EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
• abiding by all the requirements and standards issued by the Center; and • maintaining electronic and secure records of pro - cessing activities. Special Requirements for Children’s Data The PDPL imposes additional requirements for the processing of children’s data, as follows. • If the child is under 15 years old, valid consent must be obtained from the child’s guardian in writ - ing and in an explicit manner. Such consent must be limited in time, and may be revoked later on. • If the child is at least 15 years old, the child, or their guardian, must give their written consent. • If the child is to participate in a game or a competi - tion, the requested data must be limited to what is strictly necessary. Moreover, such data may not later be used in any operations involving profiling, tracking or behavioural monitoring of children. Processing of Data Relating to Criminal Convictions and Offences The PDPL does not apply to criminal convictions and offences, as it expressly excludes personal data relating to judicial seizure records, investigations and judicial proceedings from its scope. Consequently, such data falls outside the regulatory framework of the PDPL. Under the rules of criminal procedure, investigations conducted by the Public Prosecution are confidential by operation of law. Pursuant to Criminal Procedures Law No 174 of 2025, access to investigation materials and case files is restricted to legally authorised per - sons whose involvement is required for the conduct of the proceedings, and only to the extent permitted by law. 1.4 Processing of Personal Data for Research and Development Purposes The anonymisation process is currently not regulated under the PDPL, but may be organised by the Center at a later date. However, data related to persons only constitutes “personal data” – and therefore becomes subject to the PDPL –where it relates to an identi - fied or identifiable individual, including health data. Once such data no longer pertains to an identified or
identifiable individual, it automatically falls outside the scope of the PDPL. Egyptian law does not provide for a unified or sector- specific regime governing the secondary use, sharing or reuse of health data comparable to the European Health Data Space Regulation. Instead, the appli - cable legal framework is limited to the general rules set out under the PDPL. As a result, the regulation of secondary uses of health data in Egypt, including the anonymisation of patient data for product develop - ment or scientific research, remains contingent on any future decisions, guidelines or regulatory frameworks to be issued by the Center. 1.5 Processing of Personal Data in the Context of Artificial Intelligence Egypt does not currently have a standalone law regu - lating AI. Accordingly, the use of personal data in the training, development or operation of AI systems or models is governed by the PDPL and its Regulations. Any processing of personal data in this context must comply with the general data protection principles set out under the PDPL, including lawfulness, purpose limitation, data minimisation, data accuracy, storage limitation, integrity and confidentiality, and account - ability. Specific AI-Related Requirements and Guidance Under the Regulations, where personal data is used to train or operate AI models, the legal obligation imposed on data processors is limited to compliance with “locally, regionally, and internationally recognised standards”. This includes the Egyptian Charter for Arti - ficial Intelligence, a soft law document issued by the National Council for Artificial Intelligence. This Charter includes the common international standards, such as human-centredness, transparency and explainability, fairness, security and safety, and accountability, and covers the use of AI in both the public and private sectors. 1.6 Data Breach Requirement A personal data breach includes any unauthorised access, disclosure, copying, transfer, alteration or destruction of personal data during storage, trans - mission or processing. Once aware of a breach, both
75 CHAMBERS.COM
Powered by FlippingBook