Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
Réglementations › Reste du monde › Égypte
PDPL (Égypte)
Loi sur la protection des données personnelles, loi n° 151 de 2020 (Égypte)
QuandEn vigueur depuis 2020 ; règlement d’application publié en 2025
Qui en assure l’applicationCentre de protection des données personnelles (PDPC)
À qui elle s’appliqueResponsables du traitement et sous-traitants traitant les données personnelles de personnes se trouvant en Égypte.
Informer le régulateurNotifier le Centre dans un délai de 72 heures à compter de la prise de connaissance
DPO requisChaque responsable du traitement et chaque sous-traitant ayant la personnalité morale doit désigner un employé qualifié comme DPO et l’enregis…
EnregistrementLes responsables du traitement et les sous-traitants doivent obtenir des licences du Centre, dont les frais sont plafonnés à EGP 2 millions, ainsi que des autoris…
Transferts à l’étrangerLes transferts à l’étranger exigent une protection équivalente dans le pays de destination et une licence ou une autorisation du…
Délai de réponse aux demandesSix jours ouvrables pour répondre
Amende maximaleAmendes jusqu’à EGP 5 millions (environ USD 100,000) par infraction, doublées en cas de récidive
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Portée et base légale
Portée extraterritoriale
3
Covers Egyptians anywhere, non-Egyptians in Egypt, and non-Egyptians abroad where the data concerns Egyptians or residents and the act is also criminal there.Issuance Art. 2 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Base légale
3
Explicit consent is the default; other grounds are contract, legal obligation and exercising legal rights. No legitimate interests ground.Arts. 2, 6 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Consentement
2
Explicit consent for specific purposes is required; sensitive and children's data need written explicit consent.Arts. 2, 6, 12 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Executive Regulations may prescribe consent mechanics.
Données sensibles
3
Processing sensitive data requires both written explicit consent and a licence from the Personal Data Protection Center.Art. 12 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Enfants
3
Children's data is sensitive. Under 15 needs written guardian consent; for ages 15 to 18 the Center sets the consent mechanism.Art. 1; Exec. Regs Art. 15 (Decision 816/2025) · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Regulation article per translation; not confirmed against the Gazette.
Droits des personnes
Droits
2
Know and access data, withdraw consent, correct and erase, restrict processing, object, and be told of breaches.Art. 2 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. No portability or automated decision right.
Délai de réponse aux demandes
3
Six working days to respond; silence is treated as refusal.Art. 32 (per translation); Art. 10 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Article number for the six-day period unconfirmed.
Marketing
2
Electronic direct marketing requires prior consent, a clear opt-out and a Center licence; consent records kept three years.Arts. 17-18; Exec. Regs Art. 18 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Gouvernance
DPO requis
3
Every legal-entity controller and processor must appoint a qualified employee as DPO and register them with the Center.Art. 8 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Qualifications du DPO
3
DPOs must be registered with the Center, reportedly after credentials checks, a clean record and a Center-approved exam.Art. 8; Executive Regulations (Decision 816/2025) · secondary source · source ↗
Exam and category rules from secondary summaries; regulation articles not verified.
Enregistrement
3
Controllers and processors need Center licences with fees capped at EGP 2 million, plus permits for transfers, marketing and CCTV.Arts. 26-27; Executive Regulations · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Validity and tiered fees from secondary sources.
DPIA
1
No express DPIA in the Law; the DPO must run periodic assessments and audits of data protection systems.Art. 9 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. Executive Regulations DPIA provisions not confirmed.
Registres
2
Controllers must keep a dedicated record of processing, and processors a record of processing activities.Arts. 4, 5 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Conservation
2
Data may not be kept longer than the purpose requires and must be erased when the purpose ends.Arts. 3, 4 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Violations
Informer le régulateur
2
Notify the Center within 72 hours of becoming aware; national-security breaches immediately.Art. 7 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Information des personnes
3
Notify affected data subjects within three working days after notifying the Center.Art. 7 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Transferts
Transferts à l’étranger
3
Transfers abroad need equivalent protection in the destination and a licence or permit from the Center, unless a listed exception applies.Arts. 14-15 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Localisation
0
No general in-country storage mandate.Art. 14 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Application
Amende maximale
2
Fines up to EGP 5 million (about USD 100,000) per offense, doubled for repeat offenses.Arts. 41, 42, 45, 48 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached. USD value near the scale boundary.
Responsabilité pénale
3
Many violations carry imprisonment (at least 3 to 6 months); managers who knew of a violation face the same penalties.Arts. 36, 41-42, 47 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Action privée
2
Victims keep the right to claim compensation; entities are jointly liable for employees' violations.Arts. 35, 47 · secondary source · source ↗
Unofficial English translation (Andersen); official Arabic text not reached.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles