Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
Regulaciones › Resto del mundo › Egipto
PDPL (Egipto)
Ley de Protección de Datos Personales, Ley n.º 151 de 2020 (Egipto)
CuándoEn vigor desde 2020; Reglamento Ejecutivo emitido en 2025
Quién la aplicaCentro de Protección de Datos Personales (PDPC)
A quién se aplicaResponsables y encargados que tratan datos personales de personas en Egipto.
Informar al reguladorNotificar al Centro en un plazo de 72 horas desde que se tenga conocimiento
DPO obligatorioTodo responsable y encargado que sea persona jurídica debe designar a un empleado cualificado como DPO y regis…
RegistroLos responsables y encargados necesitan licencias del Centro con tasas de hasta EGP 2 millones, además de permi…
Transferencias al extranjeroLas transferencias al extranjero requieren una protección equivalente en el destino y una licencia o permiso de…
Plazo de solicitudesSeis días hábiles para responder
Multa máximaMultas de hasta EGP 5 millones (unos USD 100,000) por infracción, duplicadas en caso de reincidencia
43%
of Egypt's 21 requirements are already met by European Union (GDPR). Here is what PDPL (Egypt) adds, biggest gaps first.
RegistroGobernanzaBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PDPL (Egypt) adds3 Controllers and processors need Center licences with fees capped at EGP 2 million, plus permits for transfers, marketing and CCTV.
Arts. 26-27; Executive Regulations · source ↗
Base jurídicaAlcance y base jurídicaBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PDPL (Egypt) adds3 Explicit consent is the default; other grounds are contract, legal obligation and exercising legal rights. No legitimate interests ground.
Arts. 2, 6 · source ↗
DPO obligatorioGobernanzaBig gap
GDPR1 DPO required for public bodies, large-scale systematic monitoring, or large-scale special-category or criminal data processing.
PDPL (Egypt) adds3 Every legal-entity controller and processor must appoint a qualified employee as DPO and register them with the Center.
Art. 8 · source ↗
Requisitos del DPOGobernanzaBig gap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
PDPL (Egypt) adds3 DPOs must be registered with the Center, reportedly after credentials checks, a clean record and a Center-approved exam.
Art. 8; Executive Regulations (Decision 816/2025) · source ↗
Responsabilidad penalAplicación de la leyBig gap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PDPL (Egypt) adds3 Many violations carry imprisonment (at least 3 to 6 months); managers who knew of a violation face the same penalties.
Arts. 36, 41-42, 47 · source ↗
Alcance extraterritorialAlcance y base jurídicaGap
GDPR2 Applies to non-EU controllers offering goods or services to, or monitoring the behavior of, people in the EU.
PDPL (Egypt) adds3 Covers Egyptians anywhere, non-Egyptians in Egypt, and non-Egyptians abroad where the data concerns Egyptians or residents and the act is also criminal there.
Issuance Art. 2 · source ↗
Datos sensiblesAlcance y base jurídicaGap
GDPR2 Special categories (health, biometrics, religion, etc.) are prohibited unless explicit consent or another listed exception applies.
PDPL (Egypt) adds3 Processing sensitive data requires both written explicit consent and a licence from the Personal Data Protection Center.
Art. 12 · source ↗
NiñosAlcance y base jurídicaGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
PDPL (Egypt) adds3 Children's data is sensitive. Under 15 needs written guardian consent; for ages 15 to 18 the Center sets the consent mechanism.
Art. 1; Exec. Regs Art. 15 (Decision 816/2025) · source ↗
Plazo de solicitudesDerechos de las personasGap
GDPR2 Respond within one month, extendable by two further months for complex or numerous requests.
PDPL (Egypt) adds3 Six working days to respond; silence is treated as refusal.
Art. 32 (per translation); Art. 10 · source ↗
ConservaciónGobernanzaGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PDPL (Egypt) adds2 Data may not be kept longer than the purpose requires and must be erased when the purpose ends.
Arts. 3, 4 · source ↗
Informar a las personasViolaciones de datosGap
GDPR2 Notify affected individuals without undue delay when the breach is likely to result in high risk.
PDPL (Egypt) adds3 Notify affected data subjects within three working days after notifying the Center.
Art. 7 · source ↗
Transferencias al extranjeroTransferenciasGap
GDPR2 Transfers outside the EEA need an adequacy decision or appropriate safeguards (SCCs, BCRs), or a listed derogation.
PDPL (Egypt) adds3 Transfers abroad need equivalent protection in the destination and a licence or permit from the Center, unless a listed exception applies.
Arts. 14-15 · source ↗
Already covered by GDPR: Consent, Rights, Marketing, DPIA, Records, Tell the regulator, Localization, Maximum fine, Private action.
A gap means PDPL (Egypt) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales