In brief
- We are currently less than one month away from the expiration of the grace period provided under the provisions of the Personal Data Protection Law No. 151 of 2020 (PDPL). By 31 October 2026, all data users subject to the PDPL are required to reconcile their positions and be in full compliance with the provisions of the PDPL.
- Earlier this month, the Personal Data Protection Center (PDPC) officially launched its electronic portal. This portal will receive and process applications for accreditation, licenses, and permits.
- All organizations subject to the PDPL can access the portal, including foreign controllers and processors. However, creating a profile and submitting applications require authentication through the Egyptian government’s Digital Egypt platform – noting that Digital Egypt credentials are linked to an Egyptian National ID.
- This authentication requirement confirms the need for foreign controllers and processors to appoint a duly authorized local representative. The local representative can authenticate through Digital Egypt with their own credentials and can submit the necessary applications on behalf the foreign data processor/controller by virtue of their authorization.
- The portal also publishes a set of guidelines and frameworks, further outlining the PDPC’s key requirements for data controllers and processors. For a detailed analysis of the PDPL’s compliance requirements, please see our client alert issued earlier this year.
- As a reminder, on 1 November 2025, the Minister of Telecommunications and Information Technology issued Decree No. 816 of 2025 regarding the issuance of the Executive Regulations of the PDPL (“PDPL Executive Regulations”). Pursuant to the provisions of the PDPL, the grace period for compliance is one year starting from the date of the publication of the PDPL Executive Regulations. This grace period is therefore set to expire on 31 October 2026.
Mohamed Aon, Associate, has contributed to this legal update.
