Egypt Personal Data Protection Law (Law No. 151 of 2020) Reg.18: Direct electronic marketing rules: marketing licence, explicit consent, erasure on withdrawal or expiry, first-contact disclosures, intermediary duties and records

What does Reg.18 require?

A sender of direct marketing communications, controller or processor, holds a marketing licence from the Centre and explicit consent from the data subject; the controller, processor or marketing intermediary erases the data on withdrawal of consent or on expiry of the retention period or cessation of the marketing purpose, whichever comes first; data collected for marketing is not used, exchanged or processed for any other purpose without explicit consent; the initial contact identifies the caller and the marketing purpose and lets the data subject refuse or withdraw through any Centre-approved means (social media messages, text, email, telephone or other technology); an intermediary verifies that the controller or processor obtained consent for the declared purposes and retains the source of the data with the consent, ceasing use immediately otherwise; and electronic records available to the Centre show how and when consent was obtained and its purpose, requests to erase or amend consent and the actions taken, and the data security mechanisms.