.webp)
Last updated: 2026-10-17
Egypt’s Personal Data Protection Center (PDPC) has opened its electronic portal for licence, permit and accreditation applications. For foreign SaaS providers, e-commerce businesses and other companies handling personal data connected to Egypt, the immediate task is to establish which permissions apply and prepare the evidence needed to support them.
Use 31 October 2026 as a conservative operational readiness target. Current legal commentary identifies that date as the end of the compliance grace period, although published interpretations of the statutory calculation differ. The portal’s opening does not itself create a fresh transition period.
The portal is publicly reachable. However, this review could not independently test authentication, submission, payment or processing of an application. The steps below therefore distinguish published requirements from practical recommendations and procedures that still require confirmation.
The change is the launch of the application portal, separate from the regulator’s earlier information website and published guidance.
A legal update dated 7 October 2026 reports that the portal launched earlier that month to receive and process applications. An exact launch day could not be established from an official dated announcement reviewed for this article.
The legal foundation remains Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, issued under Ministerial Decision No. 816 of 2025. The regulations establish the electronic application framework.
A functioning public address does not establish that every category is available to every applicant. This review could not verify that all licence, permit and accreditation routes are enabled, or confirm completed submissions, approvals or current processing times.
Article 6 of the law’s issuance provisions gives covered parties one year from the issuance of the Executive Regulations to regularize their position. This is separate from Article 6 of the substantive PDPL, which concerns lawful processing.
The regulations were published on 1 November 2025 and took effect on 2 November 2025. These dates should not be treated as interchangeable.
October 2026 legal updates identify 31 October 2026 as the compliance deadline. Other legal analysis uses 1 November 2026. The materials reviewed did not establish a definitive official day-counting clarification that resolves that difference.
For implementation planning, complete readiness work and pursue the applicable filings before the end of October. Obtain Egyptian legal advice on the precise deadline and the position of applications awaiting a decision. The recommendation to plan for 31 October is not a claim that the statutory calculation is undisputed.
No official extension, general transitional waiver or automatic protection for pending applications was identified in this review as of 17 October 2026. That finding should not be read as proof that no unpublished or applicant-specific administrative arrangements exist.
The PDPL concerns personal data processed electronically, wholly or partly. Its territorial reach needs careful analysis.
Article 2 of the issuance law addresses offences involving Egyptians inside or outside Egypt, non-Egyptians residing in Egypt, and certain non-Egyptians abroad. For the last category, the provision includes a requirement that the conduct also be punishable where it occurred and concern data of Egyptians or foreigners residing in Egypt.
That is more conditional than a blanket statement that every foreign website with an Egyptian visitor must obtain a licence.
A foreign business should document its Egyptian establishment, customers and users, affected individuals, processing locations, contractual roles and any sector exclusions. The Central Bank and entities under its supervision have a statutory exclusion with exceptions, including money-transfer companies and exchange offices. Being a fintech business does not, by itself, establish an exemption.
An Egyptian customer’s request for a licence number is a useful trigger for review, but it cannot replace the scope assessment. For broader context, see our guide to Egypt’s Personal Data Protection Law.
A controller determines how personal data is obtained and handled for its activities. A processor carries out processing in the circumstances described by the law, including under a controller’s instructions. Both roles have obligations under the Egyptian framework.
For example, a SaaS provider may process customer-uploaded employee records under a customer’s instructions while controlling its own account administration and marketing records. That example calls for an activity-level assessment; the word “processor” in a contract does not settle every use of data.
As a practical starting point, create one list of purposes the business determines and another of processing it performs for customers. Match those lists to the proposed application category. Record who maintains processing records, implements security, handles rights requests and coordinates incidents.
The customer’s permission should not be assumed to cover the supplier’s separate responsibilities.
A licence is issued to a legal person for authorized activities and lasts three years, subject to renewal. A permit can be issued to a natural or legal person for a temporary period of up to one year. The regulations address permits for specified, temporary purposes.
Accreditation concerns qualification to provide personal-data-protection consultancy. It is not a general certificate that a customer’s operations comply with the PDPL.
Assess the general controller, processor or combined permission alongside any additional activity-specific permission. Electronic direct marketing, international transfers and public-space video surveillance have separate provisions.
A useful application worksheet should connect each activity to its proposed permission, supporting evidence, responsible owner and unresolved question. Avoid choosing a category simply because it appears first in the portal.
The framework distinguishes marketing a business’s own goods or services from marketing for others. A company running its own campaigns should assess the relevant marketing permission; outsourcing delivery does not settle the brand’s obligations.
The PDPL requires consent, identification of the communication’s originator and sender, a reachable sender address, a clear marketing purpose and an accessible refusal or withdrawal mechanism. Article 18 requires the relevant electronic consent records and changes to be retained for three years from the last communication.
Before the next campaign, test whether the team can produce the consent evidence for a selected recipient, explain the campaign purpose and demonstrate that withdrawal reaches every sending platform. Ask an agency to demonstrate the source and permission for its contact data.
For telephone campaigns, also review the separate telecommunications layer discussed in our article on Egypt’s promotional-call rules.
International transfers require a separate assessment of authorization, destination protection and applicable consent or statutory exception conditions. A contract with a cloud provider does not, by itself, establish permission under Egyptian law.
