Law No. 151 of 2020 and its Executive Regulations, issued by Ministerial Decree No. 816 of 2025, now govern how every business collects, uses, stores and transfers personal data in Egypt. The regularisation period ends on 1 November 2026. From that date, the Personal Data Protection Centre exercises its full licensing, supervisory and inspection powers.
For Egyptian companies, international groups and the global law firms who advise them, we explain what the Law requires, who it applies to and how to reach compliance quickly and defensibly.
Why this matters now
Data protection in Egypt is no longer a planning exercise. With the end of the regularisation period, the Centre may inspect, request records, refuse or revoke licences and refer violations for criminal prosecution.
Who the Law applies to
The Law applies to any natural or legal person that collects, processes or controls personal data processed wholly or partly by electronic means, whether established in Egypt or abroad, where the data concerns Egyptians or residents of Egypt.
- Banks, non-bank financial institutions and FinTech companies
- Telecom operators, technology platforms and e-commerce businesses
- Hospitals, clinics, laboratories and insurers
- Foreign companies serving customers in Egypt
- Every employer holding staff data
What is at stake
Non-compliance carries legal, commercial and transactional consequences.
- Criminal fines that may reach EGP 5 million, and imprisonment in certain cases
- Personal liability of the person in charge of actual management of a company
- Suspension or revocation of licences by the Centre
- Reputational damage and loss of customer trust
- Price, warranty and indemnity exposure in M&A and financing transactions
Controller vs. processor
Correctly identifying your role is the starting point for compliance, because the Law imposes distinct obligations on each. One company can be a controller for some operations and a processor for others.
| Aspect | Controller | Processor |
|---|---|---|
| Definition | Determines the purposes and means of processing personal data. | Processes personal data on behalf of the controller. |
| Core duty | Ensures a lawful basis and specific, legitimate purposes, and is primarily accountable to data subjects and the Centre. | Acts only on the controller’s documented instructions and within the defined purposes. |
| Licensing | Licence or permit from the Centre. | Licence or permit from the Centre. |
| Records | Keeps a record of processing activities. | Keeps a record of processing carried out for each controller. |
| Retention | Erases data once the purpose is fulfilled. | Erases or returns data to the controller when the purpose ends. |
| Security and breaches | Applies safeguards and notifies the Centre of breaches. | Applies safeguards and promptly informs the controller of any breach. |
| Data Protection Officer | Must appoint a registered DPO. | Must appoint a registered DPO. |
Agreements between controllers and processors should clearly allocate roles, instructions, security standards, sub-processing and breach responsibilities.
Key obligations and conditions
Each area below sets out what the Law requires and the steps a business should take before inspections begin.
- Cross-border transfers
- Data Protection Officer
- Licences and permits
- Consent and lawful basis
- Breach notification
- Sensitive and children’s data
- Electronic marketing
Cross-border data transfersCloud hosting, group systems and offshore support
Personal data may not be transferred, stored or shared outside Egypt unless the destination country ensures a level of protection not lower than that provided under Egyptian law, and a licence or permit is obtained from the Centre. The Law sets out limited exceptions that require the data subject’s explicit consent, such as protecting life, performing a contract, and establishing or defending legal claims.
This directly affects cloud hosting, group-wide HR and CRM systems, outsourcing and offshore support centres.
Required steps
- Map every data flow leaving Egypt
- Assess the protection level of each destination
- Apply for the cross-border transfer licence
- Put transfer agreements in place with recipients
The Data Protection OfficerMandatory for controllers and processors
The legal representative of every controller and processor must appoint a qualified Data Protection Officer, registered in the Centre’s DPO register. The DPO is the point of contact with the Centre and is responsible for internal compliance.
Core responsibilities
- Periodic assessment of processing systems
- Keeping records and implementing the Centre’s decisions
- Enabling data subject rights and handling complaints
- Breach notification and correcting violations
- Staff training and internal monitoring
Licences and permitsPersonal Data Protection Centre
Controllers and processors must obtain the licence or permit that matches their activity from the Centre. Separate licences apply to processing sensitive data, cross-border transfers and electronic marketing.
Required steps
- Classify the business as controller, processor or both
- Identify every licence category that applies
- Prepare and file the applications with supporting documents
- Track renewals and conditions
Consent and lawful basisPurpose limitation, minimisation and retention
Personal data may only be processed with the data subject’s explicit consent or on another lawful basis set by the Law, for specific, clear and legitimate purposes. Only the data needed for the purpose may be collected, and it may not be kept longer than the purpose requires.
Required steps
- Review privacy notices and consent forms
- Document the lawful basis for each processing activity
- Set retention periods and deletion procedures
Breach notification72 hours to notify the Centre
The Centre must be notified within 72 hours of becoming aware of a breach of personal data, followed by notification of affected data subjects within the statutory period. Technical and organisational security measures must be in place at all times.
