Personal Data Protection Center
EgyptEgypt's data protection authority under the Personal Data Protection Law No. 151 of 2020 (PDPL), operating under the Ministry of Communications and Information Technology (MCIT). Operational, with full enforcement expected from late 2026 after a one-year transitional period.
- Jurisdiction (head office)
- Egypt
- Scope covered
- Egypt
- Type
- Data protection authority
- GRC discipline
- Data protection & privacy
- Statutory / official basis
- Law No. 151 of 2020 on the Protection of Personal Data (PDPL); Executive Regulations issued by Decree No. 816 of 2025 on 1 November 2025
- Status
- Current — verified 15 September 2026
- Versions & language
- Official site in Arabic; English availability not verified.
A one-year transitional period under the Executive Regulations runs to the end of October 2026; full enforcement is expected from around 1 November 2026.
Why it matters
Egypt’s regime moved from statute-on-paper to operating framework when the Executive Regulations to the PDPL were issued on 1 November 2025 (Decree No. 816 of 2025), five years after the law itself. Three features are worth a UK practitioner’s attention. First, the law is extraterritorial: Article 2 applies it to anyone processing personal data of individuals located in Egypt, wherever the processing happens — so a UK controller with Egyptian customers or employees can be in scope. Second, the framework is licence-based in a way UK GDPR is not: permits are required from the PDPC for activities including cross-border transfer, direct electronic marketing and sensitive-data processing, and the transitional period for obtaining them ends in late October 2026. Third, breach notification is broader than the UK’s: the PDPC must be notified within 72 hours and affected individuals within three working days of that notification, without the risk threshold UK GDPR Articles 33 and 34 provide.
There is no UK adequacy decision for Egypt, so transfers from the UK to Egypt also need an Article 46 UK GDPR transfer tool in the other direction. The PDPC has begun publishing guidance, including Data Subject Consent Guidelines requiring consent requests in Arabic as the primary language. The points above on the Executive Regulations are drawn from law-firm summaries rather than the Official Gazette text, which we have not read; we cite the decree by number only for that reason.