Egypt Data Protection & Privacy Regulation

Controller/Processor Duties

The one-year compliance grace period that followed the Executive Regulations' effectiveness is reported to have expired on either 31 October or 1 November 2026, with the Center's acting chief executive described as treating 1 November 2026 as the operative date. From that point, controllers and processors are expected to demonstrate substantive compliance rather than treat the obligations as prospective. Among those obligations, every legal-entity controller and processor is required to appoint and register a Data Protection Officer with the Center as a precondition of applying for the General Controller/Processor Licence — a duty dated to the Regulations' effectiveness in November 2025 and now operative in fact as well as in law.

A personal-data breach must also be notified to the Center within a short, fixed window following discovery. Secondary commentary diverges on the precise figure: some sources state 72 hours, others three working days, and this has not been resolved against the Executive Regulations' own text. Entities handling personal data in Egypt are, for now, working against an unsettled deadline rather than a confirmed one.

Outlook

The period immediately following the grace period's expiry is where these duties stop being theoretical. Licensing status, Data Protection Officer appointment and breach-notification readiness are the three obligations most likely to be tested first, and the unresolved breach-notification window is the specific point most likely to produce diverging compliance practice until the Executive Regulations' own text is read definitively on that question.

Controller/Processor Duties

The Executive Regulations introduce operative controller and processor duties that were previously undefined in practice. Data users must appoint a Data Protection Officer in applicable cases and are subject to licensing obligations as data users, a status distinct from mere registration. Breach notification is now concrete and time-bound: notification to the PDPC is required within 72 hours of a controller becoming aware of a breach, with immediate notification required where the breach touches national security, and affected individuals must be informed within three business days. These are the most fully specified new obligations in the current evidence base and represent a clear escalation from the principle-level duties in the underlying 2020 law to enforceable operational deadlines.

Outlook

These duties are enacted but not yet effective in the sense that full penalty exposure attaches only once the transitional grace period ends on 1 November 2026; controllers and processors have until that date to establish DPO appointments, licensing status and breach-response procedures capable of meeting the 72-hour and three-business-day windows.

Cross-Border & Adequacy

Cross-border personal data transfers are now subject to a licensing requirement under the Executive Regulations, in addition to a standing requirement for explicit data-subject consent. No adequacy decisions issued by or in respect of Egypt were identified this cycle, and no SCC-equivalent or BCR-equivalent transfer mechanism was located in the available sourcing. On the current evidence, PDPC licensing plus explicit consent is the sole lawful transfer basis in the regime, which is a materially narrower set of options than jurisdictions offering a menu of adequacy, standard clauses and binding corporate rules. This narrows the practical routes available to any organisation moving Egyptian personal data outside the country's borders once the transitional period ends.

Outlook

Whether the PDPC develops or publishes an adequacy framework, or an SCC/BCR-equivalent instrument, ahead of or after the 1 November 2026 deadline is the open question on this dimension; nothing in the current record indicates such a mechanism is under development.

Enforcement & Redress

The one-year reconciliation period established under Egypt's Executive Regulations (Decree No. 816 of 2025) to the Personal Data Protection Law is reported to expire on 31 October 2026 according to most law-firm commentary reviewed, with a competing date of 1 November 2026 attributed in one secondary source to a statement from the Personal Data Protection Center's acting chief executive. The Executive Regulations were issued 1 November 2025 and entered into force the following day, which is the anchor date for the one-year compliance runway now closing. As at the point of this review, no enforcement decision, fine, or published enforcement guidance issued by the Personal Data Protection Center had been located, meaning the regime remains, for now, in a pre-enforcement posture even as the transitional period that justified that posture comes to an end.

The approach of this deadline is itself the material development for enforcement purposes: it marks the point at which the substantive obligations introduced by the Executive Regulations, including the licensing and registration requirements, the breach notification timelines, and the data protection officer prerequisite, cease to carry the cushion of a transitional compliance window and become directly enforceable against any controller or processor operating without having completed the required steps. The electronic portal for licence and permit applications, reported to have launched in October 2026 ahead of the deadline, is a procedural readiness measure consistent with the Center positioning itself to process a volume of applications before or around the point full enforcement authority attaches. Whether the portal has processed any applications, and whether it has been used to issue any licences or permits as of the point reviewed, could not be confirmed from the sources available.

No information was located regarding the maximum fine levels, the procedural mechanics of any Personal Data Protection Center enforcement action, or any redress mechanism available to data subjects following a breach or non-compliance finding. These remain open questions for the enforcement regime as it moves from a transitional footing into what the reported deadline suggests will be an operational one.

Outlook

The period immediately following the close of the reconciliation window, whether dated 31 October or 1 November 2026, is the period in which the first visible signs of the Personal Data Protection Center's enforcement posture would be expected to appear, whether in the form of published guidance, the first licensing decisions issued through the electronic portal, or the first enforcement actions against non-compliant controllers or processors. As no such enforcement activity had been located as at the point of this review, the near-term outlook is properly stated as anticipated rather than observed, pending confirmation of how the Center exercises its enforcement authority once the transitional period has closed.

Enforcement & Redress

The Personal Data Protection Center's electronic portal, reported launched on 7 October 2026, is understood to be the mechanism through which the Center now receives and processes applications for accreditation, licences and permits, ahead of the 31 October/1 November 2026 expiry of the law's one-year transitional grace period. From an enforcement-and-redress perspective, this is a readiness development: it indicates the administrative channel through which post-grace-period licensing determinations, and by extension the compliance status that would underpin any future enforcement action, is now understood to be operational.

No decisions or enforcement actions by the PDPC have been identified as publicly published as of this cycle. This is recorded as an absence of a public record rather than as evidence of either enforcement activity or its absence; the grace period itself is the most likely explanation for the lack of published decisions to date, since the law's compliance deadlines have not yet lapsed. The portal launch is best read as the PDPC positioning itself procedurally for the point at which the grace period ends and the licensing and enforcement machinery becomes fully live.

Separately, the law's penalty structure for the period after the grace period lapses is understood to include tiered consequences depending on the nature of the violation: cross-border transfer violations without PDPC authorisation, unauthorised direct electronic marketing, and aggravated unauthorised processing each carry distinct, escalating fine and, in some categories, custodial consequences under the Executive Regulations framework. These are standing features of the penalty architecture rather than new developments this cycle, and they are the backdrop against which the portal's launch, and the licensing activity it is designed to process, should be read: the infrastructure enabling licence compliance is reported as going live in the same window that the penalty provisions for non-compliance are set to become fully operative.

Outlook

Whether the PDPC moves to publish any enforcement decisions, or an examination or licensing-decision schedule, once the grace period lapses on 31 October/1 November 2026 is the central item to track in this module going forward. The absence of any published decision to date is consistent with the regime still being inside its transitional period, and that absence would become more analytically significant if it persisted materially beyond the grace-period expiry without accompanying procedural explanation.

Enforcement & Redress

Egypt's Personal Data Protection Center has not issued an enforcement decision under Law No. 151 of 2020 as of this reporting cycle. The reason is structural rather than an absence of regulatory activity: the one-year grace period attached to the Executive Regulations (Decision No. 816 of 2025) runs to 31 October 2026, and that date has not yet passed. Enforcement readiness, however, has visibly advanced this cycle through the launch of the PDPC's electronic portal for licence, permit and accreditation applications, which gives the regulator the administrative infrastructure needed to track which organisations have sought the licences the Executive Regulations require.

Secondary reporting indicates that, once the grace period expires, the PDPC is expected to direct its initial enforcement attention toward large-scale personal-data holders rather than pursuing a broad simultaneous sweep across all obliged entities. This is reported as an expectation rather than a published enforcement priority document, and no PDPC statement setting out a formal enforcement-prioritisation policy has been located.

The maximum administrative fine or penalty tiers available to the PDPC under Law No. 151 of 2020 and its Executive Regulations could not be sourced this cycle, which is a material gap for any firm attempting to quantify its exposure ahead of the grace-period expiry. Similarly, no information on the PDPC's redress mechanisms for individual data subjects, such as a complaints process or an appeals route against PDPC decisions, was located in the material reached this cycle.

Outlook

The 31 October 2026 grace-period expiry is the determinative date for this module: it is the point at which the PDPC's enforcement powers become fully exercisable against the backdrop of an already-operational licensing portal. Large-scale personal-data holders are reported to be the PDPC's expected initial focus once that date passes, though this remains an expectation rather than a confirmed enforcement policy, and the absence of located fine or penalty figures leaves a quantification gap that is likely to be filled only once the PDPC takes its first public enforcement action or publishes clarifying guidance.

Enforcement & Redress

The Executive Regulations establish a penalty framework of imprisonment and/or fines of up to EGP 5,000,000, with enforcement jurisdiction sitting with Egypt's Economic Courts and PDPC staff holding judicial-control powers. No published enforcement decisions have been located for Egypt to date, consistent with a regime that has only just entered the transitional grace period and has not yet reached the point of full penalty exposure. A distinct operational signal is that, as of a 10 September 2026 verification, the PDPC's public-facing Licenses and Permits electronic portal was not reachable from the regulator's own public site, despite the approaching 1 November 2026 enforcement deadline that conditions data-user and cross-border-transfer licensing on exactly that mechanism. This is a readiness gap worth tracking rather than a substantive change to the penalty framework itself.

Outlook

The key date remains 1 November 2026. Whether the licensing portal becomes functional before that date, and whether the Economic Courts and PDPC begin issuing decisions once full enforcement applies, are the two concrete signals to watch for the next assessment of Egypt's enforcement posture.