Egypt Personal Data Protection Law Compliance with ConsentX

What is Egypt's Personal Data Protection Law?

The Personal Data Protection Law No. 151 of 2020 establishes rules for protecting personal data processed electronically, whether processing occurs wholly or partially through electronic means.

The framework regulates organizations that collect, control, process, retain, disclose, or transfer personal data and establishes rights for data subjects.

The law also establishes the Personal Data Protection Center (PDPC) as the competent authority for regulating and enforcing the framework.

The current Egyptian privacy framework therefore consists primarily of:

• Personal Data Protection Law No. 151 of 2020
• Executive Regulations No. 816 of 2025
• PDPC decisions, standards, procedures, and guidance

Territorial scope of Egypt's PDPL

The law covers electronically processed personal data relating to:

• Egyptian citizens, including those residing outside Egypt
• Non-Egyptian individuals residing in Egypt

The PDPC's current explanation of the framework expressly identifies both Egyptian citizens and non-Egyptian residents as data subjects protected by the PDPL and Executive Regulations.

Organizations outside Egypt that collect or process personal data falling within the law's scope should therefore assess whether they have Egyptian PDPL obligations.

What is personal data under Egypt's PDPL?

Personal data generally refers to information that identifies or can identify a natural person, directly or indirectly.

Examples include:

• Name
• National identification number
• Photograph
• Voice
• Email address
• Telephone number
• Online identifier
• Location information
• Financial information
• Health information
• Biometric information
• Employment information

The PDPC specifically identifies names, voice recordings, photographs, national ID numbers, and online identifiers as examples of personal data.

Key principles under Egypt's PDPL

Organizations should build their processing activities around core privacy principles, including:

Lawfulness. Personal data should be collected and processed in accordance with the law.

Purpose limitation. Data should be collected for defined and legitimate purposes.

Data minimization. Organizations should limit collection to information necessary for the intended purpose.

Transparency. Individuals should be appropriately informed about how their data is collected and used.

Accuracy. Organizations should maintain accurate personal information and address inaccurate data appropriately.

Storage limitation. Personal data should not be retained indefinitely without a legitimate purpose.

Security. Controllers and processors should implement appropriate technical and organizational safeguards.

Accountability. Organizations should maintain records and procedures demonstrating compliance.

The Executive Regulations further operationalize requirements relating to purpose specification, consent, retention, records, security, and organizational controls.

Consent under Egypt's PDPL

Consent is a central element of Egypt's data protection framework.

Article 2 of the PDPL provides that personal data may not generally be collected, processed, disclosed, or revealed except with the explicit consent of the data subject or in circumstances permitted by law.

The law therefore combines an explicit-consent model with statutory exceptions.

Organizations should not assume that consent is required for every processing operation, but where consent is the applicable basis, the organization should be able to demonstrate that valid consent was obtained.

What makes consent valid in Egypt?

A compliant consent mechanism should provide individuals with sufficient information to understand what they are agreeing to.

Organizations should consider:

• Identity of the organization
• Purpose of processing
• Categories of data collected
• Intended use
• Relevant recipients
• Retention period or criteria
• International transfers
• Marketing purposes
• Rights of the data subject
• Withdrawal mechanisms

The Executive Regulations require approval of mechanisms used for collecting personal data and obtaining consent in specified circumstances.

Organizations should maintain electronic records demonstrating:

• Who gave consent
• When consent was given
• What purpose was disclosed
• What data was covered
• Which consent mechanism was used
• Whether consent was withdrawn or amended

This is particularly important because the Egyptian licensing framework requires organizations to demonstrate their mechanisms for obtaining consent and maintaining relevant electronic records.

Withdrawal of consent

Where processing is based on consent, individuals should have a practical mechanism to withdraw or amend their consent.

Consent withdrawal workflows should:

• Be accessible
• Clearly explain the effect of withdrawal
• Record the request
• Update the individual's preference
• Stop applicable processing
• Propagate the change to relevant systems where appropriate

ConsentX can provide the technical layer for recording and managing these consent changes.

Sensitive personal data under Egypt's PDPL

Egypt's framework provides enhanced protection for sensitive personal data.

The PDPC identifies sensitive categories including:

• Health data
• Psychological or mental health information
• Genetic information
• Biometric information
• Financial information
• Religious beliefs
• Political opinions
• Security-related information
• Children's data

The Executive Regulations require controllers and processors handling sensitive personal data to comply with additional safeguards. These include:

• Obtaining a relevant PDPC license or permit
• Obtaining explicit written consent in applicable cases
• Ensuring the data is necessary for the intended purpose
• Avoiding harm to the data subject
• Applying required security standards
• Maintaining electronic records
• Recording consent and relevant requests

Children's personal data

Egypt's Executive Regulations introduce specific requirements for children's data.

