The Egyptian Data Protection Law (DPL) explicitly excludes data processing activities of certain financial institutions from its scope, provided specific conditions are met.

Text of the Relevant Provision

Article 3(6) DPL stipulates:

“6. Personal data which is held by the Central Bank of Egypt and entities subject to its control and supervision, with the exception of money transfer companies and currency exchange companies, provided that the rules set out by the Central Bank of Egypt in relation to handling personal data are observed.”

()"6. البيانات الشخصية التي يحتفظ بها البنك المركزي والجهات الخاضعة لرقابته وإشرافه، باستثناء شركات تحويل الأموال وشركات الصرافة، وذلك شريطة مراعاة القواعد التي يضعها البنك المركزي بشأن التعامل مع البيانات الشخصية."()

Analysis of Provisions

Article 3(6) DPL carves out a specific exception for data processing activities carried out by:

• "the Central Bank of Egypt"* ("البنك المركزي") and
• "entities subject to its control and supervision" ("الجهات الخاضعة لرقابته وإشرافه")

However, this exclusion is not absolute. It explicitly excludes from the exemption:

• "money transfer companies and currency exchange companies" ("شركات تحويل الأموال وشركات الصرافة")

Furthermore, even for the “Central Bank of Egypt” ("البنك المركزي") and the supervised entities that are not explicitly excluded, the exemption only applies:

• "provided that the rules set out by the Central Bank of Egypt in relation to handling personal data are observed" ("ذلك شريطة مراعاة القواعد التي يضعها البنك المركزي بشأن التعامل مع البيانات الشخصية")

Implications (for Business)

• The DPL does not apply to the processing of personal data by the Central Bank of Egypt itself.
• Entities regulated by the Central Bank of Egypt, except for money transfer and currency exchange companies, are also exempt from the DPL, but only if they adhere to the Central Bank of Egypt’s data protection rules. This means that these entities must familiarize themselves with and comply with a separate set of data protection regulations issued by the Central Bank of Egypt.
• Money transfer companies and currency exchange companies, despite being regulated by the Central Bank of Egypt, are subject to the DPL. This means that these companies must establish DPL compliance frameworks and cannot rely solely on compliance with the Central Bank of Egypt's data protection rules.