What Is a Personal Data Breach Under Egyptian Law?
A personal data breach occurs when your personal information is accessed, disclosed, altered, or destroyed without authorization. This could result from a cyberattack, an employee error, or a system failure at a company holding your data.
Common examples relevant to expats in Egypt include:
- A bank's customer database being hacked, exposing your financial details
- A hospital leaking your medical records
- An employer inadvertently sharing your passport information
- A telecom company experiencing unauthorized access to subscriber data
The 72-Hour Notification Rule
Article 7 of Law No. 151 of 2020 is one of the most operationally significant provisions. It requires:
- Controllers and Processors must notify the Personal Data Protection Center within 72 hours of becoming aware of a breach
- If the breach involves national security, notification must be immediate with no delay permitted
- The Center must in turn follow its own notification and escalation procedures
This rule mirrors international standards such as the EU's GDPR, making it a familiar concept if you have previously lived in Europe.
What Organizations Must Do to Prevent Breaches
Articles 13 and 4 place clear obligations on organizations handling your data to maintain robust security. They must:
- Implement security policies and procedures designed to prevent breaches
- Ensure data is accurate, sound, and secure at all times
- Appoint a qualified Data Protection Officer (DPO) who supervises compliance and monitors for violations
- Apply enhanced security measures when handling sensitive personal data
Practical implication for expats: Before sharing sensitive data with an Egyptian company, you are entitled to ask whether they have a registered Data Protection Officer and what security measures are in place.
The Role of the Data Protection Officer
Under Article 8, every legal entity acting as a controller or processor must appoint a Data Protection Officer (DPO), who must be registered with the Personal Data Protection Center. The DPO's responsibilities include:
- Overseeing compliance with the law and its Executive Regulations
- Monitoring internal data handling procedures
- Receiving requests from data subjects, including complaints about breaches
If you believe your data has been compromised, the DPO of the organization concerned is your first point of contact.
Steps to Take If Your Data Is Breached in Egypt
If you suspect or are informed that your personal data has been involved in a breach, take the following steps:
- Contact the organization's Data Protection Officer in writing, requesting confirmation of the breach and details of what data was affected.
- Document everything: save all communications, emails, and notifications you receive.
- File a complaint with the Personal Data Protection Center if the organization fails to respond or remediate.
- Monitor your financial accounts closely for signs of fraud or identity theft.
- Consider legal advice from an Egyptian lawyer if you suffer financial or reputational harm as a result.
Digital Evidence and Legal Proceedings
Article 11 confirms that digital evidence derived from personal data carries the same probative value as written evidence in legal proceedings, provided it meets technical standards set by the Executive Regulations. This means:
- Screenshots, digital communications, and data logs can be used as evidence in a complaint or lawsuit
- Keeping digital records of any breach notification or organizational response strengthens your legal position
Security Obligations for Sensitive Data
Organizations handling sensitive personal data — including health, financial, and biometric information — face stricter obligations under Article 13. They must:
- Apply dedicated security policies beyond standard data protection measures
- Ensure all relevant personnel are trained and bound by compliance obligations
- Hold a valid license from the Personal Data Protection Center
Practical Tips for Expats
- Register your contact details accurately with organizations so you can be notified promptly in the event of a breach
- Use strong, unique passwords for Egyptian online services, including banking and government portals
- Be cautious with phishing emails claiming to come from Egyptian banks or government agencies following any widely reported breach
- Keep copies of all consent forms and data agreements you have signed with Egyptian organizations