care, treatment or health-service management; proving, exercising or defending a right before the judiciary; concluding or executing an agreement between the Processor and a third party for the Data Subject's benefit; international judicial cooperation; legal necessity or an obligation to protect the public interest; transferring money to another country under that country's laws; and a bilateral or multilateral international agreement Egypt is party to.

Article 16 lets a Controller or Processor disclose Personal Data to another Controller or Processor outside Egypt under a Licence from the Center, provided their work or purpose corresponds, each of them or the Data Subject has a legitimate interest in the data, and the legal and technical protection abroad is not below Egypt's own.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.

Article 2 bars collecting, processing, disclosing or revealing Personal Data by any means except with the Data Subject's explicit consent or where a law permits it, and gives the Data Subject six rights: to know, review and obtain their own Personal Data held by any Holder, Controller or Processor; to withdraw prior consent to its retention or processing; to correct, edit, delete, add to or update it; to limit the processing to a specified purpose; to be notified of any infringement of their Personal Data; and to object to the processing or its results where it contradicts their fundamental rights and freedoms.

Except for the right to be notified of an infringement, the Data Subject pays a consideration for the service of exercising those rights, which the Center fixes and which may not exceed twenty thousand Egyptian pounds. Article 32 requires a Holder, Controller or Processor to reply to a request to exercise those rights within six working days of its submission.

Article 33 lets the Data Subject and any relevant person complain to the Center, without prejudice to judicial proceedings, where the right of Personal Data protection has been infringed, where the Data Subject has not been able to exercise their rights, or against a decision of the Data Protection Officer on a request made to them.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.

Article 19 establishes the Personal Data Protection Center as a public economic authority, and articles 20 to 25 set its board, competences, meetings, chief executive, the confidentiality its members and employees owe, and its cooperation with counterpart authorities abroad. Articles 26 to 30 govern the Licences, Permits and Certifications the Center issues, how they are applied for, amended and cancelled, and article 31 the Center's budget.

Article 33 requires the Center to decide a complaint within thirty working days of its submission, to notify the complainant and the respondent of the decision, and requires the respondent to carry it out within seven working days of that notification and tell the Center it has done so. Article 34 gives the Center's employees, appointed by the Minister of Justice, judicial control powers over violations of the Law.

Article 35 opens the penalties without prejudice to severer sanctions under any other law and without prejudice to an injured party's right to seek damages.

Article 36 penalises collecting, processing, disclosing, making available or circulating Personal Data outside the Law, article 38 a Controller's or Processor's failure to perform its articles 4, 5 and 7 obligations, article 39 the legal representatives of juristic persons who do not fulfil theirs, and article 40 a Data Protection Officer who fails to carry out the article 9 duties.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.

Article 12 prohibits a Controller or Processor, natural or juristic, from collecting, transferring, storing, saving, processing or disclosing Sensitive Personal Data except under a licence issued by the Personal Data Protection Center. Outside the cases a law authorises, the Controller or Processor must also obtain the Data Subject's explicit written consent.

Where any of those activities concerns a child's data, the legal guardian's consent must be obtained instead, and a child's participation in a game, competition or any other activity may not be made conditional on submitting more of the child's Personal Data than participation needs.

Article 1 defines Sensitive Personal Data as data revealing psychological, mental, physical or genetic health, biometric data, financial data, religious beliefs, political opinions or criminal record, and makes any data relating to a child sensitive in every case.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.

Egypt's general computer-misuse statute. Article 14 punishes intentional access to, or unintentional access and unlawful continued presence in, a restricted website, private account, or information system with imprisonment of not less than one year and a fine of EGP 50,000 to 100,000, rising to not less than two years and a fine of EGP 100,000 to 200,000 where the access results in destroying, altering, copying, or republishing data.

Article 15 separately punishes exceeding the scope of access rights legally granted on a website, account, or system. Penalties are further aggravated where the target belongs to, or is operated on behalf of, the State or a public legal entity. The Law does not define "authorization" specifically for a public, unauthenticated web page, and no Egyptian court decision construing Articles 14-15 in that context was located.

Book Three of Egypt's consolidated IP statute protects "databases, whether readable by computer or otherwise" as a category of copyrightable work (Art. 140(3)), not through a separate EU-style sui generis database right: protection rests on the database being an original compilation, the same footing as a computer program. Even where a personal-use or teaching exception would otherwise apply, the author may still prevent reproduction or copying of all or a substantial part of a database.

The Law's exceptions are enumerated rather than a general fair-use standard: personal non-commercial copying, analysis or quotation for criticism or information, short extracts for teaching, and narrow library, archiving, and legal-proceeding copying (Art. 171); none addresses text-and-data-mining or AI training. The Law has been amended several times since 2002, most recently up to Law No. 178 of 2020.

Article 2 (First) makes its listed duties obligations of service providers, without prejudice to the provisions of Law No. 175 of 2018 and of Law No. 10 of 2003 regulating telecommunications. Article 2 (First) obliges a service provider to secure data and information to ensure its confidentiality, prevent unauthorized access, and protect against damage.

Article 1 defines a service provider as any natural or legal person who provides information and communication technology services to users, including those who process or store information either directly or on behalf of others. Article 45 provides that Law No. 175 of 2018 comes into force on the day following its publication in the Official Gazette. The Law entered into force on 15 August 2018.

Article 29 of Law No. 175 of 2018 on Anti-Cyber and Information Technology Crimes punishes any person responsible for managing a website, private account, email account, or information system who intentionally exposes it to the commission of a crime under this Law, with imprisonment of not less than one year plus a fine of EGP 20,000 to 200,000.

It separately punishes the same person for negligently causing that kind of exposure through a failure to take the security precautions and measures the Law's own executive regulations are to prescribe, with imprisonment of not less than six months plus a fine of EGP 10,000 to 100,000. The duty is general.

It does not turn on whether personal data is involved and does not require a telecommunications licence, unlike the separate service-provider duties Article 2 of the same Law places on a licensed 'Service Provider'. Reconciliation of an Article 29 charge requires the National Telecommunications Regulatory Authority's own approval. Reconciliation extinguishes the criminal case without affecting a victim's civil claim.

No source located confirms whether the Prime Minister issued the Article 44 executive regulations, or what specific security precautions and measures they set. WIPO Lex's own record of this Law lists no related implementing text.

Article 35 of Law No. 175 of 2018 punishes, by imprisonment for not less than three months and a fine of EGP 30,000 to 100,000, or by either penalty, any person responsible for the actual management of a legal entity whose designated website, account, email or information system is subjected to a crime stipulated in the Law and who fails to report it to the competent authorities upon becoming aware of it.

Article 42 allows reconciliation of the misdemeanors in Articles 29 and 35 only through the National Telecommunications Regulatory Authority. Article 1 defines the Authority as the National Telecommunications Regulatory Authority. Article 45 provides that Law No. 175 of 2018 comes into force on the day following its publication in the Official Gazette. The Law entered into force on 15 August 2018.

Article 171(4) permits any person, without the author's authorization and after a work's publication, to "make an analysis of the work, or excerpts or quotations therefrom, for the purpose of criticism, discussion or information."

The exception is not tied to the news media specifically and carries no headline-versus-substantial-extract threshold of its own; whether it reaches an aggregator's systematic reproduction of headlines and snippets, as opposed to an individual's quotation for commentary, has not been tested in a reported Egyptian decision.

Egypt has no separate press-publisher neighbouring right, no compelled platform-to-publisher bargaining regime, no recognized hot-news or misappropriation doctrine distinct from ordinary copyright and unfair-competition law, and no located case law on hyperlinking or framed display.