Egypt’s cloud computing sector is experiencing rapid growth, fueled by the nation’s digital transformation initiatives and strategic geographical position. As businesses increasingly migrate to the cloud, understanding the evolving legal and regulatory framework becomes more and more relevant to businesses across all sectors.
Regulatory Framework: NTRA's Oversight
The National Telecommunications Regulatory Authority (NTRA) has established a comprehensive framework governing the establishment and operation of data centers and the provision of cloud computing services in Egypt. This framework aims to attract large-scale data centers and cloud service providers, supporting Egypt’s digital transformation efforts. These regulations are designed to foster a secure and competitive environment for cloud services in Egypt.
Key aspects of the framework include:
- Licensing Requirements: Entities providing cloud services shall obtain appropriate licenses or registrations based on factors such as the geographical location of clients, the type of services offered, and whether services are for internal use or external clients.
- Cybersecurity Accreditation: Cloud service providers are required to undergo cybersecurity evaluations and obtain accreditation certificates from NTRA, ensuring compliance with data security standards.
Direct Connectivity: Licensed entities have the right to directly connect with submarine cable systems, enhancing data transmission capabilities.
Data Protection: Law No. 151 of 2020
The Personal Data Protection Law No. 151 of 2020 (DPL) outlines the legal framework for data privacy in Egypt. It defines personal and sensitive data and sets out obligations for data controllers and processors, including a general framework for cloud service providers.
Key provisions include:
- Consent and Rights: Data subjects must provide explicit consent for data processing, and they have rights to access, correct, and delete their data.
- Data Security: Entities must implement appropriate technical and organizational measures to protect personal data.
- Cross-Border Transfers: Personal data can be transferred outside Egypt only to countries that provide adequate data protection, and with approval from the Data Protection Center.
While the DPL provides a general framework, its application to cloud computing services, especially those involving cross-border data flows, requires careful consideration.
Sector-Specific Regulations: Financial Services
For financial institutions, additional regulations apply:
- Central Bank of Egypt (CBE): While the CBE’s regulations are generally silent on cloud services, they impose strict confidentiality requirements. Outsourcing arrangements—especially those involving foreign entities such as cloud service providers—must ensure compliance with the CBE’s confidentiality standards.
- Financial Regulatory Authority (FRA): The FRA allows the use of cloud services, in particular, cloud networks, for data shared between stock brokerage companies and the stock exchange and the Misr for Central Clearing, Depository, and Registry through any service provider.
These sector-specific regulations necessitate that financial institutions conduct thorough due diligence when engaging cloud service providers to ensure compliance with applicable laws.
Recent Developments: Cloud First Policy 2024
In August 2024, the Supreme Council of Digital Society implemented the “Cloud First Policy,”[1] mandating that cloud service providers obtain a Tier-3 license to offer services to governmental agencies. This policy underscores the government’s commitment to secure and reliable cloud services, especially for public sector operations.
Conclusion
As Egypt continues to embrace digital transformation, the legal space for cloud computing is becoming more structured and robust. Entities operating in this space shall navigate a growing set of regulations to ensure compliance and capitalize on emerging opportunities.
At Shehata & Partners, we remain at the forefront of these developments, offering expert legal guidance to clients navigating the new technology ecosystem in Egypt.
