Egypt PDPL compliance, so your data handling holds up when someone asks.

What it is

What is Egypt's Personal Data Protection Law and what is it used for?

Law No. 151 of 2020 is Egypt's personal data statute. The Ministry of Communications and Information Technology records that the President passed it in July 2020 and describes it as a framework between data controllers and users, in line with international practice, especially the GDPR. The Ministry says the Law criminalises processing outside the purposes data owners authorise, obliges collectors and processors to obtain licences, permits and approvals, and sets mechanisms for personal data in online advertising, marketing and the digital environment.

The Personal Data Protection Center administers the Law. Its portal states that the Executive Regulations have been issued, and it offers permits and licences for legal entities, a permit for liberal professions, Data Protection Officer appointment and certification, accreditation of data protection consultants, guidelines and a questionnaire that determines your obligations. The practical test: for any personal data you hold, could you show the purpose people authorised, the permit or licence that applies and how the data is protected?

Current law. Law No. 151 of 2020 was passed in July 2020, and the Personal Data Protection Center's portal states that the Executive Regulations have been issued and that the focus now turns to practical implementation, institutional readiness and engagement with sectors. Use the portal's compliance questionnaire as a first step, and confirm which duties apply to your organisation with the Center and your counsel.

Who it is for

Who needs to comply with the Egypt PDPL?

The Law concerns organisations processing personal data of people in Egypt, whatever their size, including employers holding staff records. Organisations usually come to Sterling for a structured programme from one of four directions:

• You need a licence, permit or approval. The Ministry states the Law obliges collectors and processors to obtain the necessary licences, permits and approvals, and the Center's portal offers a permit or licence service for legal entities.
• You are appointing a Data Protection Officer. The portal offers appointment, replacement and certification services for Data Protection Officers, with an examination for certification.
• You run marketing, advertising or digital services. The Ministry says the Law sets mechanisms for personal data in online advertising and marketing and for the digital environment.
• You already have a GDPR programme. The Ministry describes the Law as in line with international practice, especially the GDPR, but the licence, permit and approval system is different, so GDPR work helps without replacing Egyptian compliance.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Compliance route

How do you achieve Egypt PDPL compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the Personal Data Protection Center if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, staff, users and suppliers: what is collected, for which authorised purpose, where it is stored, who processes it and whether it leaves Egypt.
2. 02
   Gap analysis: compare current practice with the Law.Each area of the Law reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Complete the Center's compliance questionnaire, work out which permits, licences or approvals apply, update notices, appoint a Data Protection Officer, put processor agreements and security measures in place and agree an incident procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Keep permits and the officer's certification current, record incidents, review transfers abroad and cloud hosting, refresh training and follow the Center's guidelines as they are issued.

Check the route before you sign. The Center's portal lists permits and licences for entities, certification of Data Protection Officers and accreditation of data protection consultants, but no organisation-wide compliance certificate. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation directly with the accreditation body concerned.

Cost

How much does Egypt PDPL compliance cost?

The cost of a Egypt PDPL programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Egypt PDPL compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Egypt PDPL engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Law, and no organisation-wide compliance certificate appears among the Center's services; the Personal Data Protection Center supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, request, security and incident procedures and processor agreement terms, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Permits and officer support

  Help working out which permits, licences or approvals apply and preparing the Data Protection Officer arrangements.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Personal Data Protection Center administers the Law; its portal states that the Executive Regulations have been issued.

Often combined with

Standards organisations pair with Egypt PDPL

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.