Your cameras are a data transfer

Under Egypt's data protection regulations, cameras are a licensed activity. Article 31 of the Executive Regulations requires a licence from the Personal Data Protection Centre (PDPC) for visual surveillance in public places, and it restricts footage from being transferred, made available, recorded or processed outside Egypt except for legally prescribed reasons. A foreign video management cloud is therefore a direct problem, not a paperwork one.

Cameras rarely appear in a data inventory because nobody thinks of them as a system. This briefing is about closing that gap. It is not legal advice.

1What Article 31 says

Visual surveillance in public places needs a licence or permit, and its output must stay in Egypt. The English rendering of Article 31 provides that the Centre issues licences and permits for visual surveillance means in public places. One of the obligations attached is, in that rendering, "not to transfer, make available, record, or process what has been monitored through such means to outside the geographic territory of the Arab Republic of Egypt, except for legally prescribed reasons."

Visual surveillance licences and permits also appear in the list of licence types in Articles 19 and 20, alongside controller, processor, cross-border transfer and electronic marketing licences.

2Why cameras are usually missed

Because they are bought by facilities, not IT, and they increasingly run in someone else's cloud. A modern camera estate often includes:

• a cloud video management system hosted outside Egypt, where recordings are stored and reviewed
• remote monitoring by a security contractor, sometimes from another country
• analytics features such as people counting, licence plate recognition or face matching, processed by the vendor
• mobile apps that stream live and recorded footage to managers wherever they are

Each of those can move footage, or its processing, outside Egypt. None of them shows up in an asset register built by IT.

3Workplace cameras still make you a controller

Employee data is fully in scope, and CCTV in offices, warehouses and branches processes it. There is no internal-processing exemption for staff data. Whether a given site counts as a "public place" for Article 31 is a legal question we cannot settle, but the footage is personal data either way, so the general obligations and the cross-border rules still apply to it.

4Five questions to ask about your cameras

1. Where are recordings stored, including any cloud backup, and in which country?
2. Who can view footage remotely, and from where?
3. Does the vendor process footage for analytics, and where does that processing run?
4. How long is footage kept, and can you prove it is deleted?
5. Which of your sites face a street, a shop floor or any other area the public can enter?

If the answer to the first three involves a server outside Egypt, treat the camera system as a priority in your remediation plan rather than a footnote.

5What remediation usually looks like

Keeping recording and processing inside Egypt, and licensing what the regulations require. For most organisations that means an on-premises or Egypt-hosted video management system, analytics that run locally, remote access that does not replicate recordings abroad, a defined retention period, and a visual surveillance licence for public-facing sites.

6Where we might be wrong

• "Public places". The rendering we rely on does not define the term. Whether a reception area, a retail floor or a car park open to visitors qualifies needs counsel's view.
• "Legally prescribed reasons". The exception to the no-transfer rule is not defined in the text we reviewed.
• Coverage. At least one practitioner overview of the Executive Regulations does not address visual surveillance at all, so the treatment above rests mainly on one article-level rendering. Check the article number and wording against the Arabic text.

Get Egyptian counsel before changing a camera contract on the strength of this. To find out where your footage actually goes, book our 90-minute data audit.

Sources

Executive Regulations, article level: Consortio Law Firm English rendering, ID Law Firm overview

Practitioner alerts: Baker McKenzie, Clyde & Co