PDPL Compliance in Egypt: What Changes on October 31 | Blog Article

On October 31, 2026, the grace period under Egypt’s Personal Data Protection Law (PDPL) ends. By that date, every organization the law applies to is expected to be in full compliance. PDPL compliance is now a question of days, not months.

Law No. 151 of 2020 is Egypt’s data protection law. It sets rules for how organizations collect, use, store and share personal data, meaning any information that identifies a person, such as a name, ID number, voice or image. It also gives individuals rights over their data, and created a regulator, the Personal Data Protection Center (PDPC), to enforce it.

The law itself is not new. It was published in July 2020 and took effect that October. What set the compliance clock running was the PDPL Executive Regulations, issued under Decree No. 816 of 2025 on November 1, 2025. Their publication started a one year grace period, and that year is now ending.

For compliance teams, much of the work sits with IT, legal and data protection specialists. But one system deserves particular attention: the whistleblowing or reporting channel. It can hold some of the most sensitive personal data an organization processes, about the people who raise concerns, the people named in them, and anyone who witnessed what happened. This article covers who the PDPL applies to, what it requires, and the questions compliance teams should ask about their reporting channel before the deadline. For the wider picture of how Egypt’s rules are changing, see our guide to compliance in Egypt in 2026 .

What changes on October 31

Until now, the Personal Data Protection Center has not used its full enforcement powers because of the grace period. According to Egyptian law firm Soliman, Hashish & Partners, a PDPC panel indicated that after the grace period, organizations will be expected to demonstrate substantive, good faith compliance.

Early in October, the PDPC launched an online portal for applications for licenses, permits and accreditation. Applications require authentication through the government’s Digital Egypt platform, which is linked to an Egyptian national ID. As Baker McKenzie notes, this means foreign companies will in practice need an authorized local representative who can apply on their behalf.

Applications also take time. According to CMS, the PDPC’s review period is 90 working days once an application is complete, so organizations that have not yet applied should not wait for the deadline.

Who the PDPL applies to

The PDPL protects personal data about individuals that is processed electronically, in whole or in part. Its obligations fall on three types of party:

Controllers, who decide how and why personal data is processed. An organization running its own reporting channel is likely to be the controller of the reports it receives.
Processors, who process personal data on a controller’s behalf, such as a third party platform provider.
Holders, who possess and keep personal data in any form.

In practice, that covers most organizations that handle the personal data of employees, customers or other individuals in Egypt electronically. Baker McKenzie advises that all entities with a local presence in Egypt, and foreign entities handling personal data relating to individuals in Egypt, should evaluate how the law applies to them. Examples include:

employers of every kind, for the personal data of their staff;
retailers, FMCG and ecommerce companies, for customer and loyalty program data;
hospitals and healthcare providers, for patient data, which the law treats as sensitive;
schools, for student data, which includes children’s data;
insurers and other nonbank financial firms supervised by the Financial Regulatory Authority rather than the Central Bank;
manufacturers and logistics companies, for employee, supplier and contractor data; and
foreign companies with customers or employees in Egypt.

Controllers and processors based outside Egypt must appoint a representative in Egypt. The law’s offences can also reach beyond Egypt’s borders: they can apply to Egyptian nationals anywhere, to foreign nationals living in Egypt, and to foreign nationals abroad where the act is also an offence in that country and the data relates to Egyptians or residents of Egypt.

The law sets out six exclusions. It does not apply to personal data:

kept by individuals and processed for personal use;
processed for official statistics or to apply a legal provision;
processed solely for media purposes, provided it is accurate and not used for anything else;
relating to judicial enforcement records, investigations and court proceedings;
held by national security authorities; or
held by the Central Bank of Egypt and the entities it supervises, except money transfer and foreign exchange companies.

Two of these are worth reading carefully. The exclusion for investigations refers to judicial records and court proceedings, so organizations should not assume it covers their own internal investigations without legal advice. The Central Bank exclusion means most banks follow the Central Bank’s own rules on personal data, alongside the strict confidentiality duties in the Banking Law. We cover those in our article on what Law 194 of 2020 means for whistleblowing in Egyptian banks .

