Egyptian law places a firm obligation on companies to report data breaches quickly. Under Article 7 of Law No. 151 of 2020, both data controllers and processors must notify the Personal Data Protection Center within 72 hours of becoming aware of any breach or violation involving personal data in their possession. This is a tight window designed to ensure swift action.
While Article 7 specifically mandates notification to the Center, the broader framework of the law — including your rights under Article 2 and the obligations on controllers under Article 4 — supports the expectation that affected individuals should also be informed, particularly where the breach could cause harm. The law's Executive Regulations and Center decisions may further specify individual notification requirements.
As an expat, if you suspect your data has been compromised by a service provider in Egypt (such as a bank, telecom company, or e-commerce platform), you have grounds to formally inquire with that organization and, if unsatisfied, raise the matter with the Personal Data Protection Center. Practical tip: Keep records of what data you have shared with Egyptian businesses so that if a breach occurs, you can quickly assess your exposure and take steps such as changing passwords or alerting your bank.
This is general legal information, not legal advice. For advice on your specific situation, consult a lawyer licensed in Egypt.