Egypt Personal Data Protection Law (Law No. 151 of 2020)
Egypt's first comprehensive personal data protection law. Law No. 151 of 2020 promulgates the annexed Personal Data Protection Law (14 chapters, 49 articles) governing the electronic processing of personal data of natural persons by holders, controllers and processors, establishing the Personal Data Protection Centre, a licensing/permit regime, data subject rights, cross-border transfer controls, breach notification, and criminal/administrative penalties. Ratified 13 July 2020; effective from 15 October 2020.
Egypt Personal Data Protection Law (Law No. 151 of 2020) is a compliance framework from Egypt (with extraterritorial reach to processing of Egyptians' and Egyptian residents' data) with 8 domains and 42 controls that map to 1 other frameworks. The largest domains are Executive Regulations (MCIT Decree 816 of 2025): delegated duties – Egypt Personal Data Protection Law (Law No. 151 of 2020) (18 controls), Controller and processor obligations (Articles 4, 5, 7, 10) – Egypt Personal Data Protection Law (Law No. 151 of 2020) (9 controls), Rights of the data subject and conditions of processing (Articles 2, 3, 6, 32, 33) – Egypt Personal Data Protection Law (Law No. 151 of 2020) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (8)
Controller and processor obligations (Articles 4, 5, 7, 10) – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.10 | Art.10 Procedure for disclosure requests |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.4.1-4 | Art.4.1-4 Controller: lawful sourcing, adequacy, processing method and purpose |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.4.10-12 | Art.4.10-12 Controller: licence or permit, Egyptian representative and demonstrable compliance |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.4.5-6 | Art.4.5-6 Controller: no unlawful disclosure and technical and organisational security |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.4.7-9 | Art.4.7-9 Controller: deletion, correction and the record of personal data |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.5.1-5 | Art.5.1-5 Processor: instructions, purpose, period, deletion and no unlawful disclosure |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.5.6-8 | Art.5.6-8 Processor: no processing beyond the controller's purpose, security and no harm |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.5.9-12 | Art.5.9-12 Processor: record of processing activities, demonstrable compliance, licence and representative |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.7 | Art.7 Breach notification: the Centre within 72 hours and the data subject within three working days |
Cross-border transfer (Articles 14 to 16) – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.14 | Art.14 Cross-border transfer only to adequate protection and under licence or permit |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.15 | Art.15 Transfer with explicit consent below the protection level |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.16 | Art.16 Making data available to a controller or processor abroad under licence |
Data protection officer (Articles 8, 9, 13) – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.13 | Art.13 DPO security duties for sensitive personal data |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.8 | Art.8 Appointment and registration of a data protection officer |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.9 | Art.9 Duties of the data protection officer |
Direct electronic marketing (Articles 17, 18) – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.17 | Art.17 Conditions for direct electronic marketing |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.18 | Art.18 Duties of the sender: defined purpose, no disclosure of contacts, three-year consent records |
Executive Regulations (MCIT Decree 816 of 2025): delegated duties – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.10-11 | Reg.10-11 Replacing a DPO on fifteen days' notice, suspension and one officer for several entities |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.12 | Reg.12 DPO duties under the Regulations: annual privacy report, monitoring of requests and complaints, no conflicting assignments |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.14 | Reg.14 Sensitive data controls: licence, explicit written consent, necessity, Centre security standards, no profiling of children and secure records |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.15 | Reg.15 Children's data: explicit written guardian consent under 15 and guardian consent from 15 to 18 |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.16 | Reg.16 Cross-border transfer controls: licence per adequacy, consent, protective technologies and named destination countries |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.17 | Reg.17 Making data available to a controller or processor abroad: complementary activity and equal protection |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.18 | Reg.18 Direct electronic marketing rules: marketing licence, explicit consent, erasure on withdrawal or expiry, first-contact disclosures, intermediary duties and records |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.2 | Reg.2 Collection controls: licence, informed consent, Centre-approved