EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
the controller and the processor must take immediate action. Mandatory Notification The Center must be notified within 72 hours of becom - ing aware of the breach. Where the breach relates to national security considerations, notification must be made without delay. Notification must be submitted through the designated channels and recorded in a secure breach register, and must include details of the breach, affected data, potential impact, mitigation measures and the DPO’s details. Affected data subjects must be notified within three working days of notifying the Center, with information on the breach and the measures taken. Required Actions Organisations must: • assess and contain the breach; • notify the Center within the statutory timeframe; • notify affected data subjects; • document the breach and corrective actions; • implement technical and organisational measures to prevent recurrence; and • ensure oversight by the DPO. Investigations and Liability The Center may investigate breaches, request infor - mation and co-ordinate with national security authori - ties where applicable. Non-compliance may result in regulatory, administrative or criminal sanctions. 1.7 Regulators Personal Data Protection Center The Personal Data Protection Center is the primary authority responsible for enforcing the PDPL and its Regulations. It regulates activities related to person - al data processing, issues the required permits and licences, makes national policies and guidelines, and investigates violations. However, as it was only established recently, and there is currently a grace period extending until 31 October 2026, the Center is not yet fully utilising its regulatory powers.
In all cases, the Center has the power to make inves - tigations based on complaints it receives or at its own discretion. Moreover, the Center is duly authorised to effect settlements of claims and to enter into reconcili - ation agreements in respect of criminal proceedings with the parties concerned. The Center co-ordinates domestically with sectoral regulators and national security authorities. It may also co-operate with foreign data protection authori - ties pursuant to international, regional or bilateral agreements or based on reciprocity, for the purposes of protecting personal data, verifying compliance by controllers and processors outside Egypt, exchanging information and assisting in the investigation of data breaches and related offences. National Telecommunications Regulatory Authority (NTRA) The NTRA is responsible for overseeing privacy and confidentiality obligations within the telecommunica - tions sector in accordance with the Telecommunica - tions Law. Its mandate includes ensuring that telecom operators comply with legal requirements relating to the protection of users’ communications and personal data. Regulatory action by the NTRA may be triggered either by complaints submitted by users or through the NTRA’s own monitoring and supervisory activities. In this context, the NTRA is empowered to conduct audits and inspections of telecommunications opera - tors and to impose regulatory or administrative sanc - tions where breaches are identified. Authorities Responsible for the Enforcement of the Cybercrimes Law As described in 1.1 Overview of Data and Privacy- Related Laws , the Cybercrimes Law contains some provisions that are related to data privacy, especially when concerned with an individual’s reputation and private life. In this regard, the authorities responsible for enforcing the Cybercrimes Law include the Public Prosecution, the economic courts and the NTRA.
76 CHAMBERS.COM
Powered by FlippingBook