For children under 15 years of age, organizations must obtain explicit written consent from the child's legal guardian before collecting and processing the child's personal data, subject to legally permitted exceptions. The consent should specify the period for which the data will be collected and processed and should allow withdrawal or amendment.

The Executive Regulations establish separate consent requirements for individuals between 15 and 18 years old, with mechanisms determined in accordance with the applicable regulatory requirements.

Where children participate in games, competitions, or similar activities, organizations must not collect more data than necessary for participation and must not use such data for prohibited classification, tracking, or behavioral monitoring activities.

Privacy notices and transparency

Organizations should provide appropriate information to individuals when collecting their personal data.

A privacy notice should explain relevant matters such as:

• Identity of the controller
• Contact details
• Purpose of collection
• Categories of personal data
• How data will be processed
• Relevant recipients
• Retention
• Data-subject rights
• Consent and withdrawal mechanisms
• International transfers
• Marketing activities
• Relevant automated processing

Transparency should be integrated into the collection process rather than treated solely as a website-policy requirement.

Data subject rights under Egypt's PDPL

Egypt's PDPL provides individuals with several rights regarding their personal data.

Know and access personal data. Individuals have the right to know about and access personal data held about them, subject to applicable conditions.

Obtain information. Data subjects can obtain relevant information concerning how their data is processed.

Correct or update data. Individuals can request correction or updating of inaccurate personal information.

Delete or erase data. Individuals have rights concerning deletion or erasure where the statutory requirements are met.

Restrict or stop processing. Individuals can exercise rights to object to or stop certain processing activities under the applicable provisions.

Withdraw consent. Where consent is the basis for processing, individuals can withdraw their consent.

The PDPC identifies exercising data-subject rights as a core component of its regulatory framework.

Data Subject Access Requests in Egypt

Organizations should maintain a structured workflow for privacy requests.

A practical DSAR process should include:

• Request intake
• Identity verification
• Request classification
• Data discovery
• Review of applicable legal conditions
• Response preparation
• Secure delivery
• Request logging
• Completion evidence

ConsentX can help centralize request intake, tracking, status management, and audit evidence.

Data Protection Officer in Egypt

The Executive Regulations establish a formal Data Protection Officer (DPO) framework.

The PDPC describes the DPO as a person appointed by the legal representative of a legal entity acting as a data user, operating independently and registered in the PDPC's DPO registry.

The DPO's responsibilities include:

• Monitoring privacy compliance
• Monitoring internal data-protection procedures
• Supporting implementation of security policies
• Receiving data-subject requests
• Maintaining communication with the PDPC
• Reporting on the organization's privacy posture

The Executive Regulations also establish procedures for registering DPOs and replacing them.

Organizations should therefore review their DPO appointment and registration obligations as part of their 2026 compliance program.

Licensing and permits under Egypt's PDPL

One of the most significant features of the new Egyptian framework is its licensing and permit regime.

The PDPC states that data users are required to obtain applicable licenses or permits.

The framework includes licensing or permit categories for:

• Controller-processor activities
• Controllers
• Processors
• Electronic marketing
• Cross-border data transfers
• Visual surveillance tools

Licenses generally have a three-year renewable term, while permits generally have a one-year renewable term, according to the PDPC's current FAQ.

Organizations should determine which licenses or permits apply to their activities rather than assuming that a general privacy policy is sufficient for compliance.

Data security under Egypt's PDPL

Controllers and processors must implement appropriate technical and organizational safeguards.

Security controls should address risks such as:

• Unauthorized access
• Unauthorized disclosure
• Loss
• Destruction
• Alteration
• Unlawful processing
• Data leakage

Practical measures may include:

• Encryption
• Access controls
• Authentication
• Multi-factor authentication
• Secure backups
• Network security
• Logging
• Monitoring
• Vulnerability management
• Employee training
• Incident response
• Vendor security controls

The Executive Regulations require license applicants to provide information about the mechanisms used to secure and protect personal data.

Data breach notification in Egypt

Egypt's current framework establishes specific breach-notification timelines.

According to the PDPC, data users must notify the Center within 72 hours of becoming aware of a breach, including the information and procedures required by the law, regulations, and applicable PDPC directions.

Where a breach involves national-security matters, notification must be made immediately.

