CevroEgypt: Personal Data Protection Law 151/2020 and what it requires
Personal Data Protection Law 151/2020: a law that is enacted or being phased in, with enforcement practice still maturing. Overseen by Personal Data Protection Center (Egypt).
Key requirements at a glance
| Registration with the regulator | Required |
|---|---|
| Data protection officer | Required |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Depends on thresholds or circumstances |
| Data localization | Not required |
Penalties and enforcement
Administrative and criminal penalties under the Law and its 2025 Executive Regulations.
What to know in practice
Licensing/permit-based; full compliance deadline is approximately October–November 2026 under the newly issued Executive Regulations.
How Cevro helps
- Maps Personal Data Protection Law 151/2020 to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Egypt?
Personal Data Protection Center (Egypt) oversees Personal Data Protection Law 151/2020.
Is breach notification mandatory under Personal Data Protection Law 151/2020?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Egypt restrict cross-border data transfers?
Conditionally. Transfers are restricted in some circumstances, so check whether your data flows trigger the rules before relying on them.
Do you need a data protection officer under Personal Data Protection Law 151/2020?
Yes. Appointing a data protection officer is required.
What are the penalties for non-compliance in Egypt?
Administrative and criminal penalties under the Law and its 2025 Executive Regulations.