EgyptEgypt Personal Data Protection Law, the Center, judicial control and penalties
Law No. 151 of 2020, Articles 19-31 and 34-44 (the Center, judicial control and penalties)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 16 October 2020.
An enforcement supervision rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Expect the Personal Data Protection Center to decide a complaint against you within thirty working days of its submission, and carry out its decision within seven working days of being told of it, telling the Center once you have.
- Expect the Center's employees, appointed by the Minister of Justice, to hold judicial control powers over violations of the Law.
- Expect the penalties to apply without prejudice to severer sanctions under any other law and without prejudice to an injured party's right to seek damages from you.
- Note that a legal representative of a juristic person is personally penalised for the person's failure to fulfil its obligations, and a Data Protection Officer for failing to carry out the article 9 duties.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Imprisonment of not less than three months (or a fine of EGP 500,000 to 5,000,000, or both) for unauthorized processing or disclosure of Sensitive Personal Data (Art. 41); imprisonment of not less than six months (or a fine of EGP 200,000 to 2,000,000, or both) for an ordinary Personal Data violation committed for material or moral benefit or to endanger the data subject (Art. 36).
Penalty structure
This band (Art. 41) applies to unauthorized collection, disclosure, processing, storage, transfer, or making available of Sensitive Personal Data without the data subject's consent. Ordinary Personal Data violations carry a lower band under Art. 36: a fine of EGP 100,000 to 1,000,000, or, where committed for material or moral benefit or to endanger the data subject, imprisonment of not less than six months plus a fine of EGP 200,000 to 2,000,000. A violation of the cross-border transfer conditions (Arts. 14-16) carries a separate band under Art. 42: imprisonment of not less than three months plus a fine.
- Rule
- Fixed only
- As of
- 2 September 2026
- Minimum
- 500,000
- Currency
- EGP
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Personal Data Protection Center (PDPC), established under the Ministry of Communications and Information Technology
What it reaches
Obligation class
Governance, Reporting, Licensing
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 19 establishes the Personal Data Protection Center as a public economic authority, and articles 20 to 25 set its board, competences, meetings, chief executive, the confidentiality its members and employees owe, and its cooperation with counterpart authorities abroad. Articles 26 to 30 govern the Licences, Permits and Certifications the Center issues, how they are applied for, amended and cancelled, and article 31 the Center's budget.
Article 33 requires the Center to decide a complaint within thirty working days of its submission, to notify the complainant and the respondent of the decision, and requires the respondent to carry it out within seven working days of that notification and tell the Center it has done so. Article 34 gives the Center's employees, appointed by the Minister of Justice, judicial control powers over violations of the Law.
Article 35 opens the penalties without prejudice to severer sanctions under any other law and without prejudice to an injured party's right to seek damages.
Article 36 penalises collecting, processing, disclosing, making available or circulating Personal Data outside the Law, article 38 a Controller's or Processor's failure to perform its articles 4, 5 and 7 obligations, article 39 the legal representatives of juristic persons who do not fulfil theirs, and article 40 a Data Protection Officer who fails to carry out the article 9 duties.
Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbothigh_risk_decisionsis_listed_company
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.