EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
vice fee payable by the data subject to the controller or processor, as determined by the Center and within the legally prescribed limit. The practice of the Center in the future might lead to the generation of more specific rights for data sub - jects, based on its interpretation and the implementa - tion method of the law. Main Compliance “To-Dos” for Organisations While it is difficult at this early stage of the PDPL’s implementation to make an exhaustive to-do list for organisations, the following actions require attention. • Updating the existing privacy policies to meet the requirements of the Regulations – eg, specifying the scope of collecting and processing the data and the nature of collected data, implemented procedures in case of data breaches, and cross- border transfer of data. • Collecting and recording the written and explicit consent of data subjects in readily accessible records that comply with the standards set out in the Regulations. • Conducting a comprehensive assessment of the data held, in terms of relevance, accuracy and recency, deleting or anonymising unnecessary data to reduce regulatory risk, and documenting such actions. In case of deletion, there is a requirement to notify the data subject of such. • Appointing a data protection officer (DPO) and providing appropriate legal and technical training, with a view to ensuring successful registration with the Personal Data Protection Center. The appoint - ment should be made in writing and grant the DPO sufficient independence to effectively perform their duties. • Appointing a local representative where operations are conducted in Egypt without an established corporate presence in Egypt. • Reviewing and reorganising internal access con - trols, including defining data access rights, hierar - chies and systems, to ensure that personal data is accessible only to authorised personnel. • Developing and implementing a comprehensive data security policy, including technical and organi - sational measures, incident response procedures,
access controls and periodic reviews, in line with the standards issued by the Center. • Determining in advance the permits and licences required, and allocating the necessary resources while preparing the relevant documentation and supporting information. • Designing a notification procedure to ensure compliance with the Regulations timelines for data breach notifications, whether within 72 hours or without delay, as applicable. • Assessing how personal data is transferred, accessed, shared, circulated or stored outside Egypt, identifying local alternatives where feasible and, where not, ensuring that the hosting country has an adequate data protection framework and that the existing arrangements meet appropriate business, security and compliance standards. • Introducing data consent and data protection compliance provisions into service agreements, employment contracts and any other agreements involving the sharing of personal data. • Where applicable, concluding data processing agreements that clearly allocate responsibilities and liabilities between the parties. 1.3 Special Categories of Personal Data The PDPL identifies certain categories of personal data as sensitive personal data, the processing of which is subject to additional obligations. Sensitive personal data includes data revealing a person’s mental, psychological, physical or genetic health, biometric data, financial data, religious beliefs, political opinions or security status. Children’s data is also classified as sensitive. General Requirements All activities related to sensitive personal data must meet the following requirements: • obtaining a permit or a licence from the Center; • obtaining the explicit written consent of the data subject; • collected data needs to be essential and necessary for the ultimate purpose of processing (ie, data minimisation), without causing any harm to the data subject;
74 CHAMBERS.COM
Powered by FlippingBook