Egypt - Personal Data Protection Law No. 151 (2020)

Law No. 151 of 2020 was published in July 2020 and entered into force in October 2020, three months after publication. It defines personal data broadly and treats health, genetic, biometric, financial, religious, political and criminal-record data, as well as all children's data, as sensitive. Processing requires the data subject's explicit consent or another legal basis under Article 6, and sensitive data requires a specific permit. The Personal Data Protection Center (PDPC), a public economic authority under the Ministry of Communications and Information Technology, licenses controllers and processors, receives complaints, conducts inspections and regulates cross-border transfers; it is now operational and its executive regulations were issued in late 2025 to early 2026.

Controllers and processors must appoint a registered Data Protection Officer, notify the Center of breaches within 72 hours (immediately where national security is concerned) and inform affected data subjects within three days of notifying the Center. Cross-border transfers are prohibited unless the destination offers at least an equivalent level of protection and a licence or permit is obtained from the Center. Direct electronic marketing requires prior consent, sender identification and opt-out mechanisms. Enforcement is judicial, through Egypt's Economic Courts: in the first court application of the law, on 27 May 2025 an Alexandria court ordered a telecom operator to pay compensation of approximately EUR 280,000 to a customer whose SIM card had been fraudulently swapped.