Egypt PDPL: Law No. 151 of 2020 Compliance Guide

Personal data of natural persons processed electronically, wholly or partly, by controllers or processors, Egyptian entities, and foreign entities processing Egyptians' data where the processing relates to offering goods or services in Egypt. Carve-outs include central bank and banking-sector data (governed by banking law), national security bodies, and purely personal use. Sensitive data (health, biometrics, genetics, religion, financial data of children, and more) requires the Center's license and explicit consent. The electronic-processing framing means purely paper records sit outside, a narrower net than the GDPR's.

The law conditions defined activities on authorization from the Personal Data Protection Center: licenses for sensitive-data processing, permits for cross-border transfers, and authorizations for direct electronic marketing, with fees and procedures left to the executive regulations. This regulator-gated design resembles Bahrain's more than the GDPR's accountability model: certain processing is unlawful without a document from the Center, not merely unlawful if done badly. Until the executive regulations fully operationalize the machinery, companies document readiness (application-grade descriptions of processing, security, and transfer flows) so filings can move when procedures crystallize.

The law requires controllers and processors to appoint a data protection officer responsible for compliance, a registry of processing, breach notification, and serving as the Center's contact, and the DPO must be registered. Unlike the GDPR's conditional triggers, Egypt's duty reads as general for entities within scope, making it one of the region's broadest DPO mandates. Multinationals typically designate a local officer paired with regional privacy counsel. Breach notification runs through the DPO to the Center within 72 hours of awareness, with data subject notice within three days where required.

Restrictively, on the statute's face: transferring personal data outside Egypt requires a level of protection not lower than Egypt's and the Center's license or permit; unlicensed transfers are criminal offenses carrying both fines and potential imprisonment. Exceptions exist with the data subject's consent for defined purposes (international judicial cooperation, contract performance involving the data subject, and similar). Because the executive regulations and the Center's permit practice remain immature, companies run transfers on documented consent plus readiness files, and structure Egyptian operations to minimize unnecessary exports. This is the highest-risk compliance area in the law, treat it accordingly.

The law is in force and its criminal provisions are prosecutable, but the regulator's administrative machinery (licenses, fees, inspection practice) has been slowed by the wait for executive regulations, drafts have circulated for years without final issuance as of early 2026. Practically: exposure today concentrates in the criminal provisions (sensitive data, transfers, marketing without consent) which prosecutors can pursue independent of the regulations, and in commercial pressure, regional counterparties increasingly require Egypt-aware contract terms. The prudent posture is statute-level compliance now (consent, DPO, security, breach readiness, transfer discipline) with a tracking file on the regulations so licensing obligations can be met promptly when activated.