Join our webinar on democratizing data in the cloud with Forrester, Snowflake and TIAA - Sign up here

Start Now

What is Egypt's Data Protection Law

With emerging technology and the world becoming more digital, countries all over the world are drafting comprehensively data privacy regulations. Joining the global movement, the government of Egypt has passed its first-ever Personal Data Protection Law (PDPL), which is very much in line with the requirements of the global best practice, the EU’s General Data Protection Regulation (GDPR). The PDPL came into effect on 14 October 2020.

The PDPL protects data processed electronically. It applies to both data controllers and processors that process personal data belonging to Egyptian residents, whether or not the organizations are based in Egypt.


Data subjects’ rights

Under the PDPL, data subjects have the following rights:

  • Right to access personal information
  • Right to withdraw consent of processing personal data
  • Right to delete personal information
  • Right to correct and/or update personal information
  • Right to limit the processing of personal information
  • Right to object to processing of personal information
  • Right to be notified of any breach involving personal information

Processing principles

Under the PDPL, no personal information can be collected, processed, or disclosed unless there exists a legal basis to do so. Legal basis includes explicit consent of the concerned data subject, the legitimate interest of the data controller or any relevant third-party, performance of a contract, commencement of a legal action, or compliance with a legal obligation. However, where it involves the processing of sensitive personal information, the PDPL requires data controllers to obtain the explicit consent of the concerned data subject even if there is a legitimate interest to process such sensitive personal information.


Obligations of Organizations:

Under the PDPL, organizations have the following responsibilities

Authorization from the Personal Data Protection Center

For the purposes of enforcement of the law, Egypt will set up the Personal Data Protection Center. All organizations that wish to carry out the processing activities must obtain a license from the Personal Data Protection Center.

Appointment of the Data Protection Officer

Organizations must appoint a Data Protection Officer, who shall be licensed and approved by the Personal Data Protection Center. The Data Protection Officer shall notify the Personal Data Protection Center of any personal data breach.

Breach notification requirement

Data controllers and processors must report  any cyber-attacks or personal data breaches to the Personal Data Protection Center as well as to the concerned data subject within 72 hours after having become aware of the breach. Where any personal data breach threatens the national security, companies must report to the relevant authorities and concerned data subjects immediately.

Cross-border data transfer

Under the PDPL, personal information can be transferred outside Egypt only if the destination country provides equivalent or comparable data protection standards and is authorized by the Personal Data Protection Center. In exceptional cases, the transfer of personal information outside Egypt must take place only after the explicit consent of the concerned data subject, for which certain conditions shall be fulfilled.

Record of processing activities

Organizations must maintain updated records of their processing activities.


What's Next?

Organizations shall have a grace period of around 21 days to comply with the requirements of the law. A violation of the requirement of the PDPL may result in severe criminal penalties or costly administrative fines. The maximum fine that can be awarded under the law is 5 million Egyptian pounds and imprisonment of up to three year where prison sentences apply.

Egypt's Personal Data Protection Law aims to protect people’s personal information by granting them several rights and protections. Organizations are encouraged to undertake reasonable and appropriate technical measures in line with the requirements introduced by the law.

Automating privacy operations across your organization

The multi-disciplinary practice to grow trust-equity of your brand and comply with privacy regulations.

Get the Book

“By leveraging the PrivacyOps constructs from this book across our organization we were able to not only save time and money but also mitigate the risks associated with manual methods of privacy management.”

- Marty Collins, Chief Privacy and Legal Officer, QuinStreet, Inc

Automating Compliance

SECURITI.ai offers an automated solution to enable organizations to comply with the requirements of Egypt’s Personal Data Protection Law, in addition to other applicable privacy regulations, with ease and efficiency. The award-winning solution revolves around the concept of PrivacyOps, which utilizes artificial intelligence and robotic automation to streamline compliance tasks, freeing up crucial resources for other areas of business.

SECURITI.ai helps organizations discover data over a wide range of internal and external systems, build a People Data Graph to link personal data to each individual, automate data subject requests, assessments, consent management and more.

To learn how SECURITI.ai can help your business efficiently implement privacy management, request a demo today.

Democratize your data without compromising security and privacy
Register Now

View