Egypt’s Personal Data Protection Law

Egypt’s Personal Data Protection Law: A Guide for Foreign Tech Companies

Introduction

Egypt’s Personal Data Protection Law No. 151 of 2020 (the “PDPL”) sets rules for personal data processing‍. The law was adopted in 2020 and must now be read with Executive Regulations No. 816 of 2025. This guide covers scope, processing grounds, individual rights, licensing, transfers and implementation, with comparisons to GDPR and Türkiye’s KVKK.

Scope and Applicability of the PDPL

Who Must Comply: The PDPL applies to any natural or legal person (individuals or organizations) that electronically processes personal data of individuals in Egypt‍. This includes entities operating within Egypt, as well as foreign companies processing data about people in Egypt under certain conditions. Notably, the law’s scope is limited to electronic or technical processing of personal data – data processed manually and not intended to be part of an electronic filing system may fall outside its scope.

Extraterritorial Reach: Article 2 of the issuance law addresses offences committed outside Egypt. Nationality, residence and, for certain foreign offenders, dual criminality affect the analysis. Application to a non-Egyptian person abroad is conditional; assess the company’s activities, establishment and affected individuals rather than assuming every obligation applies because one customer is in Egypt.

Exemptions: The law explicitly excludes certain data processing activities from its scope. Key exemptions include:

Personal or household use: Personal data processed by an individual purely for personal/family use is not covered.
Journalistic and media purposes: Data processed for media purposes is exempt if it is done truthfully and in compliance with press/media laws‍. (This protects journalistic activities, though accuracy and other media law requirements still apply.)
Official statistics or legal obligations: Processing for official statistical purposes is exempt. Do not assume that every processing activity required by another law is outside the PDPL.
Judicial and security contexts: Exemptions address judicial records, investigations, proceedings and national-security bodies. The Central Bank and entities under its supervision are generally exempt, with exceptions including money-transfer companies and exchange offices.

These carve-outs are similar to those seen in other privacy laws (for example, GDPR also exempts purely personal or household activities and certain national security or criminal justice processing). Foreign companies should be aware that most commercial data activities (customer data, employee data, analytics, etc.) will fall under the PDPL, whereas data handled for government or national security purposes may not.

Key Requirements and Obligations under the PDPL

1. Lawful Bases for Processing: Processing requires valid consent or another applicable legal ground, unless another legal basis applies‍. Identify the ground for each purpose and data category. The law and regulations determine when processing is “legitimate and legal”:

Consent: Consent should be specific, informed and linked to the stated purpose. Check the separate requirements for electronic direct marketing.
Contract or Legal Action: The processing is necessary for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering a contract. It also covers processing needed to conclude or execute an agreement in the interest of the data subject, or to take legal action regarding the data subject’s rights. In practical terms, this permits use of personal data to fulfill contractual services (e.g. processing an e-commerce order) or to defend or exercise legal claims.
Legal Obligation or Order: The processing is necessary for compliance with a legal obligation, for carrying out an order from competent investigative authorities, or based on a judicial ruling. For example, if Egyptian law requires certain records for compliance, or if a court orders disclosure of data, those actions are lawful.
Legitimate Interest (with Balancing Test): The processing is necessary for the controller to fulfill its obligations or for any concerned person to exercise their legitimate rights, provided this necessity does not conflict with the fundamental rights and freedoms of the data subject. This clause is akin to a legitimate interests basis – it allows processing for the legitimate interests of the controller or others, but only if it doesn’t override the individual’s privacy rights. Companies relying on this basis should be prepared to demonstrate why their purpose is necessary and how they have balanced it against the individual’s rights.

Note: Unlike the GDPR, the PDPL does not import GDPR legal grounds into an Egyptian assessment without checking the local provisions. Current PDPC guidance also addresses non-profit statistical or educational purposes. Map each activity to the applicable law and regulations.

2. Data Subject Rights: The PDPL grants individuals a set of rights over their personal data, largely mirroring those in the GDPR‍. Companies must be prepared to honor these rights and establish procedures to respond within the legal timeframes. Key data subject rights under PDPL include:

Right to Access and Know: Individuals have the right to know whether a controller or processor holds their personal data and to review or obtain a copy of their data. This is similar to GDPR’s right of access. In practice, upon request, a company should provide the individual with the personal information it holds about them, along with information on how it’s being used.
Right to Withdraw Consent: Individuals may withdraw consent. Stop processing that relies solely on that consent for the relevant purpose, while separately assessing any continuing retention or other legal obligation.
Right to Correction and Deletion: Individuals have the right to have their personal data corrected, updated, or deleted (the “right to be forgotten”) if it’s inaccurate, outdated, or if the processing is unwarranted. Upon request, businesses should rectify incorrect data about the person or erase data that’s no longer needed or where consent has been withdrawn.
Right to Restrict Processing: Data subjects can require that processing be limited to specific purposes or object to certain uses. For instance, an individual might allow their data to be used for service provision but not for marketing – organizations must respect such preferences.
Right to Object: Individuals may object to processing or its results where these conflict with their fundamental rights and freedoms. Assess the objection against the applicable legal ground.
Right to be Notified of Data Breaches: Affected individuals must be informed under the applicable breach rules. Current PDPC guidance specifies three working days from notification to the Center.

Companies need accessible communication channels such as a dedicated privacy email address or portal. If charging for a request, check the statutory limit and current PDPC rules, including except. Do not charge for breach notification. Individuals can use the PDPC’s complaint routes if their rights are infringed‍.

3. Data Security and Breach Notification: The PDPL mandates that organizations protect personal data with appropriate technical and organizational measures (“Data Security”). Controllers and processors must ensure data is kept secure, accurate, and is not retained longer than necessary – essentially enforcing principles of integrity, confidentiality, and storage limitation. In the event of a data breach (termed a “Personal Data Infringement”), there are strict notification duties:

The Personal Data Protection Center (PDPC) must be notified of any data breach within 72 hours of the organization becoming aware of it. This timeline mirrors the GDPR’s 72-hour breach notification rule. If the breach might affect national security, notification must be immediate to the authorities.
When notifying the PDPC, the controller/processor should provide details on the nature of the breach, the affected data volume, contact information for the Data Protection Officer, likely consequences, and measures taken to address the breach‍. Maintaining an internal breach log with these details is advisable to meet this requirement.
Data subjects must also be informed of the breach within three working days after notifying the PDPC. Track the authority and individual notification deadlines separately rather than combining them into an approximate week. Prepare notification templates in advance.

4. Data Protection Officer (DPO): Under PDPL, DPO appointment and registration requirements must be assessed. The Egyptian role is distinct from Türkiye’s registry contact person or representative. Legal-entity data users should check the current appointment and PDPC registration conditions.

The DPO’s responsibilities, as outlined in the law, include overseeing compliance with the PDPL and its Executive Regulations, handling data subject requests and complaints, and acting as the liaison with the PDPC‍. Appointment does not remove the organization’s own responsibilities.
The appointment of the DPO must be registered with the PDPC under the current process. Check the PDPC registration guidance for qualifications, application documents and organizational requirements.
Make the DPO’s contact details accessible as required. Confirm which details must be published and where.

Existing global privacy expertise may help, but a global DPO does not automatically satisfy Egypt’s appointment, organizational and registration conditions. Assess Arabic communication and local-law knowledge.

5. Registration, Licenses, and Permits (Regulatory Oversight): One distinctive aspect of the PDPL is the requirement for formal licenses/permits from the regulator for certain data processing activities. Under the law, the new Personal Data Protection Center (the PDPC) is empowered to issue licenses, permits, and certifications to entities handling personal data‍. Key scenarios include:

General Processing License: Companies must obtain a license or permit from the PDPC to engage in personal data processing (especially if handling sensitive data or conducting electronic marketing)‍. Map the controller and processor roles, data categories and activities to current license categories. The Executive Regulations have been issued; check current PDPC procedures, documents and fees.
Sensitive Data Handling: The PDPL is particularly strict about Sensitive Personal Data includes categories such as health, biometric and financial data, beliefs, political opinions, security-status information and children’s data. Such processing is subject to additional conditions, including without a license from the PDPC and explicit consent from the data subject and any statutory exceptions. Assess these requirements during product planning, especially for health and child-facing services.
Cross-Border Data Transfer Approvals: As detailed in the next section, transferring personal data out of Egypt requires PDPC permission (a form of license or permit) unless certain conditions are met. The PDPC will be responsible for evaluating whether foreign jurisdictions have adequate protection and granting transfer licenses.
Local obligations for foreign organizations: Organizations established outside Egypt should verify the applicable local appointment and communication requirements under current PDPC rules. Do not assume GDPR Article 27 applies by analogy; distinguish the DPO, legal representative and licensing applicant roles.

The PDPC now provides information about licensing and DPO registration services. Foreign companies should include administrative compliance steps in their market-entry plan and allow time and budget for applications.

6. Cross-Border Data Transfer Rules: Egypt’s PDPL imposes restrictions on transferring personal data outside of Egypt, aiming to ensure that data leaving the country still enjoys a high level of protection. Cross-border personal data transfer is only allowed under certain conditions, generally requiring that the destination country offers protection “not less than” that provided by Egyptian law and subject to PDPC approval. Key points include:

Adequate Protection & PDPC License: By default, to export personal data from Egypt, the foreign receiving country must have a data protection standard at least equivalent to Egypt’s, and the Egyptian data controller/processor must obtain a transfer license or permit. Check current country lists, accepted safeguards and the permission’s scope. Document each flow’s purpose, recipient, data categories and onward transfers.
Exceptional transfer cases: Article 15 provides exceptional cases and the applicable conditions must be assessed together with explicit consent where required‍:
1. Protection of life or vital interests: e.g. to preserve the life of the data subject and provide medical care. (Think of a situation where a person’s medical records need to be sent abroad in an emergency.)
2. Contractual necessity for the data subject: e.g. fulfilling obligations to execute a contract that benefits the data subject.
3. Legal or judicial requirements: e.g. for international judicial cooperation, or to fulfill a legal obligation/public interest.
4. Transfers of money: e.g. executing a money transfer to another country per applicable financial laws.
5. International agreements: if the transfer is pursuant to a bilateral or multilateral treaty that Egypt is party to.
Document whether an exception applies. explicit consent alone does not justify all routine international flows. Do not assume that headquarters access, cloud hosting or remote support qualifies for an exception. Confirm the transfer route and, where needed, consider keep personal data hosting within Egypt or work toward obtaining PDPC approval for transfers.
Additional Conditions for Foreign Controllers/Processors: Article 16 of the law allows disclosure of data to foreign entities by license subject to the applicable conditions. Map centralized hosting, support access and subprocessors. Decide whether architecture changes are needed after establishing the lawful transfer route. Also verify local appointment and registration conditions separately.

7. Enforcement and Penalties: The PDPL provides for fines and criminal penalties for specified offences. Distinguish PDPC supervision from the jurisdiction of Egypt’s Economic Courts of Egypt which have jurisdiction over PDPL offences. Key penalty provisions to note:

Financial penalties: The applicable amount depends on the provision breached. Do not use old currency conversions or a single general maximum for every offence; check the relevant current statutory provision.
Criminal Penalties: Certain breaches of the PDPL carry criminal consequences including imprisonment for responsible persons. Notably, unlawful processing of sensitive personal data or conducting cross-border transfers in violation of the law can lead to offence-specific penalties. There is no single prison term applicable to every infringement. Assess corporate and individual liability against the elements of the relevant offence.
Aggravating factors: Repeat offenders can face double penalties, and courts may order the publication of the judgment in the media at the violator’s expense to publicly expose the offense. Attempted violations (even if not completed) are punishable by half the penalty of a full violation. These provisions are intended to deter non-compliance by increasing consequences for intentional or repeated neglect of the law.
Complaint and Redress: Individuals can use the PDPC’s current complaint channels. Record and investigate requests and assign responsibility for regulatory correspondence.

Implementation Timeline and Current Status

Track the law and implementing regulations separately:

Law Passage and Effective Date: Law No. 151 was published on 15 July 2020. Its commencement provision uses a three-month period from the day following publication; the law took effect in October 2020.
Executive Regulations: Executive Regulations No. 816 of 2025 were published on 1 November 2025 and took effect the next day. Implementation plans should use that text. The regulations are now in force. Do not defer licensing or registration work while waiting for their publication.
Grace Period for Compliance: The PDPC explains that covered parties must regularize their position within one year of the Executive Regulations entering into force. Confirm the timetable applicable to the organization and any subsequent decisions with the PDPC.
Current Enforcement Climate: The PDPC’s official website provides licensing, permit, DPO registration and complaint information‍. Use its current services and guidance. The absence of a particular published penalty is not evidence that obligations do not apply or that preparation can be postponed.

Before entering Egypt, verify the applicable implementation timetable and administrative procedures. Allow time for any required applications, appointments, contract changes and staff training.

Comparison with GDPR and Turkey’s KVKK

The regimes share some principles but have separate scope, processing, appointment, registration and transfer requirements.

Scope and Territorial Reach: All three laws aim to protect personal data of individuals, but their scope has nuances:

Material Scope: GDPR and KVKK apply to personal data processing whether automated or part of a structured filing system (so even some paper records are covered by GDPR/KVKK). The PDPL, by contrast, explicitly covers electronic processing of personal data. This means purely offline records might be outside PDPL’s purview, a narrower scope. In practice, most modern business data is electronic, so this difference may have limited impact, but it’s there.
Territorial Scope: GDPR applies through establishment and, in defined circumstances, offering goods or services to or monitoring people in the EU. KVKK and PDPL scope must be assessed under their own provisions. Egyptian nationality and residence connections matter under PDPL; overseas offences have additional conditions. A foreign individual’s residing status and the company’s activities must be assessed together. Do not conflate corporate, tax or registry obligations with data-protection territorial scope.

Legal Bases for Processing: Record the applicable ground for each activity:

GDPR: Provides six legal bases – consent, contract, legal obligation, vital interests, public task, and legitimate interests. GDPR’s framework often allows organizations to choose bases like legitimate interests instead of consent for many routine business purposes, provided they document a balancing test.
KVKK (Turkey): General-data processing requires explicit consent or a condition in Article 5. Legitimate interests must not override the person’s fundamental rights and freedoms. For special categories of data, apply Article 6 as amended in 2024 rather than relying on the former health-data exception alone.
PDPL (Egypt): Assess consent and other grounds against the current law and regulations. explicit consent has particular relevance to electronic direct marketing and certain sensitive-data activities.In practice: Identify a ground for each purpose and distinguish cases requiring consent from other processing conditions. Marketing may also be subject to sector and electronic-communications rules.

Data Subject Rights: Access, correction and other rights exist in all three regimes, but their scope and deadlines differ‍. A GDPR request process should not automatically be treated as sufficient. Verify the applicable Egyptian working-day deadline under current rules. KVKK Article 13 expressly requires a response as soon as possible and within 30 days at the latest; GDPR’s general period is one month, subject to its extension conditions.

Data Protection Officers: GDPR requires DPOs in specified circumstances. Türkiye’s registry contact and representative are different roles. Under PDPL, assess DPO appointment and registration conditions separately. An appointment under one regime does not automatically satisfy another regime’s qualifications or registration requirements.

Registration and Regulatory Approval: GDPR has no general controller licensing system. Türkiye’s VERBIS registration system depends on applicability and exemptions. Egypt’s licenses and permits depend on the processing activities. Identify the required applications and the authority responsible for each. Because regulatory oversight differs, plan the application documents and timetable separately for each jurisdiction.

Cross-Border Data Transfers: Do not use one regime’s transfer mechanism as a substitute for another:

GDPR: Adequacy decisions, standard contractual clauses, binding corporate rules and specified derogations may be available. Check the scope and any supplementary assessment requirements.
KVKK (Turkey): Article 9, amended in 2024, provides for adequacy and appropriate safeguards. Safeguards specified by the Board include standard contracts, which must be notified to the Authority within five working days after signature. Where adequacy and safeguards are absent, explicit consent and other occasional-transfer exceptions have their own conditions; do not assume consent authorizes routine cloud flows.
PDPL (Egypt): Assess PDPC licensing or permission, protection requirements and statutory exceptions. Storage within Egypt is not automatically mandatory in every case. Verify the transfer route before assuming localization is required or that a particular foreign jurisdiction is adequate.

Enforcement and Penalties: Enforcement regimes also differ:

Regulators: GDPR is enforced by the relevant European authorities, KVKK by Türkiye’s Authority and Board, and PDPL by the PDPC. Court jurisdiction is a separate question. Avoid predicting enforcement behavior from the regulator’s institutional structure.
Penalty severity: Check the offence, statutory provision and applicable year’s amounts rather than old TRY ceilings or currency conversions. criminal penalties also requires separate assessment: Egypt’s PDPL and Türkiye’s criminal law address specified personal-data offences.
Enforcement approach: Monitor current decisions and complaint procedures. Egypt’s Economic Courts have jurisdiction over PDPL offences. Distinguish regulatory review, administrative processes and criminal proceedings.

Compliance Strategy: From a strategy perspective:

GDPR: Maintain processing records, risk assessments, DPIAs where required and privacy-by-design controls, with evidence of implementation.
KVKK: Assess applicable VERBİS, transparency, rights-request, breach-reporting and transfer requirements alongside internal controls. Review GDPR documents locally before reusing them.
PDPL: In addition to inventories and security controls, plan regulatory application procedures and assign responsibility for PDPC engagement, licensing and requested records. Assess transfer and licensing conditions with local counsel and adapt technical architecture to verified requirements.

Assess each processing activity against its applicable requirements rather than ranking one regime as universally the strictest. Resolve conflicting obligations separately.

Practical Challenges for Foreign Companies in Egypt

Expanding into Egypt under the PDPL regime can present several practical challenges for foreign tech companies and their compliance teams:

Regulatory Uncertainty: The Executive Regulations have been issued. Monitor current license categories, application documents, DPO registration guidance and subsequent PDPC decisions. Assign responsibility for unresolved questions.
Tight Compliance Timelines: Assess the compliance period that began with the regulations entering into force. Schedule budgets, appointments, contracts and system changes promptly.
Local Representation and Workforce: Foreign companies should verify applicable local appointment conditions and plan Arabic communication capacity. Distinguish DPO, representative and authorized-applicant roles. Present notices and consent information in language users understand.
Data Localization vs. Global IT Architecture: Companies using centralized cloud or regional hubs should map cross-border data flow restrictions. Assess licensing, safeguards and exceptions before deciding whether local Egyptian processing or storage is necessary. Include backups, remote support and subprocessors in the analysis.
Consent Management and Marketing Practices: Electronic direct marketing requires assessment of prior valid explicit consent and the relevant licensing and recordkeeping conditions. Record who consented, when and to which information, and provide an accessible, free opt-out.
Sensitive Data Handling: Healthtech, fintech and child-facing services should assess sensitive-data conditions during product planning. financial data is classified as sensitive in PDPL; this differs from GDPR’s special-category list.
Enforcement Risk – Fines and Criminal Liability: Certain breaches may involve criminal liability as well as fines. Assess manager or employee liability against the relevant offence. Appointing a DPO does not automatically remove corporate or management responsibility.
Integration with Existing Compliance Programs: Reuse common inventories, security controls and request processes, but distinguish legal grounds, deadlines and applications by jurisdiction. Build routing and time tracking for Egyptian requests.

Record gaps, owners and target dates, and obtain management approval and resources.

