Pursuant to Article (14) of the Law, it is prohibited to transfer any personal data that was collected or prepared for processing to a foreign country unless such country grants a level of protection of personal data, that does not fall below what is stipulated in the Law and subject to obtaining a relevant license or permit from the Centre. However, exceptions are made under Article (15) of the Law, if the direct consent of the data subject or his representative is obtained for transferring, sharing, circulating or processing personal data to a country that does not offer the same level of protection in the following cases:

• To protect the data subject’s life and provide them with medical care, treatment, or the administration of medical services.
• To perform obligations in order to prove the existence of a legal right or to exercise or defend such right before the judiciary.
• To conclude or perform an agreement entered into by the person responsible for processing the personal data and third party, which shall be in favor of the concerned data subject.
• To perform a procedure required under an international judicial cooperation.
• There is legal necessity or obligation to protect the public interest.
• To transfer money to another country pursuant to the laws in force of that country.
• If the transfer or circulation is pursuant to a bilateral or multilateral agreement, to which the Arab Republic of Egypt is a party.

In addition, the controller or the processor may, as the case may be, grant access to personal data to another controller or processor outside the Arab Republic of Egypt by virtue of a license from the Centre provided that the following conditions have been met:

• There is conformity between the nature of work of either of the controllers or processors, or unity between the purposes for which they obtain the personal data.
• Either the controllers or processors, or the data subject, have a legitimate interest in the personal data.

The level of legal and technical protection of the personal data offered by the controller or the processor abroad shall not fall below the level of protection provided in the Arab Republic of Egypt.