Personal Data Protection & GDPR Compliance

Yes, if it is a legal entity that collects or electronically processes personal data of customers, employees or others. The size of the company does not matter. Natural persons obtain a permit for a specific purpose, valid for no more than one year. Legal entities obtain a licence valid for 3 years and renewable; a renewal request is filed at least three months before expiry (Article 40 of the Regulations).

Types of licence

• Core licence: controller and processor, controller only, or processor only.
• Supplementary licences, issued only alongside a valid core licence: cross-border data transfer (including reliance on servers or cloud services outside Egypt), direct electronic marketing, and visual surveillance in public places.

Article 21 of the Regulations requires a legal entity applying for a licence to submit the contract with its DPO, showing that the DPO accepts the responsibilities and is given the independence needed to perform them. Article 35 requires the DPO to be identified in the application. The DPO is entered in a register kept by the Centre and receives an identification code (Article 9). Article 8 of the Law requires a legal entity to appoint within its own structure a specialist employee responsible for data protection, registered with the Centre, and one DPO may serve more than one entity with the consent of those entities and the Centre (Article 11 of the Regulations). The DPO’s duties include monitoring the application of security policies, submitting an annual report to the Centre, and following up data subject requests and complaints (Article 12). The Centre must be notified at least 15 days before the DPO’s engagement ends (Article 10).

Annual fees for a legal entity depend on the number of records (each record relates to one data subject), under the table in Article 19 of the Regulations:

• No fee for 1 to 100,000 records.
• EGP 200 a year for 101,000 to 200,000 records, rising by EGP 100 for each further 100,000 records up to EGP 1,000 for entities holding up to one million records, with higher bands after that.
• The ceiling is EGP 666,666 a year (EGP 2 million over three years) for more than 5 million records.
• A controller-only or processor-only licence costs half. The cross-border transfer licence costs 50% of the licence fee, and electronic marketing costs 10% (own marketing) or 25% (marketing for others).

The application is filed electronically through the PDPC portal (pdpc.gov.eg) with the required documents, including the commercial register, the organisational structure, the nature and volume of personal data and which of it is sensitive, retention periods, security and transfer measures, the mechanism for erasing and amending data, the mechanism for obtaining consent, the DPO, and technical certificates for the infrastructure (Article 35). The Centre decides within 90 working days of receiving the complete documents, and silence counts as refusal (Article 36).

Article 6 of the Law’s issuing articles requires those covered to regularise their position within one year of the date the Executive Regulations were issued. The Regulations were published in the Egyptian Gazette on 1 November 2025, so on that basis the period ends around the end of October or the beginning of November 2026. We advise against waiting for the last day, and recommend following the PDPC portal and announcements for practical implementation details and any clarifications.

The person responsible for the actual management of a legal entity is punished with the same penalties if knowledge is proven, and the entity is jointly liable for compensation (Article 47). The Centre may also impose administrative sanctions, starting with a warning and then suspension or withdrawal of the licence in whole or in part (Article 30). Settlement is possible for some offences under Article 49.

1. Map the personal data you hold and the number of records, and decide whether you act as controller, processor or both.
2. Choose a DPO and prepare the appointment contract so that it meets Article 21 of the Regulations.
3. Prepare a record of processing activities, a privacy policy, consent mechanisms and a process for data subject requests.
4. Review supplier and cloud contracts and identify which activities need a supplementary cross-border licence.
5. Put a breach response plan in place: notify the Centre within 72 hours and the data subjects within 3 working days of notifying the Centre (Article 7 of the Law).
6. Foreign entities processing data of people in Egypt should appoint a legal representative in Egypt.