--- title: "Egypt Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/egypt-data-protection-privacy-regulation/ source_html: /jurisdictions/egypt/index.html description: "Egypt data protection and privacy regulation: 10 categories, 77 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-05T04:43:25Z content_sha256: 33aa2850a6bc2ae063b39aba89628189ebbcd9d43d4e0d28dd18dfd3e10b0170 generator: "fe-fleet/md-twin@1.0" --- # Egypt Data Protection & Privacy Regulation | Data Protection Monitor Based mainly on secondary sources. None of the sources retrieved for this jurisdiction is official or direct reporting of official material (tier 1 or 2); we look for at least 3. No finding on this page is shown with confidence above “Uncertain” until stronger sources are retrieved. # Egypt Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed in transition overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/egypt/), [World Payments](https://payments.gi/jurisdictions/egypt/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 77 claims · 31 sources in the cumulative register Download report (PDF) Expand all Egypt's data-protection regime has moved from a largely dormant statute to a fully operational, enforceable framework this cycle. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=EGYPT)[Build Report](/reports/?j=EGYPT)[Compare](/compare/?j=EGYPT) Framework posture In transition 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Personal Data Protection Center (PDPC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2026-10-31 Egypt PDPL Executive Regulations compliance grace period ends Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 8 Probable · 2 Uncertain 10 Categories 0 Red categories 57 Sub-modules 77 Claims 0 Tier-1 sources Traffic-light mix 10 amber (sums to 10 rendered categories; click to filter) No red categories; 32 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,048 Full executive summary 497 ###### Latest update · 4 November 2026 #### Lead Signal Egypt's personal data protection regime is understood to have crossed from a largely dormant statute into a nominally fully binding one. The one-year compliance grace period opened by the Executive Regulations to Law No. 151 of 2020 is reported as expiring on either 31 October or 1 November 2026, with the Personal Data Protection Center's acting chief executive described as using 1 November 2026 as the operative date. From that point, controllers and processors operating in or targeting Egypt are expected to hold a licence, have appointed and registered a Data Protection Officer, and meet breach-notification duties as matters of present compliance rather than future planning. The Center's electronic portal for licence, permit and accreditation applications is reported to have opened in October 2026, with authentication running through the Digital Egypt / Egyptian National ID system or, for foreign controllers and processors, a locally-authorised representative. Whether that portal is now accepting and processing authenticated applications end-to-end, as opposed to simply publishing guidance on how to apply, has not been independently confirmed. #### Other Developments The institutional architecture behind this shift is settled and unchanged: the Personal Data Protection Center, established under Article 19 of Law No. 151 of 2020 and chaired by the Minister of Communications and Information Technology, remains the body administering the regime. The Executive Regulations themselves were issued by Ministerial Decree No. 816 of 2025, published in the Official Gazette on 1 November 2025 and effective the following day, which is what started the one-year clock now running out. Every legal-entity controller and processor is required to appoint and register a Data Protection Officer with the Center as a precondition of applying for the General Controller/Processor Licence; that obligation, dated to the Regulations' effectiveness in November 2025, now applies in practice rather than in prospect. Separately, a personal-data breach must be notified to the Center within a short, fixed window, but secondary commentary is divided on the exact figure, variously stated as 72 hours or three working days, and this has not been resolved against the Executive Regulations' own text. #### Cross-Monitor Connections None identified. #### Outlook The period immediately ahead turns the grace-period expiry into a live test of the regime rather than a formality. Controllers and processors are expected to demonstrate licensing, Data Protection Officer appointment and breach-notification readiness from the expiry date, and the practical workability of the Center's licensing portal will be the first visible marker of whether the new regime functions as enacted or lags in administration. No enforcement decision under Law No. 151 of 2020 has been publicly reported to date, which is consistent with how recently the Center has moved into full operation, but it leaves the jurisdiction's enforcement posture, and the real-world consequence of missing the grace-period deadline, untested and worth watching. 5 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Egypt's data-protection regime has moved from a largely dormant statute to a fully operational, enforceable framework this cycle. Executive Regulations issued via Decree No. 816 of 2025, dated 1 November 2025, brought Egypt's Personal Data Protection Law No. 151 of 2020 fully into operation, and the Personal Data Protection Center (PDPC) is now empowered as the supervisory authority responsible for implementing, monitoring, and enforcing the law (CLM-EG-dp002, CLM-EG-dp001). A one-year grace period runs from that date, meaning organisations face a compliance deadline of 1 November 2026 for substantive, good-faith compliance. The PDPC's establishment as operational supervisory authority marks the transition of Egypt's data-protection framework from a five-year-dormant statute -- the PDPL was enacted in 2020 but lacked implementing regulations until now -- into an enforceable regime with a named regulator, a grace period, and specific penalty ranges. #### Other Developments Territorial scope narrower than GDPR. The PDPL's extraterritorial reach, under Article 2, is narrower than the GDPR's: it covers non-Egyptian persons abroad only where the data subject is an Egyptian national or resident (CLM-EG-dp004). This is a structural variance that limits the law's reach relative to the EU model. Cross-border data transfer is accordingly an area to watch: Egypt's approach layers the general enforcement and penalty regime of Articles 35-40 onto data-handling obligations, and combined with the PDPL's narrower-than-GDPR territorial scope, understanding when Egyptian data-protection jurisdiction attaches to a given data flow requires care distinct from a GDPR-trained compliance assumption. A third data-handling actor. The PDPL introduces a holder -- a person who holds data without decisional authority over its processing -- as a third actor distinct from the GDPR's controller/processor dichotomy under Article 4 (CLM-EG-dp009). This terminology difference means GDPR-based compliance mapping cannot be applied directly to Egypt without adaptation. Enforcement stakes are significant. Articles 35-40 impose criminal sanctions and financial penalties ranging from approximately EGP 200,000 to EGP 2,000,000, with sensitive-data-related offences attracting fines up to EGP 5,000,000 (CLM-EG-dp006). A PDPC discussion panel reported around May 2026 reaffirmed that organisations must demonstrate substantive, good-faith compliance