Answer ... There is no personal data protection law in Egypt as yet. However, on 24 February 2020 the House of Representatives finally approved the first draft personal data protection law, which should be approved by the Egyptian president unless he has any comments, which is very unlikely.

The Data Protection Law will prohibit the transfer, storage and/or sharing of personal data that was collected or prepared for processing to any foreign state, unless the following two main conditions are satisfied:

• The third state applies a protection level that is at least equivalent to that applied in the draft Data Protection Law; and
• A licence from the Personal Data Protection Centre is obtained.

The Executive Regulation to be issued for the approved Data Protection Law will set out the policies, criteria, requirements and rules to be met for the transfer, storage, sharing, processing and protection of personal data across borders.

What the licensing process will be is as yet unclear; however, it is expected that this will vary depending on a number of factors, including:

• the country to which the personal data will be transferred;
• national security concerns; and
• whether the relevant country allows the transfer of personal data to Egypt.

The approved Data Protection Law will not apply to the Central Bank of Egypt (CBE) or to entities regulated by the CBE, except for forex entities, which will be subject to the new draft Banking Law.

Answer ... According to the Cybercrime Law, all providers of IT and telecommunications services, including services involving the processing or storage of data, must retain and store users’ data for at least 180 days, including the following:

• identification data;
• the content of the service provider’s system;
• communication traffic;
• terminal data; and
• any other data required by the National Telecommunication Regulatory Authority.

These providers must also keep all stored and archived data (including personal data) confidential and not disclose such data unless there is a court order to do so.