Affected data subjects must be notified within three working days from the date of notification to the PDPC, where the applicable requirements trigger such notification.

Organizations should maintain a documented incident-response process covering:

• Detection
• Containment
• Risk assessment
• Identification of affected data
• PDPC notification
• Data-subject notification
• Remediation
• Documentation
• Post-incident review

International and cross-border data transfers

Cross-border transfers are a particularly important part of Egypt's PDPL.

The PDPC states that personal data generally may not be transferred outside Egypt unless the organization obtains a prior cross-border data-transfer license or permit from the PDPC or the transfer falls within a statutory exception.

The Executive Regulations establish requirements concerning:

• Transfer destinations
• Recipient organizations
• Legal and technical safeguards
• Applicable licenses or permits
• Data categories
• Transfer arrangements
• Security protections

The regulatory framework is therefore more restrictive than a simple contractual transfer mechanism.

Organizations using overseas cloud, analytics, CRM, advertising, or hosting providers should map their international data flows and determine whether a PDPC authorization is required.

Cross-border data transfer license

The Executive Regulations establish a specific license or permit for transferring personal data from Egypt to another country.

The authorization allows transfers subject to the approved controls and restrictions.

Adding new destination countries may require updating the authorization.

Organizations should maintain a current inventory of:

• Destination countries
• Overseas vendors
• Data categories
• Processing purposes
• Transfer volumes
• Transfer mechanisms
• Security controls

Direct electronic marketing in Egypt

Egypt's framework contains specific rules for direct electronic marketing.

Organizations engaging in electronic direct marketing must address:

• Prior explicit consent
• Marketing-purpose transparency
• Sender identity
• Contact details
• Opt-out mechanisms
• Consent withdrawal
• Consent records
• Applicable PDPC licensing

The PDPC states that marketing communications must provide a clear and accessible mechanism for withdrawing consent or objecting to further communication.

The Executive Regulations also require electronic records showing how and when marketing consent was obtained and how deletion or amendment requests were handled.

Cookies and online tracking under Egypt's PDPL

The PDPL regulates personal-data processing rather than creating a standalone universal cookie rule.

However, cookies, pixels, SDKs, advertising identifiers, analytics tools, and other online technologies may process personal data.

Organizations should therefore assess:

• What each tracker collects
• Whether individuals can be identified
• Purpose of the processing
• Applicable legal justification
• Whether consent is required
• Whether data leaves Egypt
• Whether third parties receive the information
• Whether sensitive data is involved

Cookie consent and prior-script blocking

For websites relying on consent, a compliant technical implementation should ensure that relevant non-essential trackers do not activate before the required consent signal.

A ConsentX implementation can support:

• Cookie discovery
• Tracker categorization
• Consent banners
• Purpose-based preferences
• Prior-script blocking
• Consent records
• Preference withdrawal
• Regional configurations

This helps align the technical behavior of a website with its stated privacy choices.

Automated decision-making and profiling

Organizations using profiling or automated processing should assess the privacy implications of those activities.

Relevant considerations include:

• Transparency
• Purpose limitation
• Data minimization
• Accuracy
• Security
• Human oversight
• Sensitive-data processing
• Children's data
• Potential effects on individuals

Organizations should also determine whether the processing triggers additional regulatory requirements or PDPC scrutiny.

Data retention and deletion

Organizations should establish retention periods based on:

• Processing purpose
• Legal obligations
• Contractual requirements
• Regulatory requirements
• Data sensitivity
• Operational needs

A retention program should include:

• Retention schedules
• Deletion rules
• Archiving procedures
• Legal holds
• Secure destruction
• Periodic review

Personal data should not be retained indefinitely simply because it may be useful in the future.

Data processors and third-party vendors

Organizations should maintain appropriate contractual and operational controls over processors.

Vendor agreements should address:

• Processing instructions
• Confidentiality
• Security
• Sub-processors
• Data retention
• Data deletion
• Breach notification
• Data-subject requests
• International transfers
• Regulatory cooperation

Organizations should maintain a current inventory of vendors that access Egyptian personal data.

Privacy by design

Privacy should be incorporated into websites, applications, databases, and business processes from the beginning.

Organizations should consider:

• Data minimization
• Privacy-friendly defaults
• Consent controls
• Access restrictions
• Encryption
• Retention limits
• Secure deletion
• Audit logging
• Vendor controls

This is particularly important under Egypt's new licensing and compliance framework because organizations may need to demonstrate how their technical and organizational measures protect personal data.

Compliance records and audit evidence

Organizations should maintain evidence demonstrating compliance.

