Personal Data Protection Law Egypt: What It Actually Requires

If you're processing personal data of anyone in Egypt — customers, employees, website visitors — you're caught by Law No. 151 of 2020. It's been in force since October 2020, but enforcement teeth took time to grow. Here's what the personal data protection law Egypt framework actually demands of you right now.

Quick answer

The personal data protection law Egypt operates under is Law No. 151 of 2020, which protects electronically processed personal data of Egyptian residents. You need lawful consent (or another legal basis), a designated Data Protection Officer in some cases, a license from the Personal Data Protection Center (PDPC) for most processing activities, and strict rules for cross-border transfers. Breaches carry fines from EGP 100,000 up to EGP 5 million, plus possible imprisonment for sensitive-data violations. The executive regulations have been in drafting limbo for years, which creates real compliance ambiguity.

Who the law applies to

Law 151/2020 covers any natural or legal person — Egyptian or foreign — that processes the personal data of Egyptians, or data processed inside Egypt. If you're a SaaS company abroad with Egyptian users, you're in scope. If you run an HR system for an Egyptian subsidiary, you're in scope.

The law defines "personal data" broadly: anything that identifies a natural person directly or indirectly. "Sensitive data" gets stricter treatment — health, biometrics, religious belief, political views, criminal records, children's data, and financial data all qualify.^[1]

A few carve-outs exist. Personal/household use, official statistical processing by state bodies, press and media work within legal limits, and data held by the Central Bank or in national security contexts generally sit outside the law's reach.^[2]

Honestly, most businesses assume one of those exemptions covers them. Most are wrong.

Core obligations you can't skip

Lawful basis. Consent is the headline, but it's not the only route. You can also process data to perform a contract, comply with a legal obligation, or pursue a legitimate interest — though the law leans heavily on explicit, documented consent, especially for anything sensitive.

Licensing. This is where Egypt diverges sharply from GDPR. Articles 7–8 require operators to obtain a license or permit from the Personal Data Protection Center before processing, holding, or electronically storing personal data. The PDPC was established under the Ministry of Communications and Information Technology (MCIT) but its licensing portal and fee schedule depend on the executive regulations — which, as of late 2026, remain unissued.^[3]

DPO appointment. Article 8 requires certain entities (public bodies, those processing sensitive data, and those doing large-scale regular monitoring) to appoint a Data Protection Officer. The DPO must register with the PDPC.

Breach notification. You have 72 hours to notify the PDPC of a breach, and must inform affected data subjects within 3 days of the Center's notification. Miss this and penalties stack.

Watch out: The executive regulations to Law 151/2020 were due within 6 months of issuance. We're now past 6 years. Until they publish, the licensing fees, DPO registration process, and cross-border transfer whitelist are all operating on interim guidance from the PDPC — not binding regulation. Document your good-faith compliance efforts.

Cross-border transfers

You cannot transfer personal data outside Egypt without a license from the PDPC and only to countries offering an "adequate level of protection" (Articles 14–17). The law also allows transfers with the explicit consent of the data subject, or where necessary for contract performance, legal claims, or vital interests.^[4]

In practice, if you use AWS, Google Workspace, Microsoft 365, or any non-Egyptian cloud for personal data of Egyptians, you need to document your transfer basis. Standard contractual clauses modeled on EU SCCs are commonly used, but they're not a statutory safe harbor under Egyptian law — they're a defensible position, not a get-out-of-jail card.

Keep a transfer register. When PDPC enforcement scales up, this is the first thing they'll ask for.

Penalties and enforcement

The fines are not small for a market Egypt's size.

• Unlawful processing or disclosure: EGP 100,000 to EGP 1 million (Art. 35)
• Cross-border transfer violations: EGP 500,000 to EGP 5 million (Art. 36)
• Sensitive data violations: EGP 500,000 to EGP 5 million plus 3 months to 3 years imprisonment (Art. 37)
• Failure to notify a breach: EGP 100,000 to EGP 1 million

Fines double on repeat offenses. For legal persons, the responsible manager faces the same penalties if negligence or complicity is proven.^[5]

Enforcement to date has been limited — the PDPC is still staffing up and the regulations gap gives defendants obvious arguments. Don't take comfort from that. The trajectory is clear, and the National Telecom Regulatory Authority (NTRA) has already used adjacent powers against telcos and ISPs on data-handling grounds.

What to do this quarter

Map your data. You cannot comply with the personal data protection law Egypt if you don't know what you hold, where it sits, who you share it with, and why. A one-page processing register beats a 40-page policy nobody reads.

Then: review your consent mechanisms (pre-ticked boxes don't count), draft a breach response playbook with the 72-hour clock baked in, and get a DPO appointed if you're in a mandatory category. If you're a foreign company serving Egyptian users, nominate a local representative — the PDPC will expect one when regulations drop.

For related compliance questions, see our data protection answers hub.

The regulations may still be delayed. The penalties are not.