PDPL Egypt: Personal Data Protection Law Compliance
Egypt’s Personal Data Protection Law (PDPL), Law No. 151 of 2020, is now fully enforceable. Its Executive Regulations were issued on 1 November 2025 and the one-year grace period ends around 1 November 2026. Alphavito helps Egyptian companies get licensed by the Personal Data Protection Center (PDPC), appoint a Data Protection Officer, and put the technical controls in place.
What is the Egyptian Personal Data Protection Law?
The Egyptian Personal Data Protection Law (Law No. 151 of 2020, often called the PDPL or Egypt data protection law) regulates how organisations collect, store, process and transfer the personal data of individuals in Egypt. It applies to data processed fully or partly by electronic means, whether by companies based in Egypt or by foreign companies that target people in Egypt.
The law was passed in 2020 but could not be enforced until its Executive Regulations were issued. Ministerial Decree No. 816 of 2025 issued those regulations on 1 November 2025 and started a one-year transition period. The regulator is the Personal Data Protection Center (PDPC), which issues licences, registers DPOs, publishes guidelines and investigates complaints.
Limited exclusions apply, for example data kept for purely personal use, official statistics, judicial proceedings, national security, and data held by the Central Bank of Egypt and the banks it supervises. For almost every other private company, hospital, school, e-commerce site and service provider, the PDPL applies.
Who must comply with Egypt’s PDPL?
Data controllers
Any organisation that decides why and how personal data is processed: employers, retailers, clinics, schools, telecoms, real estate and more.
Data processors
IT, cloud, payroll, call-centre and marketing providers that process personal data on behalf of a controller.
Companies outside Egypt
Foreign controllers and processors that handle data of people in Egypt must appoint a local representative.
Key PDPL obligations under the Executive Regulations
| Requirement | What it means for your organisation |
|---|---|
| PDPC licence | Controllers and processors need a licence from the PDPC, usually valid for three years. Fees depend on activity type and data volume. The PDPC review can take up to 90 working days after a complete application. |
| Supplementary permits | Separate permits are required for cross-border data transfers, electronic direct marketing and CCTV/visual surveillance. |
| Data Protection Officer (DPO) | Every legal entity must appoint a qualified DPO who is registered with the PDPC and submits annual reports. |
| Records of processing (ROPA) | Keep an electronic register of processing activities, consents, data categories, retention periods, recipients, hosting locations and security measures. The PDPC publishes templates for controllers and processors. |
| Lawful basis & consent | Collect data for specific, legitimate purposes with valid consent or another legal basis, and keep proof of consent. |
| Data subject rights | Let individuals know, access, correct, delete, restrict and object to processing of their data, and withdraw consent. |
| Breach notification | Notify the PDPC within 72 hours of becoming aware of a breach, and affected individuals within three working days of that notification. |
| Cross-border transfers | Transfers outside Egypt, including to overseas cloud services, need PDPC authorisation and an equivalent level of protection. |
| Security controls | Apply technical and organisational measures (access control, encryption, logging, backup, DLP) proportionate to the risk. |
PDPL penalties in Egypt
The law sets criminal and financial penalties. The most serious violations, such as unlawful processing of sensitive data (health, biometric, genetic, financial or children’s data) or unlawful cross-border transfer, can lead to imprisonment of at least three months and/or a fine of EGP 500,000 to EGP 5,000,000. Processing without the required PDPC licence or permit carries the same EGP 500,000 to 5,000,000 fine. Other breaches carry fines between EGP 100,000 and EGP 3,000,000, for example EGP 300,000 to 3,000,000 for failing controller or processor duties such as security and breach notification, and EGP 200,000 to 2,000,000 for failing to appoint a DPO. Managers who knew of a violation can be held personally liable. The PDPC can also suspend or revoke licences.
How Alphavito delivers PDPL compliance
Alphavito is a Cairo-based IT and cybersecurity provider. We combine the legal-process work with the security technology the law expects, so you deal with one partner instead of three.
PDPL gap assessment
A data privacy audit of your systems, processes and contracts against Law 151/2020 and Decree 816/2025, with a prioritised roadmap.
PDPC licensing support
We prepare and submit your licence and permit applications on the PDPC portal and handle follow-up with the Center.
DPO support
Training and day-to-day support for your appointed Data Protection Officer, or an external DPO where PDPC rules allow it.
Data discovery & registers
We find where personal data lives and build your ROPA, consent register and retention schedule.
Policies, consent & rights
Privacy notices, consent and cookie management, and a workflow for data subject requests.
Security controls & breach response
Fortinet, Sophos and Veeam based controls (firewalls, DLP, encryption, backup) plus a 72-hour breach response plan.
PDPL Egypt: frequently asked questions
What is PDPL in Egypt?
PDPL is Egypt’s Personal Data Protection Law, Law No. 151 of 2020. It sets the rules for collecting, processing, storing and transferring personal data of individuals in Egypt, and created the Personal Data Protection Center (PDPC) as the regulator.
When did the Egypt PDPL executive regulations come into force?
The Executive Regulations were issued by Ministerial Decree No. 816 of 2025 on 1 November 2025. Organisations were given a one-year grace period, so full compliance is expected from about 1 November 2026.
Does my company need a PDPC licence?
Most organisations that control or process personal data in Egypt need a licence from the Personal Data Protection Center. Extra permits are needed for cross-border transfers, electronic direct marketing and CCTV surveillance.
Is a Data Protection Officer mandatory under the PDPL?
Yes. Legal entities must appoint a Data Protection Officer who is registered with the PDPC. The law expects a qualified employee; the Executive Regulations also set rules for external and shared DPOs, so check the latest PDPC guidance.
What are the penalties for breaking Egypt’s data protection law?
Fines range from tens of thousands up to EGP 5 million, and serious violations such as unlawful processing of sensitive data can also lead to imprisonment of at least three months.
How fast must a data breach be reported in Egypt?
The PDPC must be notified within 72 hours of becoming aware of a personal data breach, and affected individuals within three working days after that.
Can I store personal data on a cloud outside Egypt?
Only with PDPC authorisation for the cross-border transfer and when the destination offers protection at least equal to Egyptian law.
Where can I find the Egypt PDPL in English or as a PDF?
The official Arabic text is published in the Official Gazette, and the PDPC publishes the law and its guidelines on its website. Contact us for a plain-English summary and a compliance checklist.
Is your organisation ready for the PDPL?
Take our online PDPL readiness check, or book a call with our compliance team in Nasr City, Cairo.
Last updated: 30 October 2026. This page is general information, not legal advice. Always check the latest PDPC guidance.