Important records can include:

• PDPC licenses and permits
• Consent records
• Privacy notices
• Processing inventories
• Data maps
• DPO records
• Vendor agreements
• DPIAs or risk assessments
• Security documentation
• Breach records
• Data-subject requests
• Marketing consent records
• Cross-border transfer records
• Retention schedules

ConsentX can help organizations maintain the consent and preference evidence layer for website and digital processing.

Enforcement by the Personal Data Protection Center

The Personal Data Protection Center (PDPC) is Egypt's national authority responsible for implementing and enforcing the PDPL and its Executive Regulations.

Its responsibilities include:

• Regulation
• Licensing
• Compliance monitoring
• Enforcement
• DPO registration
• Accreditation
• Guidance
• Complaints
• Awareness
• International cooperation

The PDPC identifies the Personal Data Protection Law No. 151 of 2020 and Executive Regulations No. 816 of 2025 as the legal framework under which it operates.

Penalties under Egypt's PDPL

Egypt's PDPL contains criminal penalties for various privacy violations.

For example, unlawful collection, processing, disclosure, or transfer of personal data without legal authorization or the data subject's consent can result in fines ranging from EGP 100,000 to EGP 1 million.

Where the conduct is undertaken for material or moral gain or with intent to expose the data subject to risk or harm, the penalties can increase to imprisonment of at least six months and fines between EGP 200,000 and EGP 2 million, or one of those penalties.

Other provisions establish additional penalties for violations such as unlawfully preventing data-subject rights.

The maximum penalty can reach EGP 5 million for specified offences where the applicable provision provides for that level of fine.

Organizations should therefore assess the specific offence and applicable statutory penalty rather than relying on a single headline fine.

Egypt PDPL compliance deadline

The Executive Regulations were issued under Ministerial Decree No. 816 of 2025 and became effective following publication in November 2025.

The PDPC states that a one-year compliance period begins from the entry into force of the Executive Regulations.

For organizations planning their compliance roadmap, November 2026 is therefore a critical implementation milestone.

What organizations should do before November 2026

Organizations operating in Egypt should prioritize the following.

• Map personal data. Identify what personal data is collected, where it is stored, why it is processed, and who receives it.
• Identify controller and processor roles. Document the organization's role for each processing activity.
• Review consent mechanisms. Ensure consent is explicit and appropriately recorded where consent is required.
• Review sensitive-data processing. Identify sensitive categories and implement enhanced safeguards.
• Review children's data. Identify whether individuals under 15 may use the service and implement guardian-consent controls where required.
• Appoint and register the DPO. Assess the DPO requirements and complete applicable registration procedures.
• Review PDPC licensing. Determine whether controller, processor, marketing, cross-border, surveillance, or other licenses or permits apply.
• Map international transfers. Identify overseas vendors, cloud providers, analytics services, and other recipients.
• Review direct marketing. Ensure electronic marketing has appropriate consent, records, withdrawal, and licensing controls.
• Implement breach procedures. Ensure the organization can meet the applicable PDPC and data-subject notification timelines.

Egypt PDPL compliance checklist

Organizations preparing for the Egyptian framework should consider the following checklist.

• Determine whether the Egyptian PDPL applies
• Map personal-data processing
• Identify controllers, processors, and data holders
• Identify applicable legal bases
• Review consent mechanisms
• Provide appropriate privacy notices
• Identify sensitive personal data
• Review children's-data processing
• Implement guardian consent where required
• Appoint and register a DPO
• Assess PDPC licensing requirements
• Review cross-border transfer requirements
• Obtain applicable transfer authorization
• Review direct electronic marketing
• Obtain required marketing consent
• Implement opt-out mechanisms
• Maintain consent and marketing records
• Implement security controls
• Establish a 72-hour breach-notification capability
• Establish data-subject notification procedures
• Establish DSAR workflows
• Implement retention and deletion policies
• Review processor agreements
• Review cookies and tracking technologies
• Implement prior-script blocking where required
• Maintain compliance evidence
• Complete the transition to the new framework by November 2026

Why consent management matters for Egypt

Consent management is particularly important under Egypt's PDPL because explicit consent is a central requirement for personal-data collection and processing where no statutory exception applies.

Organizations should be able to demonstrate:

• What the individual was told
• What purpose was presented
• What consent was given
• When consent was obtained
• Which version of the consent mechanism was used
• Whether consent was modified
• Whether consent was withdrawn
• How the organization enforced the user's decision

A consent management platform can provide the technical infrastructure needed to capture and preserve this evidence.