الصفحة الرئيسية › مكتبة القوانين › Egypt PDPL
EG
Egypt PDPL
Law No. 151 of 2020 on the Protection of Personal Data, with its Executive Regulations (Ministerial Decision No. 816 of 2025)
موثّق المصدر · 12/14 معلومات مؤكَّدة من مصدرين. آخر تحقق 5 نوفمبر 2026
موعد المراجعة الكاملة التالية: . نتابع أخبار الجهات الرقابية شهريًا، وتُسجَّل التغييرات في سجل التغييرات.
الاستشهاد بهذه الصفحة: GlanceDesk Jurisdiction, “Egypt PDPL (Egypt)”, glancedeskjurisdiction.com/laws/eg-pdpl, last verified 5 November 2026.
Egypt الخصوصية
- الحالة
- Issued on 13 July 2020 and published in the Official Gazette No. 28 bis (H) of 15 July 2020; in force three months after the day following publication (issuing law, Art. 7). The Executive Regulations were issued by Decision No. 816 of 2025 of the Minister of Communications and Information Technology, published in Al-Waqa'i Al-Misriya No. 244, Supplement (A), on 1 November 2025, and in force from the next day. Everyone covered had one year from the issue of the Regulations to comply (issuing law, Art. 6).✓
- على من ينطبق
- Personal data of natural persons processed electronically, in whole or in part, by any holder, controller or processor (issuing law, Art. 1). The offences reach Egyptians in or outside Egypt, non-Egyptians living in Egypt, and non-Egyptians abroad where the act is also an offence where it happened and the data belongs to Egyptians or foreign residents of Egypt (issuing law, Art. 2). Excluded (issuing law, Art. 3): data kept by individuals for personal use; official statistics or processing required by law; accurate data processed only for media purposes; court and investigation records; data held by national security bodies; and data held by the Central Bank of Egypt and the entities it supervises, except money transfer and exchange companies.✓
- حدود الحجم
- The law sets no size or turnover threshold: it covers every holder, controller and processor, whether a natural or a legal person (Arts. 1, 4 and 5).
- الجهة الرقابية
- The Personal Data Protection Center (PDPC), an economic public authority reporting to the Minister of Communications and Information Technology (Art. 19).✓
- الإبلاغ عن الخروقات أو الحوادث
- Report a breach to the PDPC through its portal or hotline within 72 hours of becoming aware of it, and at once where national security is involved (law Art. 7; Executive Regulations Art. 5). Tell the affected people within 3 working days of reporting to the PDPC, by the means agreed when their data was collected (Executive Regulations Art. 5).✓
- مهلة الرد على طلبات البيانات الشخصية
- Reply within 6 working days to a request by a data subject to exercise their rights under Article 2, such as access, withdrawing consent, correction, erasure, restriction or objection (Art. 32). Separately, a written request by an authorised party for personal data to be made available is decided within 6 working days, with reasons for any refusal; no answer in time counts as a refusal (Art. 10). Data subjects may be charged for these services, except breach notice, at fees the PDPC sets of no more than EGP 20,000 (Art. 2). The PDPC decides a complaint within 30 working days, and its decision must be carried out within 7 working days (Art. 33).✓
- مسؤول حماية البيانات
- Mandatory: the legal representative of every controller or processor that is a legal person appoints a qualified employee as data protection officer, registers the officer in the PDPC's register and announces it; a controller or processor who is a natural person is personally responsible (Art. 8). The officer must hold relevant qualifications, pass the PDPC's tests and have no conviction for a crime of dishonour (Executive Regulations Art. 7), and the PDPC must be told at least 15 days before the officer's contract ends (Executive Regulations Art. 10). The officer need not be on the staff in every case: a replacement officer may come from the entity's own staff or be contracted (Executive Regulations Art. 10), and a registered officer may act for more than one entity if those entities agree, there is no conflict of interest and the PDPC approves; one officer may be registered for linked entities that exchange data, after notifying the PDPC (Executive Regulations Art. 11).✓
- الممثل المحلي
- Required: a controller or processor outside Egypt appoints a representative in Egypt (law Arts. 4(11) and 5(12)). Without a branch or representative office, it acts through a branch or an office that represents it, approved by the PDPC for the term of the licence or permit; a controller who is a natural person appoints an agent in Egypt (Executive Regulations Art. 3).✓
- نقل البيانات إلى الخارج
