Five years after Egypt’s Personal Data Protection Law (Law No. 151 of 2020) was first published, it finally has teeth. The Executive Regulations took effect on 2 November 2025, starting a one-year grace period — which means every company in scope has until 1 November 2026 to be compliant. That’s less than a month away.
Unlike data protection laws you may already be familiar with, Egypt’s regime doesn’t just ask companies to adopt good privacy practices. It requires many of them to apply for an actual license or permit before they’re legally allowed to keep processing personal data at all.
Who Needs to Comply Under Egypt’s PDPL
The law applies broadly, and the scope catches more companies than most expect:
- Any entity with a presence in Egypt that processes personal data, regardless of sector
- Foreign companies processing the personal data of individuals located in Egypt, even without a local office
- Both data controllers (who decide why and how data is processed) and data processors (who process it on a controller’s behalf)
A handful of narrow exemptions exist — for example, certain data held by the Central Bank of Egypt and entities under its supervision — but for the large majority of businesses operating in or selling into Egypt, the law applies in full.
Egypt’s Data Protection Compliance Checklist
1. Licensing and Registration with the PDPC
This is the feature that sets Egypt’s regime apart: certain processing activities — acting as a controller or processor, processing sensitive personal data, or transferring data outside Egypt — require a license or permit from the Personal Data Protection Center (PDPC), the regulator established under the law. License fees can run up to EGP 2,000,000, with permits and certifications up to EGP 500,000. The PDPC has 90 days to decide on an application — and silence is treated as rejection, not approval, so applications need to go in with real lead time before the deadline.
2. Appointing a Registered Data Protection Officer
Controllers and processors must appoint a Data Protection Officer, and the DPO must be registered with and approved by the PDPC — the Center can also suspend a registered DPO and require a replacement. DPOs are required to file an annual privacy protection report, and a special report within 15 days of taking up the role.
3. Breach Notification Procedures
If a personal data breach occurs, the PDPC must be notified within 72 hours — or immediately where national security is implicated. Affected individuals must then be informed within three working days of that notification, through whatever communication channel was agreed when their consent was originally collected.
4. Cross-Border Data Transfer Approvals
Personal data cannot be transferred, stored, or processed outside Egypt without a license or permit from the PDPC, an assessment of the destination country’s data protection standards, and the data subject’s explicit consent. For any business running cloud infrastructure, outsourced processing, or group-wide data systems outside Egypt, this is often the most disruptive requirement to plan around.
5. Lawful Basis and Consent
Processing must rest on one of six lawful bases set out under the law: consent, performance of a contract, a legal obligation, legitimate interest, the establishment or defense of a legal claim, or execution of a court order. For most commercial processing, this means revisiting consent language, privacy notices, and onboarding flows to confirm they hold up under the new standard.
What Happens If You Miss the Deadline
The penalties are not symbolic. Non-compliance can expose controllers and processors to imprisonment and/or fines of up to EGP 5,000,000, enforced through Egypt’s Economic Courts, where PDPC staff hold judicial control powers to investigate violations. During the grace period, the PDPC has largely focused on guidance and platform rollout rather than enforcement — but that posture is expected to shift the moment the 1 November 2026 deadline passes.
What to Do Before November 1
For most companies, the practical starting point is a gap assessment: map what personal data you hold, where it’s processed and stored, whether any of it crosses Egypt’s borders, and which of your current activities require a PDPC license rather than just internal policy updates. From there, the licensing and DPO registration steps are the ones with the longest lead time — and, given the PDPC’s 90-day review window, the ones least forgiving of a late start.
If your business processes personal data in or relating to Egypt — whether you’re a multinational with a Cairo office or a foreign company serving Egyptian customers remotely — this deadline applies to you, not just to local tech companies. Our team at Al Majidi Law Firm regularly advises technology companies operating in Egypt and businesses across sectors on regulatory compliance matters, and can help you assess where your organization stands against the PDPC’s requirements before the deadline passes. Get in touch to start your compliance review.
This article is for general informational purposes and does not constitute legal advice. For guidance tailored to your organization’s data processing activities, please contact Al Majidi Law Firm directly. Further detail is available from the Personal Data Protection Center.