Required steps
- Adopt a written incident response plan
- Assign roles and escalation lines
- Prepare notification templates in advance
- Run regular breach simulations
Sensitive data and children’s dataHealth, biometric, financial and other categories
Sensitive data, including health, genetic, biometric, financial, religious and political data, may only be processed with explicit written consent and a specific licence from the Centre. Processing children’s data requires the consent of the guardian.
Sectors most affected
- Banking, FinTech and insurance
- Healthcare and laboratories
- Education and EdTech
- Biometric access and HR systems
Electronic marketingConsent and opt-out
Direct electronic marketing requires the recipient’s prior consent, clear identification of the sender and an easy way to opt out of future messages.
Required steps
- Audit marketing lists and consent records
- Add opt-out links to every message
- Keep consent evidence for each contact
Rights of data subjects
Businesses must be able to respond to these requests promptly and document how they did so.
- Know and accessTo know about, access and obtain their personal data.
- Withdraw consentTo withdraw prior consent to retention or processing.
- Correct and eraseTo correct, update, add to or erase their data.
- Restrict and objectTo restrict processing, object to it, and be told of any breach.
Key dates
- 2020
- Personal Data Protection Law No. 151 of 2020 is issued.
- November 2025
- The Executive Regulations are issued by Ministerial Decree No. 816 of 2025, opening a one-year regularisation period.
- 1 November 2026
- The regularisation period ends and the Personal Data Protection Centre begins full supervision, inspection and enforcement.
How Dawoud & Dawoud Law Firm can help
A structured path from first review to ongoing compliance.
- Gap assessmentA full compliance review with a prioritised remediation plan.
- Licensing and DPOLicence applications before the Centre, and DPO appointment and registration.
- Policies and contractsPrivacy notices, consent forms, controller–processor and transfer agreements.
- Ongoing supportBreach response, representation before the Centre, and data protection due diligence in transactions.
Frequently asked questions
When is Egypt’s data protection law fully enforced?
The regularisation period under the Executive Regulations ends on 1 November 2026. From that date the Personal Data Protection Centre exercises its full supervisory and inspection powers.
Does the Law apply to foreign companies?
Yes. It applies to controllers and processors outside Egypt where the processing concerns the personal data of Egyptians or of residents in Egypt.
Can personal data be transferred outside Egypt?
Only to a country that ensures a level of protection not lower than Egyptian law, and with a licence from the Centre, subject to limited exceptions that require the data subject’s explicit consent.
How quickly must a data breach be reported?
The Centre must be notified within 72 hours of becoming aware of the breach, and affected data subjects must then be informed within the statutory period.
How does Egypt’s PDPL compare with the GDPR?
It shares core principles with the GDPR, such as lawful basis, purpose limitation and data subject rights, but adds a licensing system run by the Centre and mandatory registration of Data Protection Officers.
Who can help with PDPL compliance?
Dawoud & Dawoud Law Firm advises Egyptian and international companies on gap assessments, PDPC licensing, DPO appointment, cross-border transfers and breach response.
قانون حماية البيانات الشخصية المصري — ملخص
تنتهي مهلة توفيق الأوضاع المقررة باللائحة التنفيذية لقانون حماية البيانات الشخصية رقم 151 لسنة 2020، الصادرة بقرار وزير الاتصالات وتكنولوجيا المعلومات رقم 816 لسنة 2025، في الأول من نوفمبر 2026، ويباشر مركز حماية البيانات الشخصية اعتبارًا من هذا التاريخ سلطاته الرقابية والتفتيشية كاملة.
أبرز الالتزامات
- الحصول على الترخيص أو التصريح اللازم من المركز لكل من المتحكم والمعالج.
- تعيين مسؤول لحماية البيانات الشخصية وقيده في السجل المعد لذلك.
- إمساك سجل بعمليات المعالجة.
- إخطار المركز بأي خرق للبيانات خلال اثنتين وسبعين ساعة.
- حظر نقل البيانات إلى خارج البلاد إلا إلى دولة توفر مستوى حماية لا يقل عن المستوى المقرر قانونًا، وبترخيص من المركز.
المتحكم والمعالج
المتحكم هو من يحدد أغراض المعالجة ووسائلها، أما المعالج فيتولى المعالجة لحساب المتحكم ووفقًا لتعليماته. ويرتب القانون على المخالفة غرامات قد تصل إلى خمسة ملايين جنيه، والحبس في بعض الحالات.
يقدم مكتب داود وداود للمحاماة خدمات تقييم الامتثال، واستخراج التراخيص، وصياغة السياسات والعقود، ودعم مسؤولي حماية البيانات، وإدارة الخروقات.
This page provides general information on Egyptian law as of October 2026 and is not legal advice. Laws and regulations change, and specific advice should be obtained for each matter.
© Dawoud & Dawoud Law Firm. All rights reserved. The content of this page may not be copied, reproduced, scraped, harvested, or used to train artificial intelligence systems, by automated or manual means, without the prior written consent of Dawoud & Dawoud Law Firm. Search engines may index this page and display short excerpts with attribution.
← ALL INSIGHTS