What Counts as Personal Data Under Egyptian Law
Under Law No. 151 of 2020, personal data means any information relating to an identified or identifiable natural person. This includes:
- Your full name, national ID number, or passport number
- Contact details such as phone numbers and email addresses
- Financial information, including bank account details
- Location data and IP addresses
- Any combination of data that could indirectly identify you
As an expat, your data held by employers, landlords, hospitals, banks, and government bodies all falls under this definition.
Your Core Rights as a Data Subject
Article 2 of the law establishes that collecting, processing, disclosing, or revealing your personal data without your explicit consent is prohibited. You hold the following enforceable rights:
- Right to be informed: You must be told when and why your data is being collected.
- Right of access: You can request to see any personal data held about you by any organization.
- Right to obtain your data: You can request a copy of your personal data in a readable format.
- Right to correct inaccuracies: If data held about you is wrong, you can demand it be corrected.
- Right to withdraw consent: You may withdraw your consent to data processing at any time.
How to Make a Data Access Request
Article 10 sets out the formal procedure for requesting access to your personal data:
- Submit your request in writing to the controller or processor holding your data.
- Include valid identification documents to prove your identity.
- The organization must verify your documents and respond within a reasonable period set by the Executive Regulations.
- Requests can be made by you personally or through a legally authorized representative.
Practical tip for expats: If your employer, a hospital, or a telecom provider holds data about you, you have the right to submit a written request in English. However, providing an Arabic translation may speed up the process significantly.
When Can Your Data Be Processed Without Consent?
Article 6 outlines situations where processing is considered lawful even without explicit consent:
- Processing is necessary to perform a contract you are party to (e.g., a work contract or tenancy agreement)
- Processing is required to comply with a legal obligation
- Processing protects your vital interests or those of another person
- Processing serves a legitimate interest of the controller, provided it does not override your fundamental rights
Understanding these exceptions helps you recognize when an organization is legally entitled to use your data and when they are overstepping.
Sensitive Personal Data: Extra Protections
Article 12 creates a higher level of protection for sensitive personal data, which includes health records, biometric data, financial details, and information relating to religion or political views. Organizations must:
- Obtain a license from the Personal Data Protection Center before handling sensitive data
- Obtain your written and explicit consent unless an exception applies by law
As an expat, this is particularly relevant when dealing with private hospitals, insurance providers, and employers who may request health or financial records.
What to Do If Your Rights Are Violated
If you believe an organization has mishandled your personal data, you can:
- Contact the Personal Data Protection Center, the regulatory authority established under Article 19, headquartered in Cairo
- File a formal complaint requesting an investigation
- Pursue civil or criminal liability under the law's penalty provisions
The Center has the authority to issue warnings, impose remediation orders, and revoke licenses of non-compliant organizations.
Practical Advice for Expats
- Always read consent forms carefully before signing documents that include data collection clauses
- Keep copies of any written consent you provide to Egyptian organizations
- Verify that any company handling your sensitive data holds a valid license from the Personal Data Protection Center
- If you are unsure about your rights in a specific situation, consult a licensed Egyptian lawyer familiar with data protection law