Law No. 151 of 2020 Promulgating the Personal Data Protection Law
Law No. 151 of 2020 Promulgating the Personal Data Protection Law
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 16 October 2020.
A comprehensive regime rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Obtain a Personal Data Protection Center license before collecting, storing, transferring, or processing any Sensitive Personal Data, including a biometric, health, genetic, financial, religious, political, or criminal-record identifier, or any data relating to a child.
- Obtain the data subject's explicit consent before processing their personal data unless another lawful ground applies, such as performing a contract, complying with a legal obligation, or acting under a judicial order.
- Obtain a parent or legal guardian's consent before processing a child's personal data, and do not condition a child's participation in a game, competition, or activity on personal data beyond what participation requires.
- Notify the Personal Data Protection Center of any personal data breach within 72 hours of discovering it, and notify immediately where the breach concerns national security.
- Obtain a Center license or permit before transferring, storing, or sharing personal data outside Egypt, unless the destination country's protection level meets or exceeds Egypt's own, or the data subject has given explicit consent.
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Imprisonment of not less than three months (or a fine of EGP 500,000 to 5,000,000, or both) for unauthorized processing or disclosure of Sensitive Personal Data (Art. 41); imprisonment of not less than six months (or a fine of EGP 200,000 to 2,000,000, or both) for an ordinary Personal Data violation committed for material or moral benefit or to endanger the data subject (Art. 36).
Penalty structure
This band (Art. 41) applies to unauthorized collection, disclosure, processing, storage, transfer, or making available of Sensitive Personal Data without the data subject's consent. Ordinary Personal Data violations carry a lower band under Art. 36: a fine of EGP 100,000 to 1,000,000, or, where committed for material or moral benefit or to endanger the data subject, imprisonment of not less than six months plus a fine of EGP 200,000 to 2,000,000. A violation of the cross-border transfer conditions (Arts. 14-16) carries a separate band under Art. 42: imprisonment of not less than three months plus a fine.
- Rule
- Fixed only
- As of
- 2 September 2026
- Minimum
- 500,000
- Currency
- EGP
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Personal Data Protection Center (PDPC), established under the Ministry of Communications and Information Technology
What it reaches
Obligation class
Consent, Data subject rights, Biometric, Breach notice, Transfer, Licensing
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Egypt's comprehensive personal-data statute. It requires a lawful basis (ordinarily the data subject's consent) for processing, imposes a licensing regime for Sensitive Personal Data (including biometric identifiers and any data relating to a child, which is always sensitive), prohibits cross-border transfer absent equivalent protection and a Center license, and requires notifying the Personal Data Protection Center of a breach within 72 hours.
Enforcement is criminal: unauthorized processing of ordinary Personal Data carries a fine of EGP 100,000 to 1,000,000, rising to imprisonment plus a fine of EGP 200,000 to 2,000,000 where done for gain or to endanger the data subject, and unauthorized processing of Sensitive Personal Data carries imprisonment plus a fine of EGP 500,000 to 5,000,000.
The Law's own Executive Regulations, needed to operationalize its licensing and consent rules, were not issued until Ministerial Decree No. 816 of 2025, more than five years after the Law itself took effect.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_voiceprocesses_biometricsserves_minors