once the grace period expires on 1 November 2026, and flagged foreign-appointed data protection officer arrangements as a practical implementation challenge (CLM-EG-dp008). #### Cross-Monitor Connections Egypt's newly operational data-protection enforcement regime, with criminal sanctions reaching into the millions of Egyptian pounds, is relevant to the financial-integrity monitor's coverage of Egyptian institutional compliance practices, insofar as data-handling obligations under the PDPL will intersect with AML/CTF customer-due-diligence data practices for regulated financial entities. It is also relevant to the world-payments monitor's coverage of Egypt's concurrent payments-licensing formalisation, since payment service providers newly licensed under the Central Bank of Egypt's framework will also be subject to the PDPL's data-handling and cross-border-transfer obligations as data controllers, processors, or holders. #### Outlook The 1 November 2026 grace-period expiry is the critical compliance inflection point to watch: organisations operating in Egypt will need to demonstrate substantive, good-faith compliance from that date, and the PDPC's practical enforcement posture beyond issuing reminders remains to be tested. The PDPC's electronic licensing and registration portal is expected to go live around June 2026, which would be the concrete procedural marker of the registration regime becoming operational ahead of the compliance deadline. The foreign-appointed DPO issue flagged by the PDPC panel is a specific implementation gap to watch for resolution or further guidance before the deadline. Read full brief · 1048 words ###### Latest update · 4 November 2026 #### Regulatory Status Egypt's data protection regime, anchored in Law No. 151 of 2020 and administered by the Personal Data Protection Center under the Minister of Communications and Information Technology, moves this period from a framework that was largely unenforced in practice to one that is nominally fully binding. The Executive Regulations issued by Ministerial Decree No. 816 of 2025 — published 1 November 2025, effective the next day — opened a one-year compliance grace period that is reported to expire on either 31 October or 1 November 2026, with the Center's acting chief executive described as treating 1 November 2026 as the operative date. The Center's electronic portal for licence, permit and accreditation applications is reported open since October 2026, with authentication through Digital Egypt / Egyptian National ID or a locally-authorised representative for foreign entities, though whether it processes authenticated applications end-to-end remains unconfirmed. Controllers and processors are now expected to hold the required licence, to have appointed and registered a Data Protection Officer with the Center as a precondition of that licence, and to meet breach-notification obligations whose precise deadline — 72 hours in some accounts, three working days in others — has not been settled against the Executive Regulations' own text. No enforcement decision under Law No. 151 of 2020 has been publicly reported to date, consistent with how recently the Center has become operational. #### Outlook The immediate period ahead will show whether the licensing portal operates as a complete application channel and whether the Center begins acting on the duties it now has the legal basis to enforce. The absence of any reported enforcement decision, combined with the unresolved breach-notification deadline, leaves both the practical bite of the regime and the precise compliance timetable as open questions for entities operating in or targeting Egypt. 3 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Egypt's data-protection regime became fully operational this cycle. Executive Regulations under Decree No. 816 of 2025 took effect 1 November 2025, establishing the Personal Data Protection Center as supervisory authority under the Personal Data Protection Law No. 151 of 2020 (CLM-EG-dp001, CLM-EG-dp002). The law's territorial scope is narrower than the GDPR's, extending extraterritorially only to Egyptian nationals or residents abroad (CLM-EG-dp004), and it introduces a third data-handling actor -- the holder -- distinct from the GDPR's controller/processor dichotomy (CLM-EG-dp009). Enforcement carries criminal sanctions and fines from approximately EGP 200,000 to EGP 2,000,000, rising to EGP 5,000,000 for sensitive-data offences (CLM-EG-dp006), and a PDPC panel reported around May 2026 flagged foreign-appointed DPO arrangements as a practical compliance challenge ahead of the 1 November 2026 grace-period expiry (CLM-EG-dp008). #### Outlook The 1 November 2026 grace-period expiry and the PDPC's expected electronic licensing portal launch around June 2026 are the two concrete markers to watch as Egypt's data-protection regime moves from newly operational to fully enforced. Read full brief · 497 words Key regulatory facts for Egypt Regulatory Dimension Egypt Standing Position Jurisdiction Egypt (EG) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 77 sourced findings) Regulator & Framework Primary statute in force since 2020 but implementing regulations and regulator operability only crystallized in Nov 2025-2026, with substantive compliance (licensing, DPO, cross-border) not mandatory until 31 Oct 2026. Lawful Processing & Special Data Consent and special-category provisions are documented; pseudonymisation/anonymisation definitions were not located in available secondary sources. Data Subject Rights Correction/objection rights documented; access, portability, and response-window specifics remain unconfirmed from available sources. Controller/Processor Duties Core duties (DPO, DPIA concept, security, breach notice) exist in statute but material implementing detail is acknowledged as incomplete/uncertain by professional commentary. Primary Instruments Cited OneTrust DataGuidance, OneTrust DataGuidance, OneTrust DataGuidance, OneTrust DataGuidance, Amereller Last Confirmed / Updated 2026-11-04 (31 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Egypt: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Primary statute in force since 2020 but implementing regulations and regulator operability only crystallized in Nov 2025-2026, with substantive compliance (licensing, DPO, cross-border) not mandatory until 31 Oct 2026. Primary framework Law No. 151 of 2020 on the Protection of Personal Data (PDPL) and Executive Regulations No. 816 of 2025 Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Primary statute in force since 2020 but implementing regulations and regulator operability only crystallized in Nov 2025-2026, with substantive compliance (licensing, DPO, cross-border) not mandatory until 31 Oct 2026. #### Sub-modules (5) #### Regulator And AuthorityAmber PDPC is the statutory regulator; historically un-established, now issuing guidelines and templates and having posted the Executive Regulations. Claims (5): - The Personal Data Protection Center (PDPC) is the supervisory authority designated to enforce Egypt's Personal Data Protection Law and issue implementing guidance. - Personal Data Protection Center (PDPC) — Established under Article 19 of Law No. 151 of 2020, chaired by the Minister of Telecommunication and Information Technology. - Personal Data Protection Centre (PDPC) — PDPL Art. 19 establishes the PDPC, chaired by the Minister of Telecommunication and Information Technology, as the primary data-protection regulator. - Personal Data Protection Center (PDPC) — Art. 19 of Law No. 151 of 2020, chaired by the Minister of Telecommunications and Information Technology - The PDPC is established under Article 19 of Law No. 151 of 2020 and chaired by the Minister of Communications and Information Technology. #### Act And InstrumentsGreen PDPL (Law 151/2020) is the central instrument, supplemented by Executive Regulations No. 816/2025. Claims (6): - Law No. 151 of 2020 on the Protection of Personal Data, published in the Official Gazette in July 2020, functions as Egypt's central omnibus data-protection statute and entered into force 15 October 2020. - Executive Regulations No. 816 of 2025, issued by the Ministry of Communications and Information Technology on 1 November 2025 (publicly posted by the PDPC in late December 2025), detail the procedures for implementation, supervision, and enforcement of the PDPL. - Executive Regulations (Ministerial Decree No. 816/2025) — Entered into force on 2 November 2025, triggering the one-year Art. 6 PDPL reconciliation period ending 31 October/1 November 2026. - Executive Regulations (Decree No. 816 of 2025) — Issued 1 November 2025, entered into force 2 November 2025, triggering the one-year reconciliation period under PDPL Art. 6. - Executive Regulations (Decision No. 816 of 2025) — PDPL's operative provisions; one-year grace period for full compliance runs to 31 October 2026 - The Executive Regulations to Law 151/2020 were issued by Decree 816/2025, published 1 November 2025, opening a one-year grace period. #### Material ScopeGreen Applies to electronic (in whole or part) processing of personal data, with statutory carve-outs. Claims (1): - The PDPL applies to personal data processed electronically, in part or in full, and expressly excludes processing for personal use, official statistics, media purposes, judicial-seizure records, and data held by the Central Bank of Egypt and CBE-supervised entities (other than money-transfer/forex companies). #### Territorial ScopeAmber Extraterritorial reach to non-resident foreigners where the underlying act is criminalized abroad and victim data belongs to an Egyptian citizen/resident. Claims (3): - The PDPL extends to a non-Egyptian resident domiciled outside Egypt where the same act is criminalized in the country where it occurred and the affected personal data belongs to an Egyptian citizen or resident. - Foreign controller/processor without Egyptian presence — A local representative subject to PDPC approval, where processing personal data of individuals located in Egypt without a branch or representative office. - PDPC electronic portal — foreign controllers and processors, who are expected to appoint a representative in Egypt #### Regulator Registration And FilingAmber Licensing/permit regime administered by PDPC for sensitive-data processing, cross-border transfer, video surveillance, and e-marketing. Claims (5): - Under the Executive Regulations, processing sensitive personal data, cross-border transfers, video surveillance, and electronic direct marketing each require a PDPC-issued license or permit. - Personal Data Protection Center (PDPC) — The PDPC introduced a unified 'Controller/Processor Licence,' the primary mandatory authorisation for processing personal data, filed electronically via a portal officially launched in October 2026. - PDPC electronic licensing portal — As of 10 September 2026, no launch announcement published and no application route reachable, despite an earlier mid-2026 target. - PDPC electronic licensing portal — Reported launched in October 2026, ahead of the compliance deadline, enabling Controller/Processor Licence applications. - The PDPC's licensing/accreditation portal opened in October 2026. Egypt's omnibus regime rests on Law No. 151 of 2020 on the Protection of Personal Data (PDPL), which entered into force on 15 October 2020, with the Personal Data Protection Center (PDPC) as designated regulator. The PDPC was not operationally established for years; the long-awaited Executive Regulations (No. 816 of 2025) were issued 1 November 2025 and publicly posted by the PDPC in late December 2025, opening a one-year compliance grace period ending 31 October 2026. The regime is therefore enacted but only partially operative -- hence in_transition status. Periodic update · new data 2026-11-04 #### Regulator & Framework The Personal Data Protection Center, established under Article 19 of Law No. 151 of 2020 and chaired by the Minister of Communications and Information Technology, remains the body that administers Egypt's data protection regime. Its implementing Executive Regulations were issued by Ministerial Decree No. 816 of 2025, published in the Official Gazette on 1 November 2025 and taking effect the following day. That instrument opened a one-year compliance grace period, and the period is reported to expire on either 31 October or 1 November 2026 depending on the secondary source consulted; the Center's own acting chief executive is described as using 1 November 2026. A tangible sign of the regime moving from framework to operation is the Center's electronic portal for licence, permit and accreditation applications, reported open since October 2026. Authentication runs through the Digital Egypt / Egyptian National ID system for domestic entities, or through a locally-authorised representative for foreign controllers and processors. It has not been independently confirmed whether the portal is now accepting and processing authenticated applications end-to-end, or is at this stage limited to publishing guidance on how to apply — a distinction that matters a great deal to any entity trying to establish whether it is actually licensed. #### Outlook With the grace period at or past its boundary, the practical test ahead is whether the licensing portal functions as a complete application channel rather than an information page, and whether the Center begins issuing licences, permits and accreditations at the volume the now-binding regime implies. That operational detail, rather than the legal architecture, is the open question going into the period after expiry. 4 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Regulator & Framework The Personal Data Protection Center is understood to have officially launched its electronic portal, with the launch reported on 7 October 2026. The portal is designed to receive and process applications for accreditation, licences and permits under the Personal Data Protection Law, and it is reported to carry the unified Controller/Processor Licence, described as the primary mandatory authorisation route for any entity processing personal data in Egypt. This launch is understood to be a direct readiness step taken ahead of the one-year transitional grace period, which is understood to end on 31 October or 1 November 2026. The PDPC itself is established under Article 19 of the Personal Data Protection Law and is chaired by the Minister of Telecommunication and Information Technology. Its Executive Regulations entered into force on 2 November 2025, under Law No. 151 of 2020, and it is this Executive Regulations framework that is understood to set out the detailed licensing, consent, breach-notification and cross-border transfer mechanics the Center now administers operationally through the newly launched portal. Prior to this portal launch, the practical mechanics of filing for a Controller/Processor Licence were reported as less operationally defined; the portal is understood to formalise an electronic filing channel where previously the route to compliance was less concrete for controllers and processors seeking to meet their obligations. No direct PDPC primary text or Official Gazette text was independently retrieved to confirm the portal launch at a higher confidence tier; the finding rests on secondary legal commentary and industry reporting, which is why it is treated as a probable rather than confirmed development in this record. This should not be read as doubt about whether the portal exists, only as a statement about the sourcing tier available to this composition. The timing of the launch, in the weeks immediately preceding the grace-period expiry, is consistent with a regulator preparing its administrative infrastructure to receive a wave of licence applications before the transitional protections lapse. Controllers and processors operating in Egypt, including foreign controllers without a local branch who are separately required to appoint an authorised local representative under the Executive Regulations, are the entities for whom this portal is the operative channel for compliance going into the grace-period deadline. #### Outlook The period between the reported portal launch and the 31 October/1 November 2026 grace-period expiry is the operative window for controllers and processors to file for the Controller/Processor Licence. Confirmation of the portal's launch and functional scope through PDPC primary text or an Official Gazette notice would allow this finding to be stated with higher confidence in a future cycle. Whether the PDPC publishes further operational guidance, such as a licence-fee schedule or processing-timeline commitments, as the grace period closes is the next development to track in this module. Periodic update · new data 2026-10-11 #### Regulator & Framework Egypt's data-protection regulator, the Personal Data Protection Center, was established under Article 19 of Law No. 151 of 2020 and is chaired by the Minister of Telecommunications and Information Technology. The PDPL's operative provisions were activated by Executive Regulations issued as Decision No. 816 of 2025 on 1 November 2025, which opened a one-year grace period for full compliance running to 31 October 2026, and which became publicly available in detail around December 2025 and January 2026. The central development of this cycle is operational rather than legislative: the PDPC's electronic portal has reportedly been launched for accreditation, licence and permit applications, open to all organisations subject to the PDPL, including foreign controllers and processors. Foreign entities are expected to appoint a representative in Egypt in order to engage with the regime, though the specific pinpoint provision establishing that representative duty has not been independently verified against the Arabic-language Executive Regulations text this cycle. The exact launch date of the portal is likewise not confirmed against a PDPC primary announcement; secondary reporting as of 7 October 2026 described it as having launched earlier that month. The practical significance of the portal's launch is that it converts the PDPL from a largely dormant statute, in effect since 2020 but without an active registration or licensing mechanism, into a regime with a functioning administrative gateway. Organisations subject to the PDPL, including those processing sensitive data, conducting cross-border transfers, operating video surveillance, or engaging in electronic direct marketing, now have an operational route to seek the licences the Executive Regulations require for those categories of processing, and a functioning gateway is a precondition for the PDPC to begin assessing applications and, eventually, pursuing non-compliance once the grace period lapses. No primary PDPC source (pdpc.gov.eg) was directly reached this cycle; the findings summarised here rest on law-firm and compliance-vendor secondary reporting of the Arabic-language Executive Regulations and of the portal's operation, which should be read as a sourcing constraint on the precision of the pinpoint-article detail rather than on the overall direction of the regime. #### Outlook With the portal operational and the grace period running to 31 October 2026, the PDPC's framework is moving from a dormant legislative state into active administrative function. The most consequential near-term marker is the grace-period expiry itself, after which the PDPC is expected to begin exercising its licensing and enforcement powers in earnest; confirmation of the exact portal launch date and the representative-appointment provision from a PDPC primary source would resolve the sourcing gaps presently affecting this module. Periodic update · new data 2026-10-04 #### Regulator & Framework Egypt's data-protection regulatory architecture rests on the Personal Data Protection Law (PDPL, Law 151/2020) and its Executive Regulations, issued as Ministerial Decree No. 816/2025, which entered into force on 2 November 2025. That entry into force triggered the one-year reconciliation period provided under Article 6 PDPL, a transitional window during which existing data processing activities are understood to be brought into compliance with the new licence-based regime. The Personal Data Protection Centre's own published framing extends that grace period until 31 October 2026, giving affected organisations a defined, if narrowing, compliance runway. The Executive Regulations operationalise the Personal Data Protection Centre (PDPC), established under PDPL Article 19 and chaired by the Minister of Telecommunication and Information Technology, as Egypt's primary data-protection regulator. The regime the PDPC administers is described in commentary as licence-based and regulator-led, covering consent mechanisms, records of processing activity, cross-border transfers, and data protection officer appointments, among other areas, a structure that places the PDPC at the centre of a wide range of day-to-day compliance determinations rather than leaving those determinations to self-assessment by controllers and processors. A material extraterritorial-scope feature of the regime is that foreign controllers and processors without a branch or representative office in Egypt, who nonetheless process the personal data of individuals located in Egypt, are required to appoint a local representative, itself subject to PDPC approval. This creates a compliance dependency for offshore entities serving the Egyptian market that mirrors, in structure though not necessarily in detail, representative-appointment requirements seen in other extraterritorial data-protection regimes. The most significant framework-level development identified this cycle is administrative rather than legislative: as at 10 September 2026, the PDPC had published no launch announcement for its electronic licensing portal, and no application route was reachable, despite an earlier mid-2026 target having passed without the portal materialising. Since the regime is licence-based, and licensing is the mechanism through which controllers, processors, cross-border transfer authorisations, electronic-marketing permits and CCTV permits are all meant to be granted, the absence of a functioning portal weeks before the 31 October 2026 grace-period expiry represents a structural gap between the law's substantive requirements, which have been in force since November 2025, and the regulator's administrative capacity to process the applications that compliance with those requirements depends on. This gap is a framework-level finding distinct from any single substantive obligation: it concerns the PDPC's own operational readiness rather than the content of any specific duty imposed on controllers or