Egypt Personal Data Protection Law (Law No. 151 of 2020) Reg.3: Controller controls: accuracy checks, deletion with notice, a Centre-approved rights mechanism, the Egyptian representative, inspector access and records of requests

What does Reg.3 require?

The controller holds a Centre licence or permit of the category its activity needs, without prejudice to the approvals of the authorities regulating that activity; complies with the purpose licensed or permitted; verifies accuracy by reviewing the source and consistency with the purpose; deletes data immediately when the purpose ends and notifies the data subject of the deletion, keeping data retained for a legitimate reason in a non-identifying form; operates a Centre-approved mechanism for access, withdrawal of consent, correction, limitation and objection requests; where based outside Egypt without a branch or representative office, appoints a representative through a branch or an office acting for it, accredited by the Centre for the licence period, a natural person appointing an agent; gives the Centre's inspectors access to electronic records as judicial officers; obtains only the volume and type of data the law regulating its activity allows; binds collectors to confidentiality; tests and evaluates accuracy and integrity periodically under the Centre's mechanisms; renders data retained for legal or national security reasons unreadable and non-identifying and deletes it when the reason ends; keeps confidentiality and recovery and timely-access measures against physical or technical incidents; and keeps secure electronic records of addition and modification requests with their outcome and reasons, deletion and consent-withdrawal requests with their outcome and the means of notifying the data subject, and data withheld for legal or national security reasons in a form the inspectors can verify.