We act for foreign investors, multinationals, banks, technology companies and family-owned groups with operations, staff or customers in Egypt. Some come to us with nothing in place. Others already run a GDPR programme at group level and want to know what Egypt adds on top of it. Usually it’s more than they expect.
We advise and represent clients across the full compliance cycle, including:
- Data protection gap assessments
- PDPL licence and permit applications
- Cross-border data transfer permits
- Local representative appointment
- Data Protection Officer arrangements
- Privacy notices and consent mechanisms
- Arabic-language consent wording
- Records of processing and electronic registers
- Data processing agreements
- Cloud and outsourcing contracts
- Employee and HR data compliance
- Sensitive and children’s data processing
- Direct electronic marketing permits
- CCTV and workplace monitoring
- Data breach notification and response
- Dealing with the PDPC and inspections
- Group policy localisation for Egypt
- Data protection training for local teams
Timing is the practical issue this year. The Centre’s electronic licensing portal came online only in 2026, and licence applications are reviewed by technical teams rather than rubber-stamped, so the queue ahead of the enforcement date is not something to plan around late.
If you process personal data in Egypt, or about people in Egypt, contact Youssry Saleh & Partners to review where you stand and what has to be filed.
Frequently Asked Questions
Yes. Law No. 151 of 2020 on the Protection of Personal Data, with Executive Regulations issued in November 2025. The law existed for years before that, but it wasn’t workable in practice until the regulations came out.
It can. The law has extraterritorial reach and may cover foreign entities processing personal data relating to individuals located in Egypt. Without a branch here, you would generally need a registered local representative.
No. It helps, and a lot of the documentation carries over. But licensing, the local representative requirement and the Arabic consent expectations have no GDPR equivalent, so a group programme still needs an Egypt layer.
Yes, with permission. A separate licence or permit is required, and the destination country is assessed for adequacy. Cloud storage abroad counts as a transfer.
Fines, and for some offences imprisonment. Failing to appoint a registered DPO alone carries a fine in the range of EGP 200,000 to EGP 2,000,000. Exposure depends on the violation and the circumstances.
