ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXPersonal Data Protection Law No. 151 of 2020
Egypt
In force since 2020
Personal Data Protection Law No. 151 of 2020, operationalized by Executive Regulations issued under Ministerial Decree No. 816 of 2025, with a compliance deadline in November 2026.
Asia & Africa
Egypt
Personal Data Protection Law No. 151 of 2020
Egypt PDPL
Ministerial Decree No. 816 of 2025
Personal Data Protection Center (PDPC)
In force
One year from the entry into force of the Executive Regulations
November 2026
Controllers, processors, data holders, and other entities within the law's scope
A central requirement, subject to statutory exceptions
Subject to enhanced safeguards and explicit written consent in applicable cases
Special requirements apply, including guardian consent for children under 15
Controllers and processors are subject to DPO appointment and registration requirements under the new regulatory framework
PDPC licenses and permits apply to controllers, processors, cross-border transfers, electronic marketing, and certain other activities
Generally require a prior PDPC license or permit unless a statutory exception applies
Requires specific consent and regulatory authorization requirements
PDPC notification within 72 hours in applicable cases
Generally within 3 working days after notification to the PDPC where required
Certain violations can attract fines reaching EGP 5 million, with imprisonment also possible for specified offences
The Egyptian framework applies to several categories of organizations and individuals involved in personal-data processing. A controller is responsible for determining the purposes and means of processing personal data; examples include e-commerce companies, banks, insurance companies, hospitals, universities, employers, technology companies, SaaS providers, marketing companies, government organizations and online platforms. A processor processes personal data on behalf of a controller or according to the controller's instructions; examples include cloud providers, hosting providers, payroll platforms, CRM providers, analytics providers, marketing platforms and customer-support providers. The Egyptian law also recognizes the concept of a data holder, meaning a person or entity that lawfully or factually possesses and retains personal data in any form or storage medium.
Egypt's PDPL contains criminal penalties for various privacy violations. For example, unlawful collection, processing, disclosure, or transfer of personal data without legal authorization or the data subject's consent can result in fines ranging from EGP 100,000 to EGP 1 million. Where the conduct is undertaken for material or moral gain or with intent to expose the data subject to risk or harm, the penalties can increase to imprisonment of at least six months and fines between EGP 200,000 and EGP 2 million, or one of those penalties. Other provisions establish additional penalties for violations such as unlawfully preventing data-subject rights, and the maximum penalty can reach EGP 5 million for specified offences where the applicable provision provides for that level of fine.
The Executive Regulations further operationalize requirements relating to purpose specification, consent, retention, records, security, and organizational controls.
The Personal Data Protection Law No. 151 of 2020 establishes rules for protecting personal data processed electronically, whether processing occurs wholly or partially through electronic means.
The framework regulates organizations that collect, control, process, retain, disclose, or transfer personal data and establishes rights for data subjects.
The law also establishes the Personal Data Protection Center (PDPC) as the competent authority for regulating and enforcing the framework.
The current Egyptian privacy framework therefore consists primarily of:
The law covers electronically processed personal data relating to:
The PDPC's current explanation of the framework expressly identifies both Egyptian citizens and non-Egyptian residents as data subjects protected by the PDPL and Executive Regulations.
Organizations outside Egypt that collect or process personal data falling within the law's scope should therefore assess whether they have Egyptian PDPL obligations.
Personal data generally refers to information that identifies or can identify a natural person, directly or indirectly.
Examples include:
The PDPC specifically identifies names, voice recordings, photographs, national ID numbers, and online identifiers as examples of personal data.
Organizations should build their processing activities around core privacy principles, including:
Lawfulness. Personal data should be collected and processed in accordance with the law.
Purpose limitation. Data should be collected for defined and legitimate purposes.
Data minimization. Organizations should limit collection to information necessary for the intended purpose.
Transparency. Individuals should be appropriately informed about how their data is collected and used.
Accuracy. Organizations should maintain accurate personal information and address inaccurate data appropriately.
Storage limitation. Personal data should not be retained indefinitely without a legitimate purpose.
Security. Controllers and processors should implement appropriate technical and organizational safeguards.
Accountability. Organizations should maintain records and procedures demonstrating compliance.
The Executive Regulations further operationalize requirements relating to purpose specification, consent, retention, records, security, and organizational controls.
Consent is a central element of Egypt's data protection framework.
Article 2 of the PDPL provides that personal data may not generally be collected, processed, disclosed, or revealed except with the explicit consent of the data subject or in circumstances permitted by law.
The law therefore combines an explicit-consent model with statutory exceptions.
Organizations should not assume that consent is required for every processing operation, but where consent is the applicable basis, the organization should be able to demonstrate that valid consent was obtained.
A compliant consent mechanism should provide individuals with sufficient information to understand what they are agreeing to.
Organizations should consider:
The Executive Regulations require approval of mechanisms used for collecting personal data and obtaining consent in specified circumstances.
Organizations should maintain electronic records demonstrating:
This is particularly important because the Egyptian licensing framework requires organizations to demonstrate their mechanisms for obtaining consent and maintaining relevant electronic records.
