Your app processes Egyptian user data, and the grace period is over

Egypt passed its first data protection law, No. 151 of 2020, back in 2020, and then did what many expected: almost nothing with it for five years. That changed fast. The Executive Regulations issued by Prime Ministerial Decree 816 were published November 1, 2025, giving every covered entity one year to reconcile its status with the new framework. The Personal Data Protection Centre's electronic portal went live in October 2026. The grace window expired at the start of this month (lawyers argue whether the date is October 31 or November 1; plan as though it were the earlier one), and PDPC officials confirmed enforcement began days later. If your app holds Egyptian users' data, the paper era is over.

The part that is not GDPR

The write-ups call the PDPL "Egypt's GDPR." The headline divergence is bigger than that framing suggests: Egypt runs a licensing regime. Processing personal data at all requires a license or permit from the PDPC. Licenses run three years with fees tiered by record volume (free under 100,000 records, rising to an EGP 666,666 annual cap above 5 million, halved if you are only a controller or only a processor); permits are shorter-term and priced as a fraction of the main license. On top of that sit supplementary permits: cross-border transfers, direct electronic marketing, and even CCTV surveillance each need their own. The Center has 90 working days to decide a complete application, and silence counts as refusal. The document checklist is a real one too: a registered Data Protection Officer, a record of processing activities, privacy policy, security policies, a processing-agreement template, retention policy, incident response plan, and data-subject-request procedures. GDPR compliance does not shortcut any of it; the license itself is the obligation.

The obligations that touch an app

Six duties matter specifically to software businesses:

• Breach clock. Notify the PDPC through the portal or hotline within 72 hours of becoming aware of a breach, then notify affected users within three working days of that report. A breach touching national security is reportable immediately.
• DPO with a state exam. Every legal entity needs a Data Protection Officer, and the DPO must pass a PDPC-administered exam and sit in its registry. Your CIPP/E does not substitute; one qualified DPO can serve several entities with approval.
• Consent, approved. Consent is the default basis for collection, and where you rely on it the mechanism itself must be PDPC-approved as a license precondition.
• Sensitive data. Children's data is sensitive per se (guardian consent under 15), alongside health, biometric, genetic, financial, religious, political, and criminal-record data. License plus written consent.
• Marketing. Promotional email or SMS to users needs its own e-marketing license with a Center-approved unsubscribe path.
• User rights with a fee wrinkle. Access, rectification, erasure, and objection rights exist, but the controller can charge a PDPC-fixed fee of up to EGP 20,000 per rights request.

The cross-border trap

This is where the PDPL is genuinely stricter than GDPR. Moving personal data out of Egypt requires a triple lock: the destination must offer protection "not below" Egypt's level, you need a PDPC license naming the destination countries, and the data subject's consent. There are no standard contractual clauses and no published adequacy list, so every new destination is its own administrative application with no published track record to price the odds against. For an app on Supabase in Frankfurt or AWS in Ireland, the honest reading is that a transfer permit belongs in the filing, which is the kind of thing nobody budgeted.

If you are outside Egypt

The extraterritorial reach is the law's murkiest corner. The provision applying the law abroad is framed around offences and offenders rather than GDPR-style targeting, but the practice consensus is broad: entities outside Egypt that process data of people in Egypt should comply. The regulations settle part of it operationally: the portal authenticates through Digital Egypt credentials tied to an Egyptian National ID, and entities outside Egypt that target people or activities in Egypt must appoint and register a local representative, subject to the same licensing. For foreign apps with Egyptian users, the practical answer is a local rep, not a debate about scope.

The cost of ignoring it

PDPL penalties are criminal, not administrative. Processing without consent or legal basis draws EGP 100,000 to 1,000,000 fines; sensitive-data violations and unauthorized cross-border transfers carry a minimum three-month prison term and fines up to 5,000,000; operating without the required license sits in the same 500,000 to 5,000,000 band, doubled on repeat. Managers who knew of the violation are personally liable, and cases go to the Economic Courts. The PDPC also holds non-criminal levers: warnings, license suspension, and public naming.

Our position

File now, and file as a license applicant, not a privacy-policy updater. The PDPL is not a documentation exercise bolted onto GDPR compliance; it is a permission system where processing is the regulated act. We are biased, obviously: this is our home jurisdiction, and our own filings are in the same queue as everyone else's, so the boring advice is not theoretical here. Start the DPO exam process and the ROPA today rather than waiting for the fee schedule to clarify, because the portal queues will not get shorter. For our clients outside Egypt, the pattern is the local representative plus a domestic hosting read: if the data can lawfully stay in-country, the cross-border permit problem mostly evaporates. And treat the unclear edges, the extraterritorial text and the empty adequacy list, as risks to plan around rather than loopholes to drive through.

The takeaway

The filing order that works:

• Register the DPO and book the PDPC exam first; it gates the application.
• Build the ROPA, retention policy, incident response plan, and request procedures as one document set.
• Map your transfers before naming destination countries: hosting, processors, analytics providers.
• File the main license, then the supplementary permits your features trigger (marketing email is its own permit).
• Outside Egypt: appoint the registered local representative before touching the portal, because the login needs a national ID.

This is the compliance ground we work on every day in our custom software builds from Alexandria, and the filings our own products like CashTaq are working through. If your app has Egyptian users and no filings yet, send us the store link.

← the journal