Compliance ยท ELArchive
Egypt's Data Protection Law Is Now Enforceable: What Your Records Must Be Able to Prove
The grace period is over
On 1 November 2026, the grace period under Egypt's Personal Data Protection Law runs out, and the Personal Data Protection Center (PDPC) gains the power to inspect your institution, license your processing and penalize what it finds.
Most compliance teams have spent this year on policies and privacy notices. That work matters, but an inspector won't stop at the policy. They'll ask what personal data you hold, why you hold it, who opened it last month and when you plan to destroy it.
The answers sit in your records. If half of those records are in storage rooms, shared drives and departmental inboxes, you'll struggle to give them, and under this law, struggling comes at a price.
What is Egypt's PDPL?
Egypt's Personal Data Protection Law (Law No. 151 of 2020) governs how organizations collect, process, store and transfer personal data about individuals in Egypt. Its Executive Regulations, issued by Ministerial Decree No. 816 of 2025, turned the law's principles into enforceable rules. The PDPC is the supervisory authority responsible for licensing, monitoring and enforcement.
The law applies whether processing happens inside or outside Egypt, as long as it relates to individuals located in Egypt.
Five things your records must now prove
The Executive Regulations spell out exactly what the regulator expects to see. Here's what each requirement means for the people who manage your records.
| Requirement | What the regulator expects | What it means for your records |
|---|---|---|
| Electronic register | A secure register of consent records, data categories, processing scope, retention schedules and security measures, ready for PDPC inspection | Every file holding personal data must be classified and traceable |
| Data subject rights | Individuals can access, correct, erase, restrict or object to processing, and withdraw consent. Every request and action must be logged | You must find one person's data across the institution, fast |
| Retention limits | Data is kept only for a defined, limited period tied to its purpose | Destruction must be scheduled and documented, not left to chance |
| Breach notification | The PDPC must be notified within 72 hours of a breach; affected individuals within three days after that | You need to know exactly which records were exposed and who accessed them |
| Licensing and DPOs | Controllers and processors need PDPC licences or permits, and a registered Data Protection Officer | Your DPO needs a single, reliable view of where personal data lives |
The penalties go well beyond fines. Some violations carry criminal sanctions, which is why legal advisors describe Egypt's law as one of the strictest data protection regimes anywhere.
Where paper and shared drives fail
Ask any records manager where compliance gets hard, and they'll point to the filing room before the policy manual.
- Personal data hides in contracts, HR files, customer forms and old correspondence. Nobody can build a register from documents that were never indexed.
- When someone pulls a folder from a cabinet, nothing records who took it or what they read.
- Retention usually runs on memory, so files outlive their purpose and every extra year adds exposure.
- A data subject request that should take an afternoon turns into a two-week search across departments.
- And if a breach happens, 72 hours passes quickly when you can't say which records were exposed.
Inspection-readiness checklist
Run your team through these seven questions. Every "no" or "not sure" shows you where to start.
- Do we know every document type that holds personal data?
- Is each one classified by data category and processing purpose?
- Does each have a defined retention period and a destruction process?
- Can we retrieve all records about one individual within days, not weeks?
- Can we show who accessed a record, and when?
- Is our paper backlog digitized and indexed, or still in storage rooms?
- Does our Data Protection Officer have one view of where personal data lives?
How ELArchive helps you answer the inspector
ELArchive is the digital archiving platform we've had in production since 2008. We build every deployment around the way the institution actually works, with its own document types, approval rules and people, so the archive fits your operation from day one.
- Every record enters the archive already classified by your own document types and fields, so the register the PDPC expects grows as your team works.
- Our Backlog Scanning team digitizes and indexes the paper you already have, including the boxes nobody has opened in years.
- When a data subject request comes in, your team searches one archive instead of chasing files across departments.
- Permissions decide who can open which records, and access is logged, which is exactly what you need when you have to scope a breach.
- Retention periods sit on each document type, so files are destroyed on schedule and the destruction leaves a record behind it.
We've spent 25 years building institutional platforms for banks, ministries, universities and large enterprises. More than 200 of our deployments are live today across 9 countries.
Frequently asked questions
When does Egypt's Personal Data Protection Law become enforceable?
The one-year grace period following the Executive Regulations ends on 1 November 2026. After that, organizations that haven't regularized their processing face penalties.
Who does Egypt's PDPL apply to?
Any person or organization processing personal data of individuals located in Egypt, whether the processing happens inside or outside the country.
Who enforces the PDPL?
The Personal Data Protection Center (PDPC), which handles licensing, monitoring, inspections and enforcement.
What are the penalties for non-compliance?
Financial penalties and, for certain violations, criminal sanctions.
How quickly must a data breach be reported?
To the PDPC within 72 hours of becoming aware of it, and to affected individuals within three days of notifying the PDPC.
Do we need a Data Protection Officer?
The Executive Regulations formalize the appointment and registration of DPOs. Check the criteria that apply to your organization with your legal advisor.
Does the law cover paper records?
The law governs personal data, not formats. Paper files holding personal data still need classification, retention limits and controlled access.
How long can we keep personal data?
Only for a defined period linked to the purpose it was collected for. Each data type needs its own retention schedule.
How does digital archiving help with PDPL compliance?
A digital archive indexes records, controls and logs access, and applies retention rules, giving you the evidence an inspection or data subject request requires.
Where should we start if our records are mostly on paper?
With an inventory of document types that hold personal data, followed by digitizing the backlog so it can be classified and searched.
Get inspection-ready
The grace period is ending, but you don't have to start from zero.
Book an ELArchive consultation and our team will review your records against the PDPL requirements, show you where the gaps are and plan how to close them.