processors. It is, however, likely to shape how every other module of the regime is experienced in practice over the remainder of 2026, since obligations that are formally in force cannot be formally discharged through licensing where no licensing mechanism yet exists. #### Outlook The period between now and 31 October 2026 is the operative compliance countdown for Egypt's data-protection framework. The central question is whether the PDPC launches its licensing portal within the remaining weeks of the grace period, extends the transitional period to accommodate its own administrative timeline, or begins enforcement action against entities that have not obtained licences that the portal has not yet been able to issue. The PDPC is understood to retain statutory authority to initiate investigations and enforcement actions even during the grace period, notwithstanding that it is reported as not currently utilising its full powers while the transitional period runs, which leaves open the possibility of early enforcement activity even absent a functioning licensing portal. Organisations with an Egyptian compliance footprint, including foreign controllers and processors relying on the local-representative mechanism, face continuing uncertainty over how licence-dependent obligations, including cross-border transfer authorisation, will be practically discharged if the portal's non-launch persists past the grace-period deadline. Periodic update · new data 2026-09-28 #### Regulator & Framework The Personal Data Protection Center is confirmed as the supervisory authority responsible for implementation, monitoring and enforcement of Law No. 151 of 2020, a status formalised by the Executive Regulations issued under Decree No. 816 of 2025. This activates a supervisory structure that had existed on paper since 2020 but lacked operative implementing detail for five years. The Executive Regulations themselves entered into force on 2 November 2025 and carry a one-year transitional grace period, running to 1 November 2026, before full enforcement is expected to apply. The framework is now a two-instrument stack: the primary Law No. 151/2020 establishing rights and obligations in principle, and the Executive Regulations giving those obligations operative content, including the PDPC's supervisory mandate. No primary PDPC gazette text was directly retrieved this cycle; the findings rest on T3 law-firm commentary describing the same Regulations, which is recorded as an evidentiary gap rather than absorbed silently. #### Outlook The governing date is 1 November 2026, when the transitional grace period lapses and the PDPC's enforcement and licensing functions become fully operative in practice, not merely on paper. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (20) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/egypt) — The Personal Data Protection Center (PDPC) is the supervisory authority designated to enforce Egypt's Personal Data Protection Law and issue implementing guidance. - [OneTrust DataGuidance](https://www.dataguidance.com/news/egypt-data-protection-law-published-official-gazette-enters-force-3-months) — Law No. 151 of 2020 on the Protection of Personal Data, published in the Official Gazette in July 2020, functions as Egypt's central omnibus data-protection statute and entered into force 15 October 2020. - [OneTrust DataGuidance](https://www.dataguidance.com/news/egypt-pdpc-issues-executive-regulations-personal-data) — Executive Regulations No. 816 of 2025, issued by the Ministry of Communications and Information Technology on 1 November 2025 (publicly posted by the PDPC in late December 2025), detail the procedures for implementation, supervision, and enforcement of the PDPL. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/egypt-new-data-protection-law-and-what-expect) — The PDPL applies to personal data processed electronically, in part or in full, and expressly excludes processing for personal use, official statistics, media purposes, judicial-seizure records, and data held by the Central Bank of Egypt and CBE-supervised entities (other than money-transfer/forex companies). - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/egypt-new-data-protection-law-and-what-expect) — The PDPL extends to a non-Egyptian resident domiciled outside Egypt where the same act is criminalized in the country where it occurred and the affected personal data belongs to an Egyptian citizen or resident. - [OneTrust DataGuidance](https://www.dataguidance.com/news/egypt-pdpc-issues-executive-regulations-personal-data) — Under the Executive Regulations, processing sensitive personal data, cross-border transfers, video surveillance, and electronic direct marketing each require a PDPC-issued license or permit. - [Amereller](https://amereller.com/publication/the-egyptian-personal-data-protection-regime-what-you-need-to-know-ahead-of-31-october-2026/) — Personal Data Protection Center (PDPC) — The PDPC introduced a unified 'Controller/Processor Licence,' the primary mandatory authorisation for processing personal data, filed electronically via a portal officially launched in October 2026. - [Amereller](https://amereller.com/publication/the-egyptian-personal-data-protection-regime-what-you-need-to-know-ahead-of-31-october-2026/) — PDPC electronic licensing portal — As of 10 September 2026, no launch announcement published and no application route reachable, despite an earlier mid-2026 target. - [Shalakany](https://shalakany.com/wp-content/uploads/2025/12/New-Executive-Regulations-for-Egypts-Personal-Data-Protection-Law-.pdf) — Executive Regulations (Ministerial Decree No. 816/2025) — Entered into force on 2 November 2025, triggering the one-year Art. 6 PDPL reconciliation period ending 31 October/1 November 2026. - [Baker McKenzie / Helmy, Hamza and Partners](https://www.bakermckenzie.com/en/insight/publications/2026/01/egypt-important-data-protection-update) — Personal Data Protection Center (PDPC) — Established under Article 19 of Law No. 151 of 2020, chaired by the Minister of Telecommunication and Information Technology. - [Kennedys Law](https://www.kennedyslaw.com/en/thought-leadership/article/2026/egypt-s-personal-data-protection-law-the-compliance-countdown-has-begun/) — Executive Regulations (Decree No. 816 of 2025) — Issued 1 November 2025, entered into force 2 November 2025, triggering the one-year reconciliation period under PDPL Art. 6. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/egypt) — Personal Data Protection Centre (PDPC) — PDPL Art. 19 establishes the PDPC, chaired by the Minister of Telecommunication and Information Technology, as the primary data-protection regulator. - [Kooch](https://kooch.co/en/post/egypt-pdpl-licensing-portal-october-2026) — Foreign controller/processor without Egyptian presence — A local representative subject to PDPC approval, where processing personal data of individuals located in Egypt without a branch or representative office. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/egypt) — Personal Data Protection Center (PDPC) — Art. 19 of Law No. 151 of 2020, chaired by the Minister of Telecommunications and Information Technology - [Shalakany](https://shalakany.com/wp-content/uploads/2025/12/New-Executive-Regulations-for-Egypts-Personal-Data-Protection-Law-.pdf) — Executive Regulations (Decision No. 816 of 2025) — PDPL's operative provisions; one-year grace period for full compliance runs to 31 October 2026 - [Kooch](https://kooch.co/en/post/egypt-pdpl-licensing-portal-october-2026) — PDPC electronic portal — foreign controllers and processors, who are expected to appoint a representative in Egypt - [Baker McKenzie](https://www.bakermckenzie.com/en/insight/publications/2026/10/egypt-personal-data-protection-law-update) — PDPC electronic licensing portal — Reported launched in October 2026, ahead of the compliance deadline, enabling Controller/Processor Licence applications. - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/egypt) — The PDPC is established under Article 19 of Law No. 151 of 2020 and chaired by the Minister of Communications and Information Technology. - [Shalakany](https://shalakany.com/wp-content/uploads/2025/12/New-Executive-Regulations-for-Egypts-Personal-Data-Protection-Law-.pdf) — The Executive Regulations to Law 151/2020 were issued by Decree 816/2025, published 1 November 2025, opening a one-year grace period. - [Kooch](https://kooch.co/en/post/egypt-pdpl-licensing-portal-october-2026) — The PDPC's licensing/accreditation portal opened in October 2026. ### Egypt: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Consent and special-category provisions are documented; pseudonymisation/anonymisation definitions were not located in available secondary sources. Primary framework Law No. 151 of 2020 (PDPL), Executive Regulations No. 816/2025 Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Consent and special-category provisions are documented; pseudonymisation/anonymisation definitions were not located in available secondary sources. D2 · Lawful Processing — Full Module Record 4 sub-modules · 35 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Egypt: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Correction/objection rights documented; access, portability, and response-window specifics remain unconfirmed from available sources. Primary framework Law No. 151 of 2020 (PDPL) Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Correction/objection rights documented; access, portability, and response-window specifics remain unconfirmed from available sources. #### Sub-modules (5) #### Access RightAmber PDPL is broadly described as GDPR-similar in providing data-subject rights, but a distinct access-right provision was not separately confirmed. Claims (1): - The PDPL has similarities to the GDPR with provisions relating to data subject rights, data controller and processor obligations, and strict data-transfer obligations. #### Rectification And ErasureGreen Data subjects may correct, amend, delete, add, or update their personal data. Claims (1): - Data subjects under the PDPL may correct, amend, delete, add, or update their personal data. #### Restriction And ObjectionGreen Data subjects may limit the purpose/scope of processing and object to processing or its results where a violation exists. Claims (1): - Data subjects under the PDPL may limit the purpose of processing to a specific scope and object to processing or its result where a violation exists. #### Data PortabilityRed No explicit data-portability provision was identified in the sources searched. #### Deadlines And Response WindowsRed No statutory response-deadline figures for PDPL data-subject requests were identified in the sources searched. Claims (1): - PDPL core duties — GDPR broadly on accuracy, security, erasure, record-keeping; no specific statutory response-deadline figure located The PDPL grants GDPR-analogous data-subject rights: rectification/erasure/update, purpose-limitation/restriction, and objection to processing where a violation exists. Distinct access-right scope, portability, and statutory response-deadline provisions were not clearly located in the secondary sources reviewed and are flagged as gaps pending primary-text/Executive-Regulations review. Sources and claims (4) - [OneTrust DataGuidance](https://www.dataguidance.com/jurisdictions/egypt) — The PDPL has similarities to the GDPR with provisions relating to data subject rights, data controller and processor obligations, and strict data-transfer obligations. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/egypt-new-data-protection-law-and-what-expect) — Data subjects under the PDPL may correct, amend, delete, add, or update their personal data. - [OneTrust DataGuidance](https://www.dataguidance.com/opinion/egypt-new-data-protection-law-and-what-expect) — Data subjects under the PDPL may limit the purpose of processing to a specific scope and object to processing or its result where a violation exists. - [dataprotection.gi](https://dataprotection.gi/jurisdictions/egypt/) — PDPL core duties — GDPR broadly on accuracy, security, erasure, record-keeping; no specific statutory response-deadline figure located ### Egypt: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core duties (DPO, DPIA concept, security, breach notice) exist in statute but material implementing detail is acknowledged as incomplete/uncertain by professional commentary. Primary framework Law No. 151 of 2020 (PDPL), Executive Regulations No. 816/2025 Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Core duties (DPO, DPIA concept, security, breach notice) exist in statute but material implementing detail is acknowledged as incomplete/uncertain by professional commentary. Periodic update · new data 2026-11-04 #### Controller/Processor Duties The one-year compliance grace period that followed the Executive Regulations' effectiveness is reported to have expired on either 31 October or 1 November 2026, with the Center's acting chief executive described as treating 1 November 2026 as the operative date. From that point, controllers and processors are expected to demonstrate substantive compliance rather than treat the obligations as prospective. Among those obligations, every legal-entity controller and processor is required to appoint and register a Data Protection Officer with the Center as a precondition of applying for the General Controller/Processor Licence — a duty dated to the Regulations' effectiveness in November 2025 and now operative in fact as well as in law. A personal-data breach must also be notified to the Center within a short, fixed window following discovery. Secondary commentary diverges on the precise figure: some sources state 72 hours, others three working days, and this has not been resolved against the Executive Regulations' own text. Entities handling personal data in Egypt are, for now, working against an unsettled deadline rather than a confirmed one. #### Outlook The period immediately following the grace period's expiry is where these duties stop being theoretical. Licensing status, Data Protection Officer appointment and breach-notification readiness are the three obligations most likely to be tested first, and the unresolved breach-notification window is the specific point most likely to produce diverging compliance practice until the Executive Regulations' own text is read definitively on that question. Periodic update · new data 2026-09-28 #### Controller/Processor Duties The Executive Regulations introduce operative controller and processor duties that were previously undefined in practice. Data users must appoint a Data Protection Officer in applicable cases and are subject to licensing obligations as data users, a status distinct from mere registration. Breach notification is now concrete and time-bound: notification to the PDPC is required within 72 hours of a controller becoming aware of a breach, with immediate notification required where the breach touches national security, and affected individuals must be informed within three business days. These are the most fully specified new obligations in the current evidence base and represent a clear escalation from the principle-level duties in the underlying 2020 law to enforceable operational deadlines. #### Outlook These duties are enacted but not yet effective in the sense that full penalty exposure attaches only once the transitional grace period ends on 1 November 2026; controllers and processors have until that date to establish DPO appointments, licensing status and breach-response procedures capable of meeting the 72-hour and three-business-day windows. D4 · Controller & Processor — Full Module Record 7 sub-modules · 64 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Egypt: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ A binding license-based transfer-restriction regime is confirmed, but GDPR-style adequacy/SCC/BCR/TIA architecture is absent or unconfirmed. Primary framework Law No. 151 of 2020 (PDPL), Executive Regulations No. 816/2025 Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber A binding license-based transfer-restriction regime is confirmed, but GDPR-style adequacy/SCC/BCR/TIA architecture is absent or unconfirmed. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy Cross-border personal data transfers are now subject to a licensing requirement under the Executive Regulations, in addition to a standing requirement for explicit data-subject consent. No adequacy decisions issued by or in respect of Egypt were identified this cycle, and no SCC-equivalent or BCR-equivalent transfer mechanism was located in the available sourcing. On the current evidence, PDPC licensing plus explicit consent is the sole lawful transfer basis in the regime, which is a materially narrower set of options than jurisdictions offering a menu of adequacy, standard clauses and binding corporate rules. This narrows the practical routes available to any organisation moving Egyptian personal data outside the country's borders once the transitional period ends. #### Outlook Whether the PDPC develops or publishes an adequacy framework, or an SCC/BCR-equivalent instrument, ahead of or after the 1 November 2026 deadline is the open question on this dimension; nothing in the current record indicates such a mechanism is under development. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 74 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Egypt: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial and telecom overlays are documented; other sectoral overlays are unconfirmed gaps. Primary framework Law No. 151 of 2020 (PDPL); Telecom Regulation Law No. 10/2003; Anti-Cyber and IT Crimes Law No. 175/2018 Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Financial and telecom overlays are documented; other sectoral overlays are unconfirmed gaps. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 69 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Egypt: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Direct-marketing licensing is confirmed; the remaining adtech sub-domains are unconfirmed gaps typical of a still-maturing regime. Primary framework Executive Regulations No. 816/2025 to the PDPL Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Direct-marketing licensing is confirmed; the remaining adtech sub-domains are unconfirmed gaps typical of a still-maturing regime. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 31 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Egypt: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Biometric/genetic licensing is confirmed; ADM transparency, profiling restrictions, AI risk assessment and surveillance carve-outs remain unconfirmed or purely aspirational. Primary framework Law No. 151 of 2020 (PDPL), Executive Regulations No. 816/2025 Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Biometric/genetic licensing is confirmed; ADM transparency, profiling restrictions, AI risk assessment and surveillance carve-outs remain unconfirmed or purely aspirational. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 55 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Egypt: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Minors' data is nominally sensitive/protected, but the mechanics (age threshold, parental consent, profiling ban) are confirmed absent by comparative analysis. Primary framework Law No. 151 of 2020 (PDPL) Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Minors' data is nominally sensitive/protected, but the mechanics (age threshold, parental consent, profiling ban) are confirmed absent by comparative analysis. D9 · Children's Privacy — Full Module Record 5 sub-modules · 50 words · 4 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Egypt: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Enforcement architecture (courts + PDPC) and a major 180-day-window development are confirmed; enforcement track record, funding, and collective-redress mechanisms remain unconfirmed given the regime's pre-operative status. Primary framework Law No. 151 of 2020 (PDPL), Executive Regulations No. 816/2025 Supervisory authority Personal Data Protection Center (PDPC) Traffic-light rationale — Amber Enforcement architecture (courts + PDPC) and a major 180-day-window development are confirmed; enforcement track record, funding, and collective-redress mechanisms remain unconfirmed given the regime's pre-operative status. Periodic update · new data 2026-10-25 #### Enforcement & Redress The one-year reconciliation period established under Egypt's Executive Regulations (Decree No. 816 of 2025) to the Personal Data Protection Law is reported to expire on 31 October 2026 according to most law-firm commentary reviewed, with a competing date of 1 November 2026 attributed in one secondary source to a statement from the Personal Data Protection Center's acting chief executive. The Executive Regulations were issued 1 November 2025 and entered into force the following day, which is the anchor date for the one-year compliance runway now closing. As at the point of this review, no enforcement decision, fine, or published enforcement guidance issued by the Personal Data Protection Center had been located, meaning the regime remains, for now, in a pre-enforcement posture even as the transitional period that justified that posture comes to an end. The approach of this deadline is itself the material development for enforcement purposes: it marks the point at which the substantive obligations introduced by the Executive Regulations, including the licensing and registration requirements, the breach notification timelines, and the data protection officer prerequisite, cease to carry the cushion of a transitional compliance window and become directly enforceable against any controller or processor operating without having completed the required steps. The electronic portal for licence and permit applications, reported to have launched in October 2026 ahead of the deadline, is a procedural readiness measure consistent with the Center positioning itself to process a volume of applications before or around the point full enforcement authority attaches. Whether the portal has processed any applications, and whether it has been used to issue any licences or permits as of the point reviewed, could not be confirmed from the sources available. No information was located regarding the maximum fine levels, the procedural mechanics of any Personal Data Protection Center enforcement action, or any redress mechanism available to data subjects following a breach or non-compliance finding. These remain open questions for the enforcement regime as it moves from a transitional footing into what the reported deadline suggests will be an operational one. #### Outlook