Compliance Tips and Best Practices for PDPL

Review existing controls through the following steps:

Conduct a PDPL Readiness Assessment: Start with a gap analysis comparing your current data protection posture (e.g. GDPR or KVKK compliance) with PDPL requirements. Identify which areas need work – for example, do you have a Data Protection Officer appointed? Are you obtaining explicit consent for all the cases PDPL would require it? Do your contracts address Egypt-specific obligations? This assessment will help prioritize efforts.
Monitor Regulatory Developments: Monitor the Executive Regulations and subsequent PDPC decisions to stay updated. Assign a DPO or adviser to assess how each change affects processing activities.
Engage Local Expertise: Consider hiring a local privacy consultant or legal counsel familiar with PDPL to support documentation, licensing and regulatory communication. Verify the applicable local appointment requirements and who may fulfill each role.
Appoint and Empower a DPO: Assess the applicable conditions and designate a Data Protection Officer for your Egypt operations. Meet the PDPC registration requirements, provide required contact details and allocate resources for the role.
Assess data flows: Identify where Egyptian user and employee data is stored, processed and accessed. Distinguish the relevant datasets in the inventory. Verify transfer routes, permissions and recipients, and prepare to stop or change a flow if necessary.
Strengthen Consent and Preference Management: Identify purposes relying on consent and provide granular consent mechanisms on your apps or websites for different purposes (e.g., separate checkboxes for receiving marketing, for sharing data with partners, etc.). Ensure that no pre-ticked boxes or implicit consents are used. All consent should be explicit (an affirmative action). Also set up easy-to-use preference centers so individuals can withdraw consent or object to processing at any time – and make sure your systems honor these choices promptly (e.g., stop sending marketing emails once someone revokes consent). Keep logs of when and how consent was given, as evidence of compliance in case of disputes.
Update Privacy Notices and Contracts: Explain purposes, rights, DPO contacts and international transfers. Add necessary security, request-support, transfer, deletion and incident provisions to processor agreements.
Implement Data Subject Rights Processes: Train support and compliance teams to recognize access, correction and deletion requests. Verify the applicable response deadline under current rules and track it. Use proportionate identity checks before disclosing data.
Enhance Security and Breach Response Plans: Review access controls, appropriate encryption, backups and staff training. Update the incident response plan for PDPC and individual notifications. Prepare templates and exercise the separate 72-hour and three-working-day deadlines.
Prepare licensing and registration: Use current PDPC services to identify required registrations and obtain any necessary permits. Prepare policies, security descriptions, flow diagrams and other required documents; track applications and renewals.
Train and Raise Awareness: Train staff in Egypt and abroad according to their tasks: marketing consent checks, IT access and security, support-request routing and HR data handling. Use the organization’s actual workflows.

Reuse GDPR and KVKK work while recording and resolving Egypt-specific gaps.

Implementation priorities

Foreign tech companies should assess Egypt’s licensing, processing and transfer requirements separately from their GDPR or KVKK programmes.

The Executive Regulations are now in force. Follow current PDPC procedures, document unresolved questions and assign responsibility for verification before launch.

Sources:

Law No. 151 of 2020 (Egypt PDPL) – unofficial English translation, key Articles on scope, rights, and transfers acc.com.
ICLG – Data Protection in Egypt, 2025 – overview of PDPL definitions, principles, and penalties iclg.com.
Chambers & Partners – Data Protection & Privacy 2025: Egypt – historical material predating the implementing regulations practiceguides.chambers.com.
Hall, Booth, Smith P.C. – Egypt Passes Personal Data Protection Law – historical commentary on the law’s adoption hallboothsmith.com hallboothsmith.com.
CookieScript – KVKK vs GDPR differences – comparative secondary material to check against current official texts cookie-script.com.
Official Gazette Notice – Egypt’s PDPL publication date and effect acc.com dataguidance.com.

Related guidance and practical next steps

Current official sources

Masoud Salmani

Egypt’s Personal Data Protection Law