The core obligations for PDPL compliance

The law and its Executive Regulations set out detailed requirements. The ones most relevant to compliance teams are:

Licenses and permits. Controllers and processors must obtain a license or permit from the PDPC. Specific licenses or permits apply to sensitive personal data, cross border transfers, electronic direct marketing and visual surveillance in public places.
A Data Protection Officer. Under the law, organizations that act as controllers or processors must appoint a DPO from within their own organization, register them with the PDPC and announce the appointment publicly. The Executive Regulations set out the details. The DPO oversees compliance, handles requests from individuals and is the main contact for the PDPC.
Sensitive personal data. Beyond a license, processing sensitive personal data requires the express written consent of the individual, except where the law authorizes otherwise.
Breach notification. A breach must be reported to the PDPC within 72 hours of becoming aware of it, or immediately if it concerns national security. Affected individuals must then be notified within three working days of that report.
Cross border transfers. Personal data can only be transferred, stored or shared outside Egypt with a license or permit from the PDPC, and where the destination offers a level of protection no lower than Egypt’s. Limited exceptions apply with the individual’s express consent. The law defines cross border movement broadly, including making data available, storing it or processing it outside Egypt.
Requests from individuals. Individuals have rights to access, correct and erase their personal data, among others, and organizations must respond to requests within six working days.
Retention. Personal data must not be kept longer than needed for its purpose. After that, it must be erased, or kept only in a form that no longer identifies the person.

The law sets fines by type of violation. Examples include:

processing or disclosing personal data without consent or legal authorization: EGP 100,000 to 1 million;
failing to meet controller or processor duties, including breach notification: EGP 300,000 to 3 million;
failing to appoint and register a DPO: EGP 200,000 to 2 million;
processing sensitive personal data without consent or legal authorization, breaching the cross border rules, or breaching the licensing rules: EGP 500,000 to 5 million, with imprisonment of at least three months also possible for the first two.

Managers can be held personally liable where they knew of a violation and their own failure contributed to it, and penalties double for repeat offences.

Whistleblowing and data protection: why reporting channels need particular attention

If your organization is covered by the PDPL, your reporting channel is covered too. It is not a separate category under the law, but it is one of the harder places to comply, for three reasons:

Reports can contain sensitive data. A fraud report may include financial data, and a harassment or safety report may include health information. Sensitive data requires a license and express written consent unless the law authorizes otherwise, and carries among the highest penalties.
The content is unpredictable. Reports are written in people’s own words and can include attachments, so safeguards are best set for the most sensitive report the channel could receive.
Reports often travel. Group compliance teams, external investigators or a third party platform can mean data is accessed or stored outside Egypt, which the law treats as cross border movement.

Anonymous reporting reduces the personal data held about the reporter, but not about the people named or witnesses. In every case, the law requires controllers to protect personal data and keep it confidential, so access to reports should be limited to the people who need it.

Questions to review before the deadline

These questions are a starting point for a conversation between compliance, legal and your DPO. Some have clear answers in the law. Others, particularly where data protection and whistleblower confidentiality meet, need advice specific to your organization.

What personal data does the reporting channel actually hold? Map it for each group: the people who report, the people named in reports, and witnesses. Include free text and attachments, not just form fields.
Does it involve sensitive personal data, and is the right license in place? If reports routinely include financial, health or security related information, check whether your licensing covers that processing. Ask counsel how the law’s consent requirement for sensitive data applies to reports, since the people named in them will not usually have consented.
Where is the data stored, and who can access it from outside Egypt? Under the PDPL’s broad definition, hosting reports abroad, or giving a regional or group compliance team access from another country, may count as a cross border transfer requiring approval.
How do data subject rights interact with reporter confidentiality? The PDPL gives individuals rights over their personal data, including people named in a report. Organizations must respond to requests within six working days, so how those rights are handled without exposing the person who raised the concern is a question to settle with counsel before a request arrives.
How long are reports kept, and why? Set a retention period linked to the purpose of each type of record, and make sure closed cases are handled consistently.
Could you meet the breach notification deadlines? A breach affecting reports can be especially damaging, for the people involved and for trust in the channel. Check that your incident response plan covers the reporting channel and can meet the 72 hour and three working day timelines.
Is your DPO involved? The DPO should know how the reporting channel works, who has access, and where the data goes.
What do your vendor contracts say? If a third party provides your reporting channel, check that the contract covers PDPL obligations, including how the vendor will notify you of a breach.

Book a demo: see how your reporting channel holds up against these questions

Where iVoiceUp fits

iVoiceUp is built to keep reports confidential and access controlled, which supports several of the points above:

Restricted access. Role based access controls and configurable routing send each report only to the reviewers who need it. See anonymous reporting .
A full record. Every action and access event is logged in an audit trail, so compliance teams and DPOs can see who viewed or handled a report. See case management .
Protection for the reporter. Reports can be made anonymously, voice reports can be anonymized, and the Reporter AI Assistant flags details that could reveal the reporter’s identity.
Follow up without exposure. Investigators can ask questions through anonymous two way communication, and evidence can be attached to the case record, keeping it in one controlled place.
Control over AI. AI features can be enabled per workspace and workflow, so teams decide where AI is used on report data. See AI features .

These capabilities support an organization’s PDPL work, but they do not replace its own legal assessment.

To see how this works for your organization, explore iVoiceUp for compliance teams and legal teams , or book a demo .

Book a demo: keep reports confidential and access controlled before October 31

Frequently asked questions

When does Egypt’s PDPL grace period end?
On October 31, 2026. The law gives organizations one year from the issue of its Executive Regulations, which were issued on November 1, 2025.

What does PDPL compliance involve?
In short: working out whether the law applies to you, obtaining the required licenses and permits from the PDPC, appointing and registering a Data Protection Officer, meeting the rules on sensitive data, cross border transfers, retention and requests from individuals, and being able to report a breach within 72 hours. The detail is covered in the core obligations section above.

What are the PDPL Executive Regulations?
They are the regulations issued under Decree No. 816 of 2025 on November 1, 2025 that set out how Law No. 151 of 2020 works in practice, and whose publication started the one year grace period.

Does the PDPL apply to banks?
Most banks are excluded. The PDPL does not apply to personal data held by the Central Bank of Egypt and the entities it supervises, which follow the Central Bank’s rules instead. Money transfer and foreign exchange companies are the exception and remain covered.

How quickly must a data breach be reported?
To the PDPC within 72 hours of becoming aware of it, or immediately if it concerns national security. Affected individuals must then be notified within three working days of that report.

Does the PDPL apply to foreign companies?
It can. Controllers and processors based outside Egypt must appoint a representative in Egypt, and the PDPC portal’s authentication process makes a local representative a practical necessity. The law’s offences can also apply to foreign nationals abroad in certain circumstances.

Is a whistleblowing channel covered by the PDPL?
If it processes personal data electronically and your organization is within the law’s scope, it is likely to be. Because reports can contain sensitive personal data about several people, it is worth reviewing on its own.

Sources

This article is for general information only and does not constitute legal advice. It is based on publicly available sources as of October 2026, and the PDPC may issue further guidance. Organizations should seek advice from qualified Egyptian counsel on their specific obligations.

PDPL Compliance in Egypt: What Changes on October 31 and What It Means for Reporting Channels

What changes on October 31

Who the PDPL applies to

The core obligations for PDPL compliance

Whistleblowing and data protection: why reporting channels need particular attention

Questions to review before the deadline

Where iVoiceUp fits

Frequently asked questions

Sources

Continue reading

Saudi CMA Whistleblowing Rules: What Listed Companies Must Have in Place

AI Whistleblowing in the UAE: How AI Is Changing the Way Misconduct Is Reported and Investigated

Why We Built iVoiceUp Ventures

Need a practical walkthrough for your team?