Data Protection in Egypt

Data Protection in Egypt

Personal data in Egypt is governed by Personal Data Protection Law No. 151 of 2020, supervised by the Personal Data Protection Center (PDPC). The Executive Regulations, issued by Ministerial Decree No. 816 of 2025, turned the law's principles into operating rules and gave existing controllers and processors a one-year period to bring their activity into line. From our Cairo branch we place a client against these rules: whether it acts as a controller, a processor or both, and what it has to obtain, appoint or document.

Licences, permits and the PDPC

Collecting, storing, transferring or otherwise processing personal data electronically requires a licence or permit from the PDPC: a licence for ongoing activity, a permit where the processing is limited to one purpose and period. Separate licences or permits apply to cross-border transfers, electronic direct marketing and sensitive data. A legal entity must appoint a data protection officer from the PDPC registry or register its own, and a foreign controller or processor with no presence in Egypt must appoint a representative in Egypt, through a local branch, an existing entity or an authorised representative under a power of attorney, subject to PDPC approval.

Consent, rights and notices

Processing rests on the data subject's consent for a stated purpose; using the data for another purpose needs fresh consent. Individuals can access their data, correct it, object and withdraw consent, and the privacy notice must be in Arabic, in plain language and easy to find. Sensitive data needs explicit written consent on top of the PDPC permit, and for a child under 15 the consent comes in writing from the guardian. Electronic marketing needs prior explicit consent, a clearly identified sender and purpose, and an effective way to opt out.

Transfers abroad, breaches and enforcement

Personal data may not be transferred, stored or accessed outside Egypt without a PDPC licence or permit, an assessment of the destination country's level of protection and the data subject's explicit consent. A personal data breach must be reported to the PDPC within 72 hours of becoming aware of it, and affected individuals must be told within three working days. Non-compliance exposes the entity to the sanctions in the law and to damages claims. For the wider corporate practice, see General Commercial & Corporate; to scope a compliance file, contact our team.

MENA coordination

The firm was founded in Kuwait in 1986 and has a branch in Cairo. It covers MENA matters in cooperation with partner offices in Saudi Arabia, the UAE and Qatar, and partner offices in Turkey and the United States. Those partner offices are not branches owned by the firm; local licensing and advice are assessed in the relevant jurisdiction.

This page is general information, not advice for a particular entity or transaction.

Frequently asked questions

Does Egypt have a data protection law?

Yes. Personal Data Protection Law No. 151 of 2020, with Executive Regulations issued by Ministerial Decree No. 816 of 2025. The Personal Data Protection Center supervises it and issues the licences and permits.

Does a foreign company with Egyptian users' data need a representative in Egypt?

A controller or processor outside Egypt with no presence there must appoint a representative in Egypt, for example a local branch, an existing entity or an authorised representative under a power of attorney, subject to PDPC approval.

How fast must a data breach be reported in Egypt?

To the PDPC within 72 hours of becoming aware of it. Affected individuals must be informed within three working days.

Other markets

Corporate & Commercial Law in Egypt · Data Protection in Saudi Arabia · Data Protection in the UAE · Data Protection in Qatar · Data Protection in Oman · Data Protection in Bahrain