Regulations › Rest of world › Egypt
PDPL (Egypt)
Personal Data Protection Law, Law No. 151 of 2020 (Egypt)
WhenIn force since 2020; Executive Regulations issued in 2025
Who enforces itPersonal Data Protection Center (PDPC)
Who it applies toControllers and processors handling the personal data of people in Egypt.
Tell the regulatorNotify the Center within 72 hours of becoming aware
DPO requiredEvery legal-entity controller and processor must appoint a qualified employee as DPO and regis…
RegistrationControllers and processors need Center licences with fees capped at EGP 2 million, plus permit…
Transfers abroadTransfers abroad need equivalent protection in the destination and a licence or permit from th…
Request deadlineSix working days to respond
Maximum fineFines up to EGP 5 million (about USD 100,000) per offense, doubled for repeat offenses
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
3
Covers Egyptians anywhere, non-Egyptians in Egypt, and non-Egyptians abroad where the data concerns Egyptians or residents and the act is also criminal there.Issuance Art. 2 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Lawful basis
3
Explicit consent is the default; other grounds are contract, legal obligation and exercising legal rights. No legitimate interests ground.Arts. 2, 6 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Consent
2
Explicit consent for specific purposes is required; sensitive and children's data need written explicit consent.Arts. 2, 6, 12 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Executive Regulations may prescribe consent mechanics.
Sensitive data
3
Processing sensitive data requires both written explicit consent and a licence from the Personal Data Protection Center.Art. 12 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Children
3
Children's data is sensitive. Under 15 needs written guardian consent; for ages 15 to 18 the Center sets the consent mechanism.Art. 1; Exec. Regs Art. 15 (Decision 816/2025) · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Regulation article per translation; not confirmed against the Gazette.
People's rights
Rights
2
Know and access data, withdraw consent, correct and erase, restrict processing, object, and be told of breaches.Art. 2 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. No portability or automated decision right.
Request deadline
3
Six working days to respond; silence is treated as refusal.Art. 32 (per translation); Art. 10 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Article number for the six-day period unconfirmed.
Marketing
2
Electronic direct marketing requires prior consent, a clear opt-out and a Center licence; consent records kept three years.Arts. 17-18; Exec. Regs Art. 18 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Governance
DPO required
3
Every legal-entity controller and processor must appoint a qualified employee as DPO and register them with the Center.Art. 8 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
DPO qualifications
3
DPOs must be registered with the Center, reportedly after credentials checks, a clean record and a Center-approved exam.Art. 8; Executive Regulations (Decision 816/2025) · secondary source · source ↗
Exam and category rules from secondary summaries; regulation articles not verified.
Registration
3
Controllers and processors need Center licences with fees capped at EGP 2 million, plus permits for transfers, marketing and CCTV.Arts. 26-27; Executive Regulations · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Validity and tiered fees from secondary sources.
DPIA
1
No express DPIA in the Law; the DPO must run periodic assessments and audits of data protection systems.Art. 9 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Executive Regulations DPIA provisions not confirmed.
Records
2
Controllers must keep a dedicated record of processing, and processors a record of processing activities.Arts. 4, 5 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Retention
2
Data may not be kept longer than the purpose requires and must be erased when the purpose ends.Arts. 3, 4 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Breaches
Tell the regulator
2
Notify the Center within 72 hours of becoming aware; national-security breaches immediately.Art. 7 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Tell people
3
Notify affected data subjects within three working days after notifying the Center.Art. 7 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Transfers
Transfers abroad
3
Transfers abroad need equivalent protection in the destination and a licence or permit from the Center, unless a listed exception applies.Arts. 14-15 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Localization
0
No general in-country storage mandate.Art. 14 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Enforcement
Maximum fine
2
Fines up to EGP 5 million (about USD 100,000) per offense, doubled for repeat offenses.Arts. 41, 42, 45, 48 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. USD value near the scale boundary.
Criminal liability
3
Many violations carry imprisonment (at least 3 to 6 months); managers who knew of a violation face the same penalties.Arts. 36, 41-42, 47 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Private action
2
Victims keep the right to claim compensation; entities are jointly liable for employees' violations.Arts. 35, 47 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws