Regulations › Rest of world › Egypt
PDPL (Egypt)
Personal Data Protection Law, Law No. 151 of 2020 (Egypt)
WhenIn force since 2020; Executive Regulations issued in 2025
Who enforces itPersonal Data Protection Center (PDPC)
Who it applies toControllers and processors handling the personal data of people in Egypt.
Tell the regulatorNotify the Center within 72 hours of becoming aware
DPO requiredEvery legal-entity controller and processor must appoint a qualified employee as DPO and regis…
RegistrationControllers and processors need Center licences with fees capped at EGP 2 million, plus permit…
Transfers abroadTransfers abroad need equivalent protection in the destination and a licence or permit from th…
Request deadlineSix working days to respond
Maximum fineFines up to EGP 5 million (about USD 100,000) per offense, doubled for repeat offenses
43%
of Egypt's 21 requirements are already met by European Union (GDPR). Here is what PDPL (Egypt) adds, biggest gaps first.
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PDPL (Egypt) adds3 Controllers and processors need Center licences with fees capped at EGP 2 million, plus permits for transfers, marketing and CCTV.
Arts. 26-27; Executive Regulations · source ↗
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PDPL (Egypt) adds3 Explicit consent is the default; other grounds are contract, legal obligation and exercising legal rights. No legitimate interests ground.
Arts. 2, 6 · source ↗
DPO requiredGovernanceBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
PDPL (Egypt) adds3 Every legal-entity controller and processor must appoint a qualified employee as DPO and register them with the Center.
Art. 8 · source ↗
DPO qualificationsGovernanceBig gap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
PDPL (Egypt) adds3 DPOs must be registered with the Center, reportedly after credentials checks, a clean record and a Center-approved exam.
Art. 8; Executive Regulations (Decision 816/2025) · source ↗
Criminal liabilityEnforcementBig gap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PDPL (Egypt) adds3 Many violations carry imprisonment (at least 3 to 6 months); managers who knew of a violation face the same penalties.
Arts. 36, 41-42, 47 · source ↗
Reach abroadReach and lawful basisGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
PDPL (Egypt) adds3 Covers Egyptians anywhere, non-Egyptians in Egypt, and non-Egyptians abroad where the data concerns Egyptians or residents and the act is also criminal there.
Issuance Art. 2 · source ↗
Sensitive dataReach and lawful basisGap
GDPR2 Special categories (health, biometrics, religion, etc.) are prohibited unless explicit consent or another listed exception applies.
PDPL (Egypt) adds3 Processing sensitive data requires both written explicit consent and a licence from the Personal Data Protection Center.
Art. 12 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
PDPL (Egypt) adds3 Children's data is sensitive. Under 15 needs written guardian consent; for ages 15 to 18 the Center sets the consent mechanism.
Art. 1; Exec. Regs Art. 15 (Decision 816/2025) · source ↗
Request deadlinePeople's rightsGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
PDPL (Egypt) adds3 Six working days to respond; silence is treated as refusal.
Art. 32 (per translation); Art. 10 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PDPL (Egypt) adds2 Data may not be kept longer than the purpose requires and must be erased when the purpose ends.
Arts. 3, 4 · source ↗
Tell peopleBreachesGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
PDPL (Egypt) adds3 Notify affected data subjects within three working days after notifying the Center.
Art. 7 · source ↗
Transfers abroadTransfersGap
GDPR2 Transfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or a listed derogation.
PDPL (Egypt) adds3 Transfers abroad need equivalent protection in the destination and a licence or permit from the Center, unless a listed exception applies.
Arts. 14-15 · source ↗
Already covered by GDPR: Consent, Rights, Marketing, DPIA, Records, Tell the regulator, Localization, Maximum fine, Private action.
A gap means PDPL (Egypt) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws