Why International Data Transfer Rules Matter for Expats
As an expat, you are more likely than the average Egyptian resident to have your data flowing between Egypt and other countries. Common scenarios include:
- Your employer's international HR systems storing your employment and salary data on overseas servers
- Private health insurance providers transmitting your medical records to overseas underwriters
- Banks verifying your financial history with foreign institutions
- Using global digital platforms that process and store data outside Egypt
Under Law No. 151 of 2020, each of these scenarios must comply with specific legal requirements.
The General Rule: Adequate Protection Required
Article 14 establishes the fundamental principle governing cross-border data transfers. It is prohibited to transfer personal data collected in Egypt to a foreign country, or to store or share it abroad, unless:
- The destination country provides a level of protection not less than that required under Egyptian law
- The transfer is licensed or authorized by the Personal Data Protection Center
This means that before your data can leave Egypt, the organization handling it must demonstrate that the receiving country or organization maintains equivalent data protection standards.
Exceptions: When Transfers to Unprotected Countries Are Permitted
Article 15 provides a set of permitted exceptions where data may be transferred to a country that does not offer adequate protection, including:
- You, or your legal representative, have given explicit consent to the transfer
- The transfer is necessary for the performance of a contract to which you are a party
- The transfer is required for legal proceedings or to protect your vital interests
- The transfer serves a significant public interest recognized by law
Key practical point: Your employer cannot send your personal data to their overseas headquarters without either demonstrating adequacy of protection in that country or obtaining your written, explicit consent.
Transfers Between Controllers and Processors Abroad
Article 16 deals specifically with situations where an Egyptian-based controller or processor shares your data with another controller or processor located outside Egypt. This is permitted only when:
- The Personal Data Protection Center has issued a license for the transfer
- The nature of the activities and the purpose for which the data is transferred are clearly defined and legitimate
- The overseas recipient maintains appropriate data protection standards
This provision is highly relevant for multinational companies operating in Egypt that routinely share employee or customer data across their global networks.
Sensitive Personal Data: Stricter Controls
Article 12 applies an even higher threshold to sensitive personal data, including health records, biometric information, financial data, and data relating to religion or political beliefs. For sensitive data transfers:
- The organization must hold a license from the Personal Data Protection Center
- Written and explicit consent from you is required unless a specific legal exception applies
- The overseas recipient must meet the enhanced standards applicable to sensitive data
If you are an expat receiving medical treatment in Egypt and your insurer is based abroad, ensure that your hospital or clinic has the appropriate license before sharing your records internationally.
How to Protect Yourself
To ensure your data is being transferred lawfully when living in Egypt:
- Ask your employer whether their international data transfer practices are licensed by the Personal Data Protection Center
- Review contracts carefully: employment contracts, tenancy agreements, and insurance policies should specify if your data will be transferred abroad and on what legal basis
- Withhold consent if you are uncomfortable with international transfers and no adequate legal basis is provided
- Request confirmation from any organization proposing to transfer your sensitive data abroad that they hold the required license
- File a complaint with the Personal Data Protection Center if you discover your data has been unlawfully transferred to a foreign country
The Personal Data Protection Center's Role
The Personal Data Protection Center (established under Article 19) is the licensing authority for all international data transfers. It can:
- Grant, amend, or revoke transfer licenses
- Cooperate with foreign data protection authorities under international agreements (Article 25)
- Investigate unauthorized transfers and impose sanctions
Practical Advice for Expats Working for Multinational Companies
- Ensure your employment contract specifies exactly which countries your data may be transferred to
- Confirm that your company's Data Protection Officer has registered with the Center
- If your data is transferred to your home country's parent company, the receiving entity must still meet Egypt's adequacy standard or you must have given explicit consent