Egypt. Comprehensive data protection. Law
Egypt PDPLLaw No. 151 of 2020 on the Protection of Personal Data
In force
§1Summary
- Synopsis
Egypt's comprehensive data protection law built around a licensing model: controllers and processors need PDPC licences, appoint DPOs, and obtain permits for cross-border transfers and electronic marketing.
- Key themes
- Unique features
Licence/permit regime (3-year general licences; separate permits for transfers, direct marketing and CCTV); mandatory DPO registered with the PDPC; foreign targeting entities must appoint a local representative.
- SaaS relevance
Foreign SaaS targeting Egyptian users needs a local representative and transfer permits; enforcement starts late 2026.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- PDPC within 72h; individuals within 3 days of PDPC notice
- DPO
- Yes
- Cross-border transfers
- PDPC licence/permit + adequacy (no lower protection) + consent
- Maximum penalty
- EGP 5m and/or imprisonment
§3Dates
- Key dates
- Adopted
- In force
- Executive Regulations (Ministerial Decree 816/2025) issued 1 Nov 2025, published Dec 2025; enforcement expected from ~1 Nov 2026
§4Text and authority
- Text
- Authoritative text eg.andersen.com
- Authority
- Personal Data Protection Centre (PDPC)
§5Where it applies
- Domestic law of
- Egypt
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Exact adoption/in-force dates from prior knowledge. Excludes CBE-regulated entities (prior knowledge).