Egypt Personal Data Protection Law, rights of the Data Subject

Article 2 bars collecting, processing, disclosing or revealing Personal Data by any means except with the Data Subject's explicit consent or where a law permits it, and gives the Data Subject six rights: to know, review and obtain their own Personal Data held by any Holder, Controller or Processor; to withdraw prior consent to its retention or processing; to correct, edit, delete, add to or update it; to limit the processing to a specified purpose; to be notified of any infringement of their Personal Data; and to object to the processing or its results where it contradicts their fundamental rights and freedoms.

Except for the right to be notified of an infringement, the Data Subject pays a consideration for the service of exercising those rights, which the Center fixes and which may not exceed twenty thousand Egyptian pounds. Article 32 requires a Holder, Controller or Processor to reply to a request to exercise those rights within six working days of its submission.

Article 33 lets the Data Subject and any relevant person complain to the Center, without prejudice to judicial proceedings, where the right of Personal Data protection has been infringed, where the Data Subject has not been able to exercise their rights, or against a decision of the Data Protection Officer on a request made to them.

Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.