EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
processing is necessary, proportionate and balanced against the rights of the data subjects. During the due diligence phase, personal data may be disclosed only to the extent strictly necessary to assess the transaction, in accordance with the data minimisation principle. Access should be limited, and appropriate confidentiality and security meas - ures must be implemented. Where the data involved qualifies as sensitive personal data, it may not be processed or shared unless the explicit and written consent of the data subject has been obtained, in addition to implementing appropriate confidentiality and security measures. At the stage of change of control or asset transfer, the transfer of personal data constitutes a new processing activity and must be based on a lawful ground, and personal data may not be used for purposes exceed - ing those for which it was originally collected without a valid legal basis. A change in the data controller triggers transparency and notification obligations, including informing data subjects of the change in control or processing pur - poses and complying with any mandatory notifica - tions to the Center where required by the PDPL. Following the closing and post-merger integration, the acquiring entity must review and align data process - ing activities, update privacy notices and policies, and ensure that databases are not merged or reused for new purposes without a lawful basis.
With respect to the mechanisms and assessments required for cross-border lawful transfers, the PDPL and its Regulations set out the key requirements appli - cable to any data controller or processor, as follows. • As a general rule, the PDPL and its Regulations prohibit the transfer, storage or sharing of personal data outside Egypt unless the destination country ensures a level of data protection not less than the level prescribed under the PDPL and its Regula - tions. • Notwithstanding the adequacy of the level of protection requirement, cross-border transfers to countries that do not provide an equivalent level of protection may be permitted subject to the explicit consent of the data subject (or their representa - tive), and only in limited cases, specified under Article 15 of the PDPL. • The controller or processor must obtain a licence or permit from the Center, based on its assessment of the adequacy of the level of protection in the destination country. • The controller or processor must obtain the con - sent of the data subject for the cross-border transfer. • Appropriate technical and organisational measures must be implemented to ensure an adequate level of protection for personal data during transfer, stor - age or sharing, in line with the scope and nature of the data and the terms of the licence or permit. • Personal data may only be transferred to the coun - try or countries specified in the licence or permit, and any addition of new countries requires an update of such licence/permit. Moreover, onward transfers are permitted only where the activities of the relevant controllers or processors are compatible or integrated, or serve a legitimate interest of the parties or the data subject, and pro - vided that the level of legal and technical protection applied by the controller or processor located abroad is not less than the level applicable in Egypt. 5.2 Government Notifications and Approvals The PDPL and the Regulations set out the conditions, procedures and applicable fees for obtaining a licence or permit from the Center to transfer personal data across borders. However, as a general rule, a licence/
5. International Considerations 5.1 Restrictions on International Data Transfers
Cross-border transfers of personal data in Egypt are regulated under the PDPL and its Regulations. How - ever, the PDPL and its Regulations adopt a broad con - cept of transfer, which covers any transfer, storage, sharing, disclosure, or making available of personal data, whether for processing, storage or any other purpose.
83 CHAMBERS.COM
Powered by FlippingBook