Where processing is based on consent, individuals should have a practical mechanism to withdraw or amend their consent.
Consent withdrawal workflows should:
ConsentX can provide the technical layer for recording and managing these consent changes.
Egypt's framework provides enhanced protection for sensitive personal data.
The PDPC identifies sensitive categories including:
The Executive Regulations require controllers and processors handling sensitive personal data to comply with additional safeguards. These include:
Egypt's Executive Regulations introduce specific requirements for children's data.
For children under 15 years of age, organizations must obtain explicit written consent from the child's legal guardian before collecting and processing the child's personal data, subject to legally permitted exceptions. The consent should specify the period for which the data will be collected and processed and should allow withdrawal or amendment.
The Executive Regulations establish separate consent requirements for individuals between 15 and 18 years old, with mechanisms determined in accordance with the applicable regulatory requirements.
Where children participate in games, competitions, or similar activities, organizations must not collect more data than necessary for participation and must not use such data for prohibited classification, tracking, or behavioral monitoring activities.
Organizations should provide appropriate information to individuals when collecting their personal data.
A privacy notice should explain relevant matters such as:
Transparency should be integrated into the collection process rather than treated solely as a website-policy requirement.
Egypt's PDPL provides individuals with several rights regarding their personal data.
Know and access personal data. Individuals have the right to know about and access personal data held about them, subject to applicable conditions.
Obtain information. Data subjects can obtain relevant information concerning how their data is processed.
Correct or update data. Individuals can request correction or updating of inaccurate personal information.
Delete or erase data. Individuals have rights concerning deletion or erasure where the statutory requirements are met.
Restrict or stop processing. Individuals can exercise rights to object to or stop certain processing activities under the applicable provisions.
Withdraw consent. Where consent is the basis for processing, individuals can withdraw their consent.
The PDPC identifies exercising data-subject rights as a core component of its regulatory framework.
Organizations should maintain a structured workflow for privacy requests.
A practical DSAR process should include:
ConsentX can help centralize request intake, tracking, status management, and audit evidence.
The Executive Regulations establish a formal Data Protection Officer (DPO) framework.
The PDPC describes the DPO as a person appointed by the legal representative of a legal entity acting as a data user, operating independently and registered in the PDPC's DPO registry.
The DPO's responsibilities include:
The Executive Regulations also establish procedures for registering DPOs and replacing them.
Organizations should therefore review their DPO appointment and registration obligations as part of their 2026 compliance program.
One of the most significant features of the new Egyptian framework is its licensing and permit regime.
The PDPC states that data users are required to obtain applicable licenses or permits.
The framework includes licensing or permit categories for:
Licenses generally have a three-year renewable term, while permits generally have a one-year renewable term, according to the PDPC's current FAQ.
Organizations should determine which licenses or permits apply to their activities rather than assuming that a general privacy policy is sufficient for compliance.
Controllers and processors must implement appropriate technical and organizational safeguards.
Security controls should address risks such as:
Practical measures may include:
The Executive Regulations require license applicants to provide information about the mechanisms used to secure and protect personal data.
Egypt's current framework establishes specific breach-notification timelines.
According to the PDPC, data users must notify the Center within 72 hours of becoming aware of a breach, including the information and procedures required by the law, regulations, and applicable PDPC directions.
Where a breach involves national-security matters, notification must be made immediately.
Affected data subjects must be notified within three working days from the date of notification to the PDPC, where the applicable requirements trigger such notification.
Organizations should maintain a documented incident-response process covering:
Cross-border transfers are a particularly important part of Egypt's PDPL.
The PDPC states that personal data generally may not be transferred outside Egypt unless the organization obtains a prior cross-border data-transfer license or permit from the PDPC or the transfer falls within a statutory exception.
The Executive Regulations establish requirements concerning:
The regulatory framework is therefore more restrictive than a simple contractual transfer mechanism.
Organizations using overseas cloud, analytics, CRM, advertising, or hosting providers should map their international data flows and determine whether a PDPC authorization is required.
The Executive Regulations establish a specific license or permit for transferring personal data from Egypt to another country.
The authorization allows transfers subject to the approved controls and restrictions.
Adding new destination countries may require updating the authorization.
Organizations should maintain a current inventory of:
Egypt's framework contains specific rules for direct electronic marketing.
Organizations engaging in electronic direct marketing must address:
The PDPC states that marketing communications must provide a clear and accessible mechanism for withdrawing consent or objecting to further communication.
The Executive Regulations also require electronic records showing how and when marketing consent was obtained and how deletion or amendment requests were handled.
The PDPL regulates personal-data processing rather than creating a standalone universal cookie rule.
However, cookies, pixels, SDKs, advertising identifiers, analytics tools, and other online technologies may process personal data.
Organizations should therefore assess:
For websites relying on consent, a compliant technical implementation should ensure that relevant non-essential trackers do not activate before the required consent signal.
A ConsentX implementation can support:
This helps align the technical behavior of a website with its stated privacy choices.