The period immediately following the close of the reconciliation window, whether dated 31 October or 1 November 2026, is the period in which the first visible signs of the Personal Data Protection Center's enforcement posture would be expected to appear, whether in the form of published guidance, the first licensing decisions issued through the electronic portal, or the first enforcement actions against non-compliant controllers or processors. As no such enforcement activity had been located as at the point of this review, the near-term outlook is properly stated as anticipated rather than observed, pending confirmation of how the Center exercises its enforcement authority once the transitional period has closed. Periodic update · new data 2026-10-18 #### Enforcement & Redress The Personal Data Protection Center's electronic portal, reported launched on 7 October 2026, is understood to be the mechanism through which the Center now receives and processes applications for accreditation, licences and permits, ahead of the 31 October/1 November 2026 expiry of the law's one-year transitional grace period. From an enforcement-and-redress perspective, this is a readiness development: it indicates the administrative channel through which post-grace-period licensing determinations, and by extension the compliance status that would underpin any future enforcement action, is now understood to be operational. No decisions or enforcement actions by the PDPC have been identified as publicly published as of this cycle. This is recorded as an absence of a public record rather than as evidence of either enforcement activity or its absence; the grace period itself is the most likely explanation for the lack of published decisions to date, since the law's compliance deadlines have not yet lapsed. The portal launch is best read as the PDPC positioning itself procedurally for the point at which the grace period ends and the licensing and enforcement machinery becomes fully live. Separately, the law's penalty structure for the period after the grace period lapses is understood to include tiered consequences depending on the nature of the violation: cross-border transfer violations without PDPC authorisation, unauthorised direct electronic marketing, and aggravated unauthorised processing each carry distinct, escalating fine and, in some categories, custodial consequences under the Executive Regulations framework. These are standing features of the penalty architecture rather than new developments this cycle, and they are the backdrop against which the portal's launch, and the licensing activity it is designed to process, should be read: the infrastructure enabling licence compliance is reported as going live in the same window that the penalty provisions for non-compliance are set to become fully operative. #### Outlook Whether the PDPC moves to publish any enforcement decisions, or an examination or licensing-decision schedule, once the grace period lapses on 31 October/1 November 2026 is the central item to track in this module going forward. The absence of any published decision to date is consistent with the regime still being inside its transitional period, and that absence would become more analytically significant if it persisted materially beyond the grace-period expiry without accompanying procedural explanation. Periodic update · new data 2026-10-11 #### Enforcement & Redress Egypt's Personal Data Protection Center has not issued an enforcement decision under Law No. 151 of 2020 as of this reporting cycle. The reason is structural rather than an absence of regulatory activity: the one-year grace period attached to the Executive Regulations (Decision No. 816 of 2025) runs to 31 October 2026, and that date has not yet passed. Enforcement readiness, however, has visibly advanced this cycle through the launch of the PDPC's electronic portal for licence, permit and accreditation applications, which gives the regulator the administrative infrastructure needed to track which organisations have sought the licences the Executive Regulations require. Secondary reporting indicates that, once the grace period expires, the PDPC is expected to direct its initial enforcement attention toward large-scale personal-data holders rather than pursuing a broad simultaneous sweep across all obliged entities. This is reported as an expectation rather than a published enforcement priority document, and no PDPC statement setting out a formal enforcement-prioritisation policy has been located. The maximum administrative fine or penalty tiers available to the PDPC under Law No. 151 of 2020 and its Executive Regulations could not be sourced this cycle, which is a material gap for any firm attempting to quantify its exposure ahead of the grace-period expiry. Similarly, no information on the PDPC's redress mechanisms for individual data subjects, such as a complaints process or an appeals route against PDPC decisions, was located in the material reached this cycle. #### Outlook The 31 October 2026 grace-period expiry is the determinative date for this module: it is the point at which the PDPC's enforcement powers become fully exercisable against the backdrop of an already-operational licensing portal. Large-scale personal-data holders are reported to be the PDPC's expected initial focus once that date passes, though this remains an expectation rather than a confirmed enforcement policy, and the absence of located fine or penalty figures leaves a quantification gap that is likely to be filled only once the PDPC takes its first public enforcement action or publishes clarifying guidance. Periodic update · new data 2026-09-28 #### Enforcement & Redress The Executive Regulations establish a penalty framework of imprisonment and/or fines of up to EGP 5,000,000, with enforcement jurisdiction sitting with Egypt's Economic Courts and PDPC staff holding judicial-control powers. No published enforcement decisions have been located for Egypt to date, consistent with a regime that has only just entered the transitional grace period and has not yet reached the point of full penalty exposure. A distinct operational signal is that, as of a 10 September 2026 verification, the PDPC's public-facing Licenses and Permits electronic portal was not reachable from the regulator's own public site, despite the approaching 1 November 2026 enforcement deadline that conditions data-user and cross-border-transfer licensing on exactly that mechanism. This is a readiness gap worth tracking rather than a substantive change to the penalty framework itself. #### Outlook The key date remains 1 November 2026. Whether the licensing portal becomes functional before that date, and whether the Economic Courts and PDPC begin issuing decisions once full enforcement applies, are the two concrete signals to watch for the next assessment of Egypt's enforcement posture. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 73 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Pro (£39/mo · £99/mo all products) or Firm (£199/mo · £449/mo all products) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[View Pro & Firm Plans (£39 / £199)](https://a-i.gi/licensing/#plans)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (14 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 13-22 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 32-34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 37-39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44-49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77-84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties