Organizations doing business in Egypt should note the differences between GDPR and PDPL requirements, including potential programs that may need uplift to ensure compliance.
By Calum Docherty, Rhys McWhirter, Esther Franks, Danielle van der Merwe, Hayley M. Pizzey, Bianca H. Lee, and Amy Smyth
Egypt enacted its first comprehensive data protection law, the Personal Data Protection Law No. 151/2020 (PDPL), which is supplemented by Executive Regulations No. 816 of 2025 (Regulations), on November 1, 2025. Together, the PDPL and the Regulations establish a comprehensive framework governing the collection, processing, storage, and transfer of personal data in Egypt.
The Regulations introduce a tiered licensing system for data processing, cross-border data transfers, direct electronic marketing, and video surveillance systems, and elaborate requirements for consent, data protection officer appointment, and breach reporting to the Personal Data Protection Centre (PDPC). These obligations are supplemented by a number of guidelines issued by the PDPC to provide more guidance.
In this report, we compare the requirements of the GDPR and the PDPL/Regulations in further detail, highlighting potential gaps in GDPR-based compliance programs and outlining possible steps to uplift such programs for PDPL compliance purposes. As additional regulatory guidance is issued by the PDPC, organizations may need to adjust their compliance approaches accordingly.
Recent Comments