Organizations using profiling or automated processing should assess the privacy implications of those activities.
Relevant considerations include:
Organizations should also determine whether the processing triggers additional regulatory requirements or PDPC scrutiny.
Organizations should establish retention periods based on:
A retention program should include:
Personal data should not be retained indefinitely simply because it may be useful in the future.
Organizations should maintain appropriate contractual and operational controls over processors.
Vendor agreements should address:
Organizations should maintain a current inventory of vendors that access Egyptian personal data.
Privacy should be incorporated into websites, applications, databases, and business processes from the beginning.
Organizations should consider:
This is particularly important under Egypt's new licensing and compliance framework because organizations may need to demonstrate how their technical and organizational measures protect personal data.
Organizations should maintain evidence demonstrating compliance.
Important records can include:
ConsentX can help organizations maintain the consent and preference evidence layer for website and digital processing.
The Personal Data Protection Center (PDPC) is Egypt's national authority responsible for implementing and enforcing the PDPL and its Executive Regulations.
Its responsibilities include:
The PDPC identifies the Personal Data Protection Law No. 151 of 2020 and Executive Regulations No. 816 of 2025 as the legal framework under which it operates.
Egypt's PDPL contains criminal penalties for various privacy violations.
For example, unlawful collection, processing, disclosure, or transfer of personal data without legal authorization or the data subject's consent can result in fines ranging from EGP 100,000 to EGP 1 million.
Where the conduct is undertaken for material or moral gain or with intent to expose the data subject to risk or harm, the penalties can increase to imprisonment of at least six months and fines between EGP 200,000 and EGP 2 million, or one of those penalties.
Other provisions establish additional penalties for violations such as unlawfully preventing data-subject rights.
The maximum penalty can reach EGP 5 million for specified offences where the applicable provision provides for that level of fine.
Organizations should therefore assess the specific offence and applicable statutory penalty rather than relying on a single headline fine.
The Executive Regulations were issued under Ministerial Decree No. 816 of 2025 and became effective following publication in November 2025.
The PDPC states that a one-year compliance period begins from the entry into force of the Executive Regulations.
For organizations planning their compliance roadmap, November 2026 is therefore a critical implementation milestone.
Organizations operating in Egypt should prioritize the following.
Organizations preparing for the Egyptian framework should consider the following checklist.
Consent management is particularly important under Egypt's PDPL because explicit consent is a central requirement for personal-data collection and processing where no statutory exception applies.
Organizations should be able to demonstrate:
A consent management platform can provide the technical infrastructure needed to capture and preserve this evidence.
Help centralize and track supported privacy requests.
Give users a mechanism to update or withdraw applicable consent choices.
Prevent configured non-essential trackers from executing before the required consent signal.
Configure Egypt-specific consent experiences alongside requirements from other jurisdictions.
Identify cookies, scripts, pixels, SDKs, and other third-party technologies operating on your website.
Maintain structured consent receipts and preference histories that can support internal compliance reviews and audits.
Capture and document consent where consent is the applicable legal basis. Consent records can include the timestamp, purpose, user choice, consent version, privacy notice version, consent status, and withdrawal history.
Prepare your website and digital experiences for Egypt's updated personal-data protection framework. With ConsentX, organizations can manage cookie consent, tracking technologies, prior-script blocking, consent preferences, consent receipts, marketing preferences, privacy requests, regional privacy configurations, and audit-ready consent evidence. Scan your website, configure your Egypt privacy experience, enforce user choices, and maintain evidence of consent with ConsentX.
This page provides general information about Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations issued under Ministerial Decree No. 816 of 2025 and is not legal advice. Egyptian privacy requirements can depend on the nature of the organization, its role as controller, processor or data holder, the processing activity, the categories of personal data involved, licensing and permit obligations, international transfers and applicable PDPC decisions and guidance. Organizations should review the current legislation and PDPC guidance and obtain qualified Egyptian legal advice where appropriate.
Identify cookies, trackers, pixels, scripts, and third-party technologies.
Classify technologies according to their purpose and data-processing behavior.
Determine whether each processing activity requires consent or is otherwise permitted by law.
Create a consent interface that clearly explains the relevant purposes and choices.
Use prior-script blocking to prevent configured non-essential trackers from executing before the required consent signal.
Maintain evidence showing the user's choice, timestamp, purpose, and applicable policy version.
Allow users to modify or withdraw consent where applicable.
Record changes to consent and marketing preferences.
Centralize privacy requests and maintain records of their status.
Keep consent receipts, configurations, preference histories, and related compliance evidence available for review.
The applicable framework depends on the organization's location, users, processing activities, data categories, and international operations.
Egypt
مصر
GDPR
UK GDPR
CCPA / CPRA
VCDPA
Colorado CPA
CTDPA
UCPA
TDPSA
Oregon OCPA
Montana MCDPA
Florida FDBR
LGPD
PIPEDA
DPDPA
PDPA
POPIA
FADP
Law 25
LFPDPPP
PDPL
Law 21.719
Law 1581
Law 29733
Law 18.331