Regulationsby GlyphEgypt PDPL
In force Egypt · In force Oct 16, 2020 · next deadline Nov 2, 2026 (in 6 days)
Deadlines
Coming up
One-year compliance window endsArticle 6 of the issuing law gives those covered one year from the issue of the Executive Regulations to comply. The decree's signing date was not shown, so this date is counted from publication and is an estimate.
Already passed
Executive Regulations take effectDecree No. 816 of 2025 was published in Al-Waqa'i al-Misriyya No. 244 (supplement A) on 1 November 2025 and applies from the next day.
PDPL takes effectArticle 7 of the issuing law: in force three months after the day following publication (Gazette No. 28 bis (h), 15 July 2020). Date computed from that rule.
Summaries for reference, not legal advice. Check the official text.
What it does
Egypt's data protection law covers personal data processed electronically. It sets consent and lawful processing rules, strict rules for sensitive data and cross-border transfers, and a licensing and permit system run by the Personal Data Protection Center. The Executive Regulations were only issued in November 2025, which starts a one-year window to comply.
- Who it applies to
- Holders, controllers and processors of personal data processed electronically in Egypt, and offences by Egyptians abroad or by foreigners where the data concerns Egyptians or residents. Central Bank regulated entities are largely excluded.
- Penalties
- Criminal fines from EGP 100,000 up to EGP 5 million. Unlawful processing of sensitive data and breaches of cross-border rules carry at least three months in prison and fines of EGP 500,000 to 5 million (Arts. 41 and 42). Licensing breaches carry EGP 500,000 to 5 million (Art. 45).
- Enforced by
- Personal Data Protection Center (PDPC)
- Official name
- Law No. 151 of 2020 on the Protection of Personal Data and its Executive Regulations
- Citation
- Law No. 151 of 2020; Minister of Communications and IT Decree No. 816 of 2025
- Topics
- Privacy, Data residency, Breach notification
Research notes
Both official PDFs are scanned Gazette copies hosted by the PDPC and were read page by page.
Related
Bahrain PDPLBahrain's general data protection law. It sets lawful bases for processing, stricter rules for sensitive data, individual rights, transfer limits and registration duties, and creates the Personal Data Protection Authority. It carries both administrative and criminal penalties.In effect since Aug 1, 2019
Israel Privacy Protection Law Amendment 13Major overhaul of Israel's privacy law: broadens definitions (personal and highly sensitive information), narrows database registration, requires privacy protection officers for certain entities, and gives the Privacy Protection Authority powers to impose large administrative fines and orders, plus statutory damages.In effect since Aug 14, 2025
Kenya Data Protection ActKenya's GDPR-inspired data protection law establishing the ODPC, mandatory registration of data controllers and processors, data subject rights, 72-hour breach notification to the Commissioner, DPIAs, and conditions on cross-border transfers (with some data localisation for strategic public interest processing).In effect since Nov 25, 2019
Nigeria NDPANigeria's primary data protection statute, establishing the NDPC, lawful bases, data subject rights, 72-hour breach notification, and special duties for data controllers and processors of major importance (registration, DPO, compliance audits). The GAID 2025 supersedes the NDPR 2019 and its Implementation Framework with detailed rules on audits, DPIAs, transfers and more.In effect since Jun 12, 2023Rwanda DPP LawRwanda's data protection law, modelled on the GDPR. Controllers and processors must register with the supervisory authority, report breaches within 72 hours, and store personal data in Rwanda unless they hold a certificate allowing storage abroad. Cross-border transfers need authorisation or another listed ground.In effect since Oct 15, 2021
Saudi PDPLSaudi Arabia's comprehensive data protection law with implementing regulations and separate transfer regulations: legal bases, data subject rights, breach notification to SDAIA within 72 hours, DPO and registration requirements, and restrictions on transfers outside the Kingdom.In effect since Sep 14, 2023
South Africa Cybercrimes ActCreates cybercrime offences such as unlawful access, interception, interference with data and systems, cyber fraud, extortion, and malicious communications including harmful intimate images. It also sets rules for search, seizure and cross-border cooperation. The duty for electronic communications service providers and financial institutions to report cybercrime (section 54) has not yet commenced.In effect since Dec 1, 2021South Africa POPIASouth Africa's comprehensive data protection law built on eight conditions for lawful processing, with Information Officer registration, security compromise notification to the Regulator and data subjects, and restrictions on direct marketing and cross-border transfers. Protects juristic persons as well as individuals.In effect since Jul 1, 2020
Questions about Egypt PDPL
- What are the Egypt PDPL compliance deadlines?
- Oct 16, 2020: PDPL takes effect (tentative). Nov 2, 2025: Executive Regulations take effect. Nov 2, 2026: One-year compliance window ends (tentative).
- When does Egypt PDPL take effect?
- Egypt PDPL took effect on Oct 16, 2020. The next milestone is Nov 2, 2026: One-year compliance window ends.
- Who does Egypt PDPL apply to?
- Holders, controllers and processors of personal data processed electronically in Egypt, and offences by Egyptians abroad or by foreigners where the data concerns Egyptians or residents. Central Bank regulated entities are largely excluded.
- What are the penalties under Egypt PDPL?
- Criminal fines from EGP 100,000 up to EGP 5 million. Unlawful processing of sensitive data and breaches of cross-border rules carry at least three months in prison and fines of EGP 500,000 to 5 million (Arts. 41 and 42). Licensing breaches carry EGP 500,000 to 5 million (Art. 45).