mechanisms, retention, confidentiality and the consent record |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.21-22 | Reg.21-22 Conditions for a controller or processor licence or permit |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.24-27 | Reg.24-27 Cross-border transfer licence or permit: conditions, procedure, ninety working days and fees |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.28-30 | Reg.28-30 Direct electronic marketing licence: categories, fees and conditions |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.3 | Reg.3 Controller controls: accuracy checks, deletion with notice, a Centre-approved rights mechanism, the Egyptian representative, inspector access and records of requests |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.31 | Reg.31 Visual surveillance in public places: licence, signage, no transfer abroad, no facial recognition without consent, confidentiality and security |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.35 | Reg.35 Data and documents for licence and permit applications by legal and natural persons |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.39-40 | Reg.39-40 Amendment when record volumes grow, associations' licences and renewal deadlines |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.4 | Reg.4 Processor controls: Centre-approved processing mechanism, handler confidentiality, representative, the statistical exception, AI training and processing records |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.5 | Reg.5 Breach notification through the portal within 72 hours of awareness, with a secure log, and data subjects within three working days |
| egypt-personal-data-protection-law-law-no-151-of-2020::Reg.7-9 | Reg.7-9 DPO registration: conditions, documents, the officer's code and the thirty-working-day decision |
Licences, permits and the Centre's supervision (Article 27 and the licensing regime) – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.27 | Art.27 Applying for licences, permits and certifications |
Rights of the data subject and conditions of processing (Articles 2, 3, 6, 32, 33) – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.2 | Art.2 Explicit consent and the data subject's rights |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.3 | Art.3 Conditions for lawful collection, processing and retention |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.32 | Art.32 Requests answered within six working days |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.33 | Art.33 Execution of the Centre's complaint decisions within seven working days |
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.6 | Art.6 Lawful bases for electronic processing |
Sensitive personal data and children (Article 12) – Egypt Personal Data Protection Law (Law No. 151 of 2020)
| Code | Title |
|---|---|
| egypt-personal-data-protection-law-law-no-151-of-2020::Art.12 | Art.12 Sensitive personal data and children's data |
Maps to 1 other framework
Coverage is not the same as your position
This page shows what Egypt Personal Data Protection Law (Law No. 151 of 2020) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Egypt Personal Data Protection Law (Law No. 151 of 2020) and who does it apply to?
Egypt Personal Data Protection Law (Law No. 151 of 2020) is a compliance framework from Egypt (with extraterritorial reach to processing of Egyptians' and Egyptian residents' data) with 8 domains and 42 controls. Egypt's first comprehensive personal data protection law. Law No. 151 of 2020 promulgates the annexed Personal Data Protection Law (14 chapters, 49 articles) governing the electronic processing of personal data of natural persons by holders, controllers and processors, establishing the Personal Data Protection Centre, a licensing/permit regime, data subject rights, cross-border transfer controls, breach notification, and criminal/administrative penalties. Ratified 13 July 2020; effective from 15 October 2020. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Egypt Personal Data Protection Law (Law No. 151 of 2020) actually require?
Egypt Personal Data Protection Law (Law No. 151 of 2020) has 42 controls organised across 8 domains. The largest domains are Executive Regulations (MCIT Decree 816 of 2025): delegated duties – Egypt Personal Data Protection Law (Law No. 151 of 2020) (18 controls), Controller and processor obligations (Articles 4, 5, 7, 10) – Egypt Personal Data Protection Law (Law No. 151 of 2020) (9 controls), Rights of the data subject and conditions of processing (Articles 2, 3, 6, 32, 33) – Egypt Personal Data Protection Law (Law No. 151 of 2020) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Egypt Personal Data Protection Law (Law No. 151 of 2020) do I already cover?
Egypt Personal Data Protection Law (Law No. 151 of 2020) maps to 1 other compliance frameworks. The top mapping partners are GDPR (21% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Egypt Personal Data Protection Law (Law No. 151 of 2020)?
Start your Egypt Personal Data Protection Law (Law No. 151 of 2020) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Egypt Personal Data Protection Law (Law No. 151 of 2020) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 42 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,067 frameworks.
Get Started Free →Free forever, no credit card required