Egypt Data Protection Law Executive Regulations: Where They Stand

If you're trying to comply with Egypt's Personal Data Protection Law (Law No. 151 of 2020) and keep hitting the same wall — the executive regulations — you're not imagining things. They've been delayed for years. Here's where things actually stand and what to do in the meantime.

Quick answer

As of October 2026, the executive regulations to Egypt's Personal Data Protection Law (Law 151/2020) have still not been formally issued. The law itself has been in force since October 2020, but Article 60 requires implementing regulations from the Prime Minister within six months of the law's publication — a deadline that passed in 2021 and keeps slipping. The Personal Data Protection Center, the regulator the law creates, is also not fully operational. In practice, compliance obligations exist on paper but enforcement mechanics remain incomplete.^[1][2]

Why the egypt data protection law executive regulations matter

The primary law sets the skeleton. It defines personal data, sensitive data, controllers, processors, data subject rights, cross-border transfer rules, and penalties running up to EGP 5 million for serious breaches.^[1]

But the skeleton isn't enough to run a compliance program.

The executive regulations are supposed to spell out the operational details: licensing fees for data controllers and processors, the format and procedure for cross-border transfer approvals, the technical and organizational security standards, the exact mechanics of appointing a Data Protection Officer (DPO), and how the Personal Data Protection Center (PDPC) actually processes complaints. Article 60 of Law 151/2020 directed the Prime Minister to issue these within six months of publication in the Official Gazette.^[1]

That deadline was April 2021. We're well past it.

Draft versions have circulated among stakeholders — ministries, telecom regulators, industry bodies — but no final text has been published in the Official Gazette. The Ministry of Communications and Information Technology (MCIT) has publicly acknowledged the delay on multiple occasions.^[2]

Honestly, this is where most compliance teams get stuck. You can't apply for licenses that don't have a published fee schedule. You can't file transfer requests through a center that isn't fully staffed.

What's actually enforceable right now

The law itself is in force. That's the part people miss.

Core obligations under Law 151/2020 apply regardless of whether the regulations are published:

• Consent requirements (Art. 2) — you need clear, informed, specific consent before processing personal data, with narrow exceptions for legal obligations and legitimate interests.^[1]
• Data subject rights (Arts. 3-6) — access, correction, erasure, withdrawal of consent, objection to processing.
• Breach notification (Art. 7) — controllers must notify the PDPC within 72 hours of becoming aware of a breach, and notify affected data subjects within three days.
• Cross-border transfer restrictions (Arts. 14-17) — transfers abroad require a level of protection equivalent to Egypt's and, in principle, a license from the PDPC.
• DPO appointment (Art. 8) — mandatory for controllers and processors handling sensitive data, large-scale processing, or regular systematic monitoring.

Penalties in Articles 35-45 are real. Fines range from EGP 100,000 to EGP 5 million depending on the violation, with criminal penalties including imprisonment for sensitive-data violations and unauthorized cross-border transfers.^[1]

The practical gap: without a functioning licensing regime, companies can't formally obtain the authorizations the law requires. Enforcement so far has been limited, but the exposure window keeps widening.

Watch out: The 72-hour breach notification clock runs now, not when the regulations are issued. If your systems are breached today, you're expected to notify the PDPC — even if the notification portal and procedures aren't fully built out. Document your attempt to notify.

What the draft executive regulations are expected to cover

Multiple draft iterations have leaked or been shared in consultation. The expected scope — and this is the shape the final text is likely to take — includes:

Licensing and fees. Separate license categories for controllers, processors, cross-border transfer operators, and electronic marketing. Each with its own application form, documentation requirements, and fee schedule. Early drafts suggested fees ranging from EGP 20,000 to EGP 500,000 per license category, though final numbers aren't confirmed.

Technical and organizational measures. Minimum security standards — encryption, access controls, logging, incident response plans. Expected to lean on existing MCIT and National Telecom Regulatory Authority (NTRA) cybersecurity frameworks.

Cross-border transfer mechanics. Adequacy assessment criteria, standard contractual clauses templates, binding corporate rules recognition. Also the procedure for exceptional transfers under Art. 15.

DPO requirements. Qualifications, independence guarantees, registration with the PDPC, reporting lines.

Children's data. Procedures for parental consent verification for processing data of minors under 18.

PDPC operational rules. Complaint-handling procedure, inspection powers, administrative appeal process.

If you're building a compliance program now, these are the areas to design flexibility into. Build to the law, keep procedures modular, and expect the regulations to tighten rather than loosen what's already there.

What to do while you wait

Three things worth doing now, regardless of the regulatory gap:

Map your data. You can't comply with rules you haven't translated into your own systems. Inventory what personal data you collect, where it sits, who processes it, which transfers cross Egyptian borders. This work doesn't change when the regulations drop.

Draft the consent and notice language. Article 12 of Law 151/2020 lists what privacy notices must contain. Build these now. If you operate online, your privacy policy should already reflect Law 151's language, not a generic GDPR-copy.

Prepare the DPO function. If you're in a sector that will clearly need a DPO — fintech, healthcare, telecom, large e-commerce — identify the person, document the role, and build the reporting line to management. The regulations will formalize registration, but the function should already exist.

For broader context on sector-specific obligations, see our overview of data protection answers for Egypt.

The regulations will land eventually. Companies that waited to start are the ones who'll scramble.

Where to check for updates

The executive regulations, once issued, will appear in the Official Gazette (Al-Waqa'i al-Masriya). The MCIT website and the Personal Data Protection Center page are the most reliable monitoring points. News of a Prime Ministerial Decree in draft form has surfaced periodically since 2022 — treat these as signals, not as final text.^[2][3]

Until Gazette publication, nothing is binding beyond Law 151/2020 itself.

---