Blog details
Egypt Personal Data Protection Law: consent, licences, data-subject requests and breach notice for custom systems. Get a custom quote from Golden Code.
Short answer: Egypt's Personal Data Protection Law (Law No. 151 of 2020) now operates with executive regulations issued in November 2025, and the one-year period the law gives organisations to regularize their position has ended as of 10 November 2026. If a custom website, app or back-office system processes personal data in Egypt, you need legal advice plus product work: consent evidence, licensing, data-subject requests, retention, transfer and hosting checks, and a 72-hour breach path.
By Mohamed Samy, senior backend developer specializing in Laravel/PHP, with seven years of experience. Published: 10 November 2026. Updated: 10 November 2026.
This is not legal advice, and it is not a substitute for counsel or for guidance from the Personal Data Protection Center (PDPC). The official Arabic text of the law and its executive regulations prevails over any unofficial translation I used to locate article numbers.
Most owners who contact me start with a Laravel admin that already stores names, IDs and invoices, a cloud database outside Egypt, and a marketing list without a clear opt-in log. Golden Code builds custom systems from scratch; we do not sell a compliance product or a legal retainer. The checklist below is the technical work I scope in Egypt first, then the Gulf.
What changed, and why the date matters
Law No. 151 of 2020 was published in the Official Gazette and, under Article 7 of the promulgating law, came into force three months after the day following publication. Article 6 of that promulgating law requires persons subject to the law to regularize their position within one year from the date the executive regulations are issued.
Those regulations were issued as Minister of Communications and Information Technology Decree No. 816 of 2025. Publication records place the decree in the Official Gazette (Al-Waqa'i' al-Misriya) on 1 November 2025, in force the following day. Counted from issuance on 1 November 2025, the year in Article 6 runs to 1 November 2026; some commentaries use 31 October 2026 instead. I will not invent an “enforcement hour.” As of 10 November 2026, that year has passed. Confirm remaining filings with counsel and the PDPC.
The Centre is a public economic authority under the competent minister. Use its official site, pdpc.gov.eg, for current forms and application channels.
Who the law actually covers
The attached law applies to personal data of natural persons processed electronically, wholly or partly. Promulgating Article 3 lists exclusions, including purely personal use, certain official statistical or statutory processing, specified media uses, judicial records, data held by the national security authorities defined in the law, and data held by the Central Bank of Egypt and entities under its control, except money-transfer and foreign-exchange companies as the article states.
If you run a company site, shop, clinic system, HR file or custom CRM, do not assume you are outside the law. Exemption is a legal question. The engineering question is whether the product already stores names, contacts, IDs, payments, health notes, children’s data or marketing lists.
The law distinguishes a controller, who determines the purpose and means, from a processor, who processes under a controller’s instructions or as otherwise defined. Cloud hosts, payroll vendors and marketing agencies often sit on the processor side. An ecommerce store, HR and payroll system or mobile app may be a controller, a processor, or both. Map that with counsel before you rewrite screens.
What a custom system has to support
A privacy-policy template does not implement the Egypt personal data protection law. The statute expects operational ability in the product and in the organisation around it.
| Area | What the law is driving at | Typical work in a custom app |
|---|---|---|
| Consent and notices | Express consent except where the law authorises another basis | Purpose-specific collection, Arabic notices, stored proof |
| Data-subject rights | Access, correction, erasure, restriction, objection, breach notice | Intake, identity checks, a six-working-day clock, audit trail |
| Records | Controller and processor registers of categories, disclosures, security | A living processing record, not a forgotten sheet |
| Licences and permits | Prior authorisation to handle personal data, plus activity-specific licences | Evidence packs for the Centre; do not leave filing as a backlog item |
| Transfers and hosting | Cross-border movement needs a licence or permit and an adequate level of protection | Know where data lives, including backups and support access |
| Direct marketing | Prior consent, sender identity, a working opt-out, retained consent logs | Separate marketing flags from operational mail |
| Breach handling | Report to the Centre within 72 hours of becoming aware | Detection, a 72-hour playbook, then notice to the people affected |
Consent, purposes and the fields you already collect
Article 2 says personal data must not be collected, processed, disclosed or divulged without the data subject’s express consent, except where authorised by law. Article 3 requires lawful, specified purposes made known to the person; accurate and secure data; processing appropriate to those purposes; and retention no longer than needed. Article 6 lists when electronic processing is considered legitimate, including consent, certain contractual or legal-act needs, legal obligations or competent orders, and other specified cases that must not conflict with fundamental rights and freedoms.