- Banned unless the destination gives protection at least equal to Egyptian law and the PDPC grants a licence or permit (Art. 14; Executive Regulations Art. 16, which also requires the data subject's consent). With the data subject's explicit consent, transfers to a country without that level are allowed in listed cases, such as medical care, legal claims, a contract for the data subject, judicial cooperation, public interest, money transfers and treaties Egypt has joined (Art. 15). Making data available to a controller or processor abroad needs a PDPC licence, matching activities, a legitimate interest and equal protection (Art. 16; Executive Regulations Art. 17).✓
- ملفات تعريف الارتباط والموافقة
- Collecting, processing or disclosing personal data needs the data subject's explicit consent or a legal permission (Art. 2); processing is lawful only with consent for a specific purpose, for a contract or a legal claim, to meet a legal obligation or an order of investigators or a court, or for legitimate rights of the controller or another party that do not conflict with the data subject's basic rights (Art. 6). Sensitive data, which covers health, genetic, biometric and financial data, religious beliefs, political opinions, security status and all children's data (Art. 1), needs a PDPC licence and written explicit consent, and a guardian's consent for children (Art. 12). Electronic direct marketing needs consent, the sender's identity and address, a statement that it is marketing and an easy way to refuse, and consent records kept for 3 years from the last message (Arts. 17 and 18).✓
- أقصى عقوبة
- Fines up to EGP 5,000,000, with or instead of at least 3 months' prison, for unlawful processing of sensitive data and unlawful transfers abroad (Arts. 41 and 42); up to EGP 5,000,000 for breaking the licence and permit rules (Art. 45); up to EGP 3,000,000 for a controller or processor that breaks its duties, including breach notice (Art. 38); EGP 100,000 to 1,000,000 for processing or disclosing data without consent or legal permission, rising to EGP 200,000 to 2,000,000 and/or at least 6 months' prison where done for gain or to harm the data subject (Art. 36); EGP 200,000 to 2,000,000 for a legal representative who breaks the data protection officer rules (Art. 39) and for a data protection officer who fails in the officer's duties, or EGP 50,000 to 500,000 where through negligence (Art. 40). Penalties double for a repeat offence (Art. 48), and a manager who knew of an offence and whose failure helped it happen faces the same penalties (Art. 47).✓
المعلومات الموسومة بعبارة «قيد التحقق» لا تزال قيد التأكيد ولا تُقدَّم كإجابات.
ما يجب عليك فعله✓
- Get the PDPC licence or permit for your processing before you process personal data, and keep a record of processing (law Arts. 4(9), 4(10) and 26).
- Get explicit consent, or rely on another lawful basis in Article 6, before you collect or process personal data (Arts. 2 and 6).
- Appoint a qualified data protection officer and register the officer with the PDPC (Art. 8; Executive Regulations Arts. 7 to 9).
- Report a breach to the PDPC within 72 hours and tell affected people within 3 working days after that (Art. 7; Executive Regulations Art. 5).
- Transfer data abroad only with a PDPC licence or permit to a country with equal protection, or under an Article 15 exception (Arts. 14 to 16).
- If you are outside Egypt, appoint a representative in Egypt approved by the PDPC (Art. 4(11); Executive Regulations Art. 3).
- Reply to data subject requests within 6 working days (Art. 32).
التغييرات الأخيرة
The Executive Regulations (Ministerial Decision No. 816 of 2025) were published on 1 November 2025, so the one-year period to comply under Article 6 of the issuing law has ended; Baker McKenzie (7 October 2026) gave its expiry as 31 October 2026. The PDPC has launched its electronic portal for data protection officer registration and licence, permit and accreditation applications; signing in uses Digital Egypt, linked to an Egyptian National ID, so foreign companies file through a local representative.✓
المصادر
- المصدر الأساسي: https://pdpc.gov.eg/guidelines
- المصدر الثاني: https://eg.andersen.com/wp-content/uploads/2026/02/Law-No.-151-of-2020.pdf
- الجهة الرقابية: The Personal Data Protection Center (PDPC), an economic public authority reporting to the Minister of Communications and Information Technology (Art. 19).
المصادر المستخدمة في التحقق المستقل (5)
- https://pdpc.gov.eg/guidelines
- https://eg.andersen.com/wp-content/uploads/2026/02/Law-No.-151-of-2020.pdf
- https://www.tamimi.com/law-update/general/articles/from-policy-to-practice-egypt-issues-executive-regulations-of-the-personal-data-protection-law/
- https://www.bakermckenzie.com/en/insight/publications/2026/10/egypt-personal-data-protection-law-update
- https://pdpc.gov.eg/
= مؤكَّد من مصدرين مستقلين، أحدهما على الأقل رسمي. كيف نتحقق
معلومات فقط، وليست استشارة قانونية. القوانين تتغير؛ تحقّق مع الجهة الرقابية أو محامٍ مؤهل قبل الاعتماد على هذه الصفحة. هل لاحظت خطأ؟ راسلنا على contact@