Executive Regulations to the Personal Data Protection Law No. 151 of 2020 (Decree No. 816 of 2025)

The Executive Regulations to Egypt's Personal Data Protection Law No. 151 of 2020, issued by Prime Ministerial Decree No. 816 of 2025 on 1 November 2025, constitute the detailed implementing framework that brought Egypt's data protection regime into full operational effect. Alongside their issuance, the Personal Data Protection Centre (PDPC) released a suite of operational guidelines on topics including lawful bases, consent, privacy notices, licensing, electronic direct marketing, Records of Processing Activities, and Data Protection Officers. A one-year compliance transition period applies from the date of issuance, with full enforcement expected from October 2026. The Executive Regulations give concrete shape to the PDPL's licensing model, establishing a tiered and graduated licensing regime for personal data processing activities. Different licence types and permits are prescribed depending on the nature and purpose of processing. Licence fees are scaled according to the volume of personal data processed. Detailed procedural and documentary requirements apply at each tier. All entities processing personal data must obtain the appropriate licence before commencing operations. Consent requirements are elaborated in detail: consent must be prior, informed, explicit, and freely given. The Regulations specify the format and content of privacy notices, the procedures for collecting and recording consent, and the conditions under which consent may be withdrawn. Timelines and procedures for data subject rights requests are established, covering access, rectification, erasure, restriction, and objection. Controllers must respond within prescribed periods and the Regulations specify what information must accompany responses. Cross-border transfer mechanisms are set out, including required contractual safeguards for transfers to jurisdictions without adequate protection and the PDPC approval process. Entities meeting specified thresholds must appoint a Data Protection Officer, and the Regulations specify the qualifications, duties, and registration requirements for DPOs. The 72-hour breach notification procedure is detailed, including the required content of notifications to the PDPC and the conditions triggering further notification to affected data subjects.

1. 1Activates the full operational requirements of Egypt's Personal Data Protection Law No. 151 of 2020, issued on 1 November 2025 with a one-year compliance transition period ending October 2026.
2. 2Establishes a tiered licensing regime for personal data processing, with differentiated licence types, time-limited permits, and volume-based fee scaling based on the nature and volume of data processed.
3. 3Elaborates consent requirements, specifying that consent must be prior, informed, explicit, and freely given, and setting out the format and recording requirements for valid consent.
4. 4Sets out detailed timelines and procedures for data subject rights requests, including access, rectification, erasure, restriction of processing, and objection.
5. 5Prescribes cross-border data transfer mechanisms, including contractual safeguards for transfers to non-adequate jurisdictions and the process for PDPC approval.
6. 6Establishes the threshold and requirements for appointing a Data Protection Officer, including qualifications, duties, and registration with the PDPC.
7. 7Details the 72-hour breach notification procedure to the PDPC and the conditions under which affected data subjects must also be notified.
8. 8Provides practical guidance on Records of Processing Activities (ROPA) requirements and the content of mandatory privacy notices.