In a Laravel app this is product design, not a banner. Collect only what the journey needs. Split account creation from marketing opt-in. Store who consented, to what, when, and how the notice was shown, and let withdrawal actually stop that processing.
Sensitive personal data, as defined in Article 1, includes health, biometric, financial, religious, political and security-status data, and children’s data in all cases. Article 12 adds a Centre licence and, except where the law authorises otherwise, express written consent, with guardian consent for children’s data.
Data-subject rights are a workflow, not a mailbox
Article 2 lists rights to be informed of and access data, withdraw consent, correct or erase data, limit processing, be informed of a breach, and object in specified cases. Article 32 requires a response within six working days of the request. Article 10 uses the same clock when someone entitled asks for data to be made available; silence is treated as rejection.
A generic “email admin@…” page will miss that clock. You need a usable channel, identity checks, a decision record, and a path to export, correct or delete data without breaking records you must keep. Where tax or Egypt e-receipt rules require retention, counsel should define what can be erased and what Article 4, item 7, requires to be kept without identifying the person once the purpose ends.
The 72-hour breach path
Article 7 is specific. When a controller or processor becomes aware of a breach or violation of personal data held by it, it must report to the Centre within seventy-two hours, and immediately if national security considerations are involved. Within the same 72 hours it must also provide a description of the nature, form and causes, the approximate volume of data and related records, Data Protection Officer details, likely effects, measures taken and proposed, documentation, and any further material the Centre requests. It must then notify the data subject within three working days from the date of that report, and describe the measures taken.
The clock runs from awareness to the Centre, then from the report date to the people affected. Monitoring, logging and an on-call rota have to support that sequence.
Licences, officers and hosting outside Egypt
Articles 4 and 5 require a controller or processor to obtain a licence or permit from the Centre to handle personal data. Article 26 covers types including handling and processing, direct electronic marketing, public-place visual surveillance, sensitive data, consultancy accreditation and cross-border transfer. Under Article 1, a licence to a legal person lasts three years and may be renewed; a permit lasts at most one year. Article 27 requires a decision within ninety days of a complete application; otherwise it is deemed refused. Article 26 caps the licence fee at two million Egyptian pounds and the permit or accreditation fee at five hundred thousand Egyptian pounds. That ceiling is not a Golden Code price; actual fees follow the Centre’s schedules.
Article 8 requires a legal person to appoint a specialised employee for personal data protection, register that person in the Centre’s Data Protection Officer register, and announce the appointment. A natural-person controller or processor remains responsible for implementing the law. Software can support the officer; it cannot be the officer.
Cross-border movement is defined broadly in Article 1. Article 14 says personal data collected or prepared for processing must not be transferred to a foreign state, or stored or shared there, unless a level of protection no lower than the law is available and a licence or permit has been obtained. Article 15 lists limited exceptions, still requiring express consent. If production data, backups, email, error tracking or support access sits outside Egypt, put that on the map before you assume “the app is hosted locally.”
Articles 17 and 18 govern direct electronic marketing: consent, an identifiable sender, a reachable address, a clear marketing purpose, a working rejection mechanism, and consent records kept for three years from the last transmission.
Penalties in the statute, not as a scare quote
Chapter Fourteen sets penalty ranges, not a quote for your case. Article 36 sets a fine of not less than one hundred thousand and not more than one million Egyptian pounds for unauthorised collecting, processing, disclosure or circulation without consent, with a higher range and possible imprisonment in aggravating cases in that article. Article 38 (duties in Articles 4, 5 and 7) runs from three hundred thousand to three million Egyptian pounds. Articles 41, 42 and 45 use an upper fine of five million Egyptian pounds for specified sensitive-data, cross-border, and licence offences, and Articles 41 and 42 also allow imprisonment of not less than three months, or either penalty. Article 49 provides for reconciliation or settlement in specified circumstances. Read the chapter with a lawyer. They are not a Golden Code package price.
