Egypt

Egypt operates a comprehensive and recently activated data protection regime, documented in ATLPF with a primary law plus its implementing regulations. The Personal Data Protection Law No. 151 of 2020 (PDPL), promulgated on 15 July 2020, was Egypt's first comprehensive data protection statute, but it remained largely dormant until its Executive Regulations were issued by Prime Ministerial Decree No. 816 of 1 November 2025, which brought the regime into full operational effect and triggered a one-year compliance transition running to October 2026. The PDPL applies to anyone, Egyptian or foreign, collecting or processing personal data in Egypt or processing the data of individuals resident in Egypt, with foreign controllers required to appoint a local representative. A defining feature is the licensing model: entities processing personal data, particularly for commercial purposes, must obtain a licence from the Personal Data Protection Centre. The 2025 Executive Regulations elaborate a tiered, volume-scaled licensing structure, detail consent requirements, set data-subject-rights timelines, prescribe cross-border transfer mechanisms, establish DPO thresholds and registration, and detail the 72-hour breach-notification procedure. Prior written consent is generally required, with explicit consent for sensitive data (health, financial, biometric, genetic, children's), and criminal penalties apply for serious violations. Enforcement rests with the Personal Data Protection Centre (PDPC), operating under the Ministry of Communications and Information Technology, empowered to licence, audit, investigate, sanction, and issue binding guidelines. With two in-force instruments (the Law and its 2025 Executive Regulations) and a named regulator, Egypt is among the better-documented North African regimes; its licensing-centric design is unusual and notably more permission-based than the accountability models common elsewhere on the continent.