Egypt PDPL
Personal Data Protection Law (Law No. 151 of 2020)
Comprehensive data protection law regulating personal data processing in Egypt. Requires parental consent for children under 15, mandatory Data Protection Officer appointment, and 72-hour breach notification.
Jurisdiction
Egypt
Enacted
Jul 13, 2020
Effective
Nov 1, 2020
Enforcement
Data Protection Center
Law No. 151 of 2020 was published July 13, 2020 and came into force three months later, but its licensing, DPO, breach-notification and transfer regime depended on Executive Regulations that were not issued until Minister of Communications and Information Technology Decree No. 816 of 2025, published in Al-Waqa i al-Misriyya No. 244 (Supplement A) on November 1, 2025 and in force the following day. Article (6) of the law issuing provisions gives addressees one year from the issuance of the Executive Regulations to reconcile their positions and comply, so enforcement by the Personal Data Protection Center is expected from November 2026.
Ministry of Communications and Information Technology: Law No. 151 of 2020 (official PDF, scanned); English text also at ILO NATLEX (EGY111246); Executive Regulations: Decree No. 816 of 2025, Al-Waqa i al-Misriyya No. 244 Supplement A, 1 November 2025Why It Matters
Egypt is Africa's third-largest economy. November 2026 deadline creates compliance obligation for companies serving Egyptian users, particularly for platforms used by minors.
Recent Developments
Executive Regulations issued by Ministerial Decree No. 816 of 2025, published in Al-Waqa i al-Misriyya No. 244 (Supplement A) on November 1, 2025, five years after the law, covering licences and permits for controllers and processors, data protection officers, cross-border transfers, breach management and impact assessments. Under Article (6) of the law issuing provisions, addressees have one year from issuance of the Executive Regulations to comply, so the compliance period runs to the start of November 2026. The earlier note on this row describing an 18-month grace period was incorrect.
At a Glance
Applies to
Who Must Comply
- Public and private entities processing personal data in Egypt
- Entities outside Egypt offering services to Egyptian data subjects
- Automated decision-making systems processing Egyptian personal data
Safety Provisions
- Children under 15 require guardian consent for data processing
- Mandatory 72-hour breach notification to Data Protection Center
- Data Protection Officer required for entities processing personal data
- Security measures proportionate to risk
- Cross-border transfer restrictions
Compliance & Enforcement
Key Dates
Nov 1, 2026
End of the one-year compliance period under Article (6) of the issuing provisions of Law 151/2020, running from the issuance of the Executive Regulations (Decree 816/2025, gazetted November 1, 2025); licensing, DPO, breach-notification and cross-border transfer obligations become enforceable by the Personal Data Protection Center
Penalties
EGP 3M; criminal liability
View on map
Egypt
Focus Areas
Cite This
APA
Egypt. (2020). Personal Data Protection Law (Law No. 151 of 2020).
Related Regulations
Zambia DPA
Zambia's comprehensive data protection law with special protections for vulnerable persons and DPIA requirements for high-risk processing.
Egypt AI Strategy 2025
Ambitious national strategy positioning Egypt as regional AI hub for Africa and Middle East. Targets 7.7% ICT sector GDP contribution by 2030, training 30,000 AI specialists, establishing 250 AI companies. Built on six strategic pillars: governance, infrastructure, technology, data, ecosystem, and talent. Accompanied by Egyptian Charter for Responsible AI (April 2023) with ethics principles.
Botswana DPA
Botswana's modernized data protection law requiring Data Protection Impact Assessment and establishing age 16 for consent.
Seychelles DPA
Seychelles' modern data protection law requiring DPO for large-scale processing and recognizing Cross-Border Privacy Rules certification.
Rwanda AI Policy
First African country to adopt comprehensive national AI policy. Establishes Responsible AI Office (RAIO) under MINICT. Implements RURA ethical guidelines covering beneficence, non-maleficence, autonomy, justice, explicability, transparency. Non-binding framework.
Kenya AI Bill
First comprehensive AI bill in Sub-Saharan Africa. Proposes creation of AI Commissioner, AI Authority, and Advisory Committee. Establishes risk-based regulatory model aligned with EU AI Act framework, criminalizes harmful deepfakes, and mandates AI content labeling.
Last updated September 20, 2026. Verify against primary sources before relying on this information.