How we scope the technical work
Step 1: Inventory the personal data you already hold
List systems, tables, files, backups, vendors and support tools that store or can access personal data. Note Egypt-resident customers, children, financial or health fields, and where the servers sit.
Step 2: Map purposes, legal bases and consent evidence
For each journey, write the declared purpose, the basis counsel selected, and whether the product can prove it. Separate operational messages from marketing. Fix the collection screens first.
Step 3: Build the rights and retention workflows
Implement intake, identity checks, the six-working-day clock, export, correction, erasure or restriction, and a register of decisions. Define retention with counsel so required records are kept and the rest is not stored “just in case.”
Step 4: Review hosting, processors and cross-border access
Name every vendor that can see personal data, including staging and backups. If data leave Egypt, treat Article 14 as a gate, not a footnote. Keep processor contracts and access logs with the architecture diagram.
Step 5: Rehearse the 72-hour breach path
Agree who decides that an incident is notifiable, who files the Centre report, and who notifies people within three working days of that report. Test logging and on-call cover.
Step 6: Align licences and the officer with a custom build plan
Counsel leads licensing, the officer appointment and Centre filings. We scope the software: notices, evidence, requests, records, marketing flags, access control and incident support. Golden Code does not publish a fixed compliance package. After that review we can send you a custom technical quote.
Egypt first, then Gulf statutes
Start with Egypt: Arabic notices, local customer data, and any tax or e-receipt hooks already in the system. If the same product later serves Saudi Arabia or the UAE, do not paste this checklist onto those markets.
The UAE official portal describes Federal Decree-Law No. 45 of 2021 regarding the protection of personal data, in force on 2 January 2022, and the UAE Data Office. Saudi Arabia publishes its law and implementing regulation through the Saudi Data and AI Authority (SDAIA). Those are separate regimes. Use Google Trends explore links rather than invented scores: Egypt, the UAE and Saudi Arabia.
Soft next step
If your product already holds customer or staff data in Egypt, send a short inventory: the system URL, the personal fields you store, where hosting and backups sit, and whether you send marketing messages. We will say what belongs in a custom technical scope and what belongs with your lawyer and the Centre. Start from our services overview or send Golden Code a short inventory of the personal data your system holds for a custom technical quote—no fixed package, only a scoped proposal.
FAQ
Does every Egyptian website need a PDPC licence?
Not automatically, and this article cannot decide your case. Confirm with counsel and the Centre whether you are a controller or processor and which licence or permit applies.
Is a privacy policy enough to comply with the Egypt personal data protection law?
No. A notice is necessary, but the law also expects a lawful basis, rights workflows, records, security measures, and, where required, licences, an appointed officer and transfer authorisations.
What is the 72-hour rule, exactly?
Article 7 requires a report to the Centre within seventy-two hours of becoming aware, immediately if national security considerations are involved, then notice to the data subject within three working days from the date of that report.
If our servers are outside Egypt, is that automatically unlawful?
Not automatically, but Article 14 requires a comparable level of protection and a licence or permit, with limited exceptions in Article 15. Map hosting, backups and vendor access first.
Do you sell a fixed Egypt PDPL compliance package?
No. Golden Code does not publish a fixed compliance package or a licence fee. We quote custom technical work after an inventory. Filings stay with you, your counsel and the PDPC.
Does Saudi or UAE data protection law replace the Egyptian statute?
No. They are separate regimes. For Egyptian personal data, start with Law 151/2020 and the PDPC. If you also operate in the UAE or Saudi Arabia, add those statutes with local counsel.
Sources
- Personal Data Protection Center — pdpc.gov.eg
- Law No. 151 of 2020 (Official Gazette). Unofficial English translation used for article numbers: Youssry Saleh & Partners. The official Arabic text prevails.
- Decree No. 816 of 2025 issuing the executive regulations (Official Gazette, 1 November 2025; in force 2 November 2025)
- UAE Government official page — Data protection laws (Federal Decree-Law No. 45 of 2021)
- Saudi Data and AI Authority — Laws and regulations
- Google Trends explore links above; no invented scores
