EGYPT Law and Practice Contributed by: Ibrahim Shehata, Tasneem El-Naggar and Safa Rabea, Shehata & Partners
5.2 Government Notifications and Approvals Approvals Required for Cross-Border Data Transfer The PDPC’s approval is required to obtain a licence or permit to proceed with transferring data across borders. In order to apply for said licence or permit, an application must be sub - mitted on the forms produced by the PDPC and attaching all the necessary supporting materials, demonstrating the applicant’s financial stability and technical competence. Following the com - pletion of all the applications, decisions must be made within no more than 90 days. The applica - tion will be declared rejected if the allotted time has passed without a decision from the relevant authority in the PDPC. In deciding whether to approve or reject the application, the PDPC may ask for further infor - mation, papers or documents. If the protection stated in the supplied papers is insufficient, the PDPC also has the right to seek the provision of additional guarantees for the protection of per - sonal data. It is worth mentioning that the PDPC, in accord - ance with public interests, may amend or change the provided licences or permits, even following their issuance, if: • new or relevant international, regional and/or local regulations have been issued that affect cross-border matters; • the licensee has requested to amend the purpose of their licence; • the data controller or data processor is going to merge with other entities or persons out - side Egypt; and • amendments are deemed necessary in order to continue implementing the rules of the PDPL.
This framework ensures that international data transfers comply with Egypt’s commitment to safeguarding personal data and maintaining regulatory oversight. 5.3 Data Localisation Requirements The PDPL stresses the fact that data should remain within the borders of Egypt, thereby ensuring the protection of any type of data for the protection of the public interest. The PDPL mentions the establishment of the PDPC, which will be responsible for localising the data. In addition to the PDPC, other data localisation centres are already established and are adher - ing to the rules of the Telecommunications Law until the executive regulations of the PDPL are issued. Said data centres require specific licences in order to be registered and able to operate, which can be obtained from the NTRA. These centres can be differentiated by whether they will oper - ate within or outside Egyptian borders. • Private data centres: these are established by a natural or legal person for their own exclu - sive use, without making the centre available in whole or in part to any other party. No specific registration or licences are required, whether operating inside or outside Egyptian borders. • Co-location/multi-tenants’ public data centre provider (PDCP): these data centres are established within Egypt for the purpose of hosting service providers. No specific regis - tration or licences are required when operat - ing outside of Egypt, but a licence is required when operating inside Egypt. • Cloud service provider (CSP): these are com - panies providing cloud services of all kinds, whether through wholly owned data centres or leased from licensed PDCPs. No specific
119 CHAMBERS.COM
Powered by FlippingBook