Data & Privacy - Egypt

Law No. 151 of 2020 is Egypt's first comprehensive personal data protection statute. It was ratified on 13 July 2020 and entered into force on 17 October 2020 (90 days after publication in the Official Gazette), grounded in the privacy protections of Article 57 of the Egyptian Constitution.

After a roughly five-year delay, the Executive Regulations were issued by MCIT Decree No. 816 of 2025 and entered into force in November 2025, bringing the regime fully into operation with detailed rules on consent, licensing, record-keeping, retention, security and breach response.

The Personal Data Protection Center, a public economic authority operating under MCIT supervision, is the regulator responsible for implementing, monitoring and enforcing the law, issuing licences and permits, and investigating violations. Most processing activities require prior PDPC authorization, licensing or permitting.

The PDPL grants individuals rights to be informed, access, rectify, erase, object/withdraw consent, port their data, and not be subject to certain automated decision-making. Denying these rights without lawful justification carries a fine of EGP 100,000 to EGP 1 million.

Controllers and processors must appoint a Data Protection Officer licensed and approved by the PDPC. Personal data breaches must be reported to the PDPC within 72 hours, with notification to affected individuals within three working days; DPO negligence carries fines of EGP 50,000 to EGP 500,000.

Transfers of personal data outside Egypt are generally prohibited unless the destination provides protection equivalent to Egypt's, a PDPC licence is obtained, and data-subject consent is given. Violations can lead to imprisonment of at least three months and/or fines of EGP 500,000 to EGP 5 million.