Egypt

Personal Data Protection Law No. 151 of 2020 (Executive Regulations: Prime Ministerial Decree No. 816 of 1 November 2025) IN FORCE

commenced 2020 (law); Executive Regulations in force 2 November 2025; compliance deadline 1 November 2026 · Official full text ↗

Scope

Electronically processed personal data of identified or directly/indirectly identifiable natural persons (art. 1); children's data is always sensitive; the licensing regime attaches to collecting, storing, transferring or processing electronic personal data, sensitive data, and electronic marketing.

Key obligations

Licence or permit from the Personal Data Protection Center before processing activities: licence fees up to EGP 2,000,000, permits/certifications up to EGP 500,000, 90-day decision window with silence deemed rejection (art. 26); Mandatory registered DPO within every juristic controller/processor (art. 8), responsible for enforcement, complaints, records and breach notification; 72-hour breach notification to the Center (immediate where national security is engaged), with data subjects informed within 3 days of notifying the Center (art. 7); Data subject complaint rights to the Center (art. 33); judicial enforcement through the Economic Courts

DPO required

Yes: every juristic controller/processor must appoint a competent employee as DPO, registered on the Center's DPO register (art. 8).

Registration

Yes: a licensing/permit regime run by the Center, unusually fee-heavy for the continent (fees up to EGP 2,000,000); applications decided within 90 days, silence deemed rejection.

Cross-border transfers

Transfers, storage or sharing abroad require the destination's protection to meet or exceed the Law's AND a licence or permit from the Data Protection Center (art. 14); art. 15 allows sub-threshold transfers only on explicit consent COMBINED with a listed ground (life/medical care, legal claims, contract for the data subject's benefit, judicial cooperation, public interest, money transfers, treaties); controller-to-controller disclosure abroad needs a Center licence (art. 16). The Executive Regulations operationalise the conditions. (Verified against the ACC unofficial English translation - Arabic original prevails - 2026-07-11, S27.)

Breach notification

Notify the Center within 72 hours of any personal-data infringement (immediately for national-security-related breaches); the Center immediately informs the National Security Authorities; data subjects notified within 3 days of the Center notification (art. 7).

Penalties

Imprisonment and/or fines up to EGP 5,000,000 for non-compliance; enforcement sits with the Economic Courts, with Center employees holding judicial control powers; financial and criminal penalties bite after the 1 November 2026 compliance deadline.

Authority

Personal Data Protection Center (PDPC, under MCIT)

Verified 2026-07-10