The regulations provide for a transfer application identifying the destination, recipient activity, purpose, data categories and volume, retention, storage locations and security arrangements. They contemplate submission through the dedicated portal and regulatory review.
For a technology business, build the transfer inventory around real operations. Check cloud hosting, backups, analytics, support access and onward disclosures. A database hosted in Egypt may still be accessible to overseas personnel, so hosting location alone is an incomplete assessment.
Consider an Egyptian retailer using an overseas support platform. The preparation file should explain which customer fields enter the platform, which entities receive them, where they are stored, who can access them and what happens when the retailer deletes a ticket.
This review could not verify the current live transfer-application workflow, a complete current destination-country list or a newly issued October filing manual. Confirm the accepted route and safeguards before relying on a proposed transfer arrangement.
The PDPC’s published guidance states that legal-entity data users must appoint a data protection officer regardless of processing scale. It also describes registration in the DPO Registry.
The guidance expressly contemplates foreign applicants: it lists a passport as the identity document for foreigners and requires a duly certified foreign criminal-record document. Other listed items include a photograph, qualification evidence and application fees. The DPO category framework also addresses competence and examinations.
This supports the availability of foreign applicants under the published framework. It does not establish that an overseas DPO can complete the live portal process without an Egyptian national ID, or that an existing global appointment automatically satisfies Egyptian requirements.
Confirm the candidate’s eligibility, examination route, registration category and relationship with the appointing entity. Keep the appointment documentation and registration status distinct in the project tracker.
The regulations impose a representation requirement on covered controllers and processors outside Egypt that lack a branch or representative office in the country. They refer to a representative inside Egypt and PDPC accreditation of that representation for the relevant licence or permit period.
The October legal update reports that portal profiles and applications use Digital Egypt authentication linked to an Egyptian national ID. It describes an authorized local representative using their own credentials to act for a foreign company.
The authentication procedure could not be independently verified against a current official portal manual. Treat it as a reported operational requirement to confirm with the PDPC, rather than a tested set of instructions.
Before appointing someone to submit, obtain confirmation of:
A current official checklist establishing the exact authorization documents was not located. Do not assume that an ordinary appointment letter, a particular power-of-attorney form or a foreign passport will be accepted for corporate onboarding.
The representative, DPO and portal account user have distinct functions. None is automatically equivalent to a lawyer, a GDPR Article 27 representative or a Türkiye data controller representative.
The published regulations use activity, role, record volume and, for permits, duration to determine fees.
The general licence schedule includes a fee exemption for 1–100,000 personal-data records. The general permit schedule includes a fee exemption for 1–25,000 records. These are fee provisions, not general exemptions from obtaining the applicable permission or complying with the law.
The regulations also link transfer fees to 50% of the relevant controller/processor fee, and marketing fees to 10% for marketing for oneself or 25% for marketing for others. Different categories may have their own rules.
These are published regulatory provisions, not a verified portal quotation. Confirm the applicable record-count methodology, category, current payable amount and any separate registration charges before budgeting or paying. This review did not verify a live fee calculation, payment receipt or later administrative fee adjustment.
Application preparation can proceed while account-access questions are being resolved.
The regulations call for corporate identification and activity information, the requested category, data characteristics, retention and storage arrangements, security information, DPO details and information about consent and individual-rights mechanisms.
Use the following as a working preparation pack, rather than a claim that these are the portal’s exact upload fields:
Ask system owners to validate the answers. If the inventory says that support data is deleted after 90 days, confirm that backups, exports and the support supplier’s settings support that statement. An application should describe implemented controls accurately and distinguish unfinished work.
Published PDPC guidance includes materials on consent, DPOs, privacy notices and other compliance topics. At least some guidance is dated 26 January 2026; it should not be presented as newly issued October guidance. The guidance also carries qualifications about its status and does not replace the law or regulations.
Identify whether the obstacle is technical, documentary or substantive. A login error requires a different response from an incomplete authorization document or a control the business has not implemented.
Recommended steps are:
A support ticket is not an application receipt. A submitted application is not an issued permission. Keep account creation, submission, completeness confirmation, payment and approval as separate milestones.
For corporate applications and transfers, the regulations describe a decision period of up to 90 working days after the information and documents are complete, with non-response treated as rejection. The parent law refers to 90 days. Obtain advice on the applicable procedural clock rather than assuming that regulatory silence grants approval.
No verified general policy was found under which a pending application automatically suspends enforcement or authorizes continued processing.
Before the end of October, the business should be able to answer these questions:
Preserve a dated evidence file containing the application version, authorization documents, DPO records, processing inventory, control evidence, receipts and correspondence. Record the source and version of procedural guidance relied on. Evidence of preparation supports a clear account of what happened; it does not create an exemption.
The practical objective is to leave October with a documented scope assessment, working controls and a traceable application position. Establish what has been approved, what is pending and what still needs a decision.
For businesses operating across Egypt and Türkiye, contact Kooch to discuss the Türkiye-facing KVKK/GDPR gap analysis and security documentation within your regional programme. Egyptian legal interpretation, PDPC filings and local representation should be handled with appropriately qualified Egyptian support.
