Personal Data Protection Law No 151/2020(PDPL) Egypt cookie consent and compliance

The Personal Data Protection Law No. 151 of 2020 (PDPL) governs the collection, processing, storage, transfer, and use of personal data in Egypt. It applies to both public and private entities that handle personal data of individuals located in Egypt, regardless of whether the data processing takes place inside or outside the country.  The PDPL aims to protect individuals’ privacy rights and regulate how organizations handle personal data, establishing key principles such as transparency, consent, data minimization, and accountability in all data processing activities.

Under the PDPL, personal data refers to any information related to an identified or identifiable natural person. This includes any data that can directly or indirectly identify a person, such as:  Name, address, phone number, or email  Identification numbers such as national ID, passport, or driver’s license  Financial, health, or family data  Online identifiers (e.g., IP addresses or digital profiles)  The law distinguishes between personal data and sensitive personal data, requiring stricter protection for the latter.

Sensitive personal data includes information that, if disclosed or misused, could harm an individual or result in discrimination. Examples include:  Health condition or medical records  Genetic or biometric data  Religious or political beliefs  Criminal records  Financial data  Children’s data  The processing of sensitive personal data generally requires the explicit written consent of the data subject, except in specific cases permitted by the law (e.g., for public interest, health protection, or judicial purposes).

The Egyptian Data Protection Center (EDPC), under the Ministry of Communications and Information Technology, is the primary regulatory authority responsible for enforcing the PDPL.   The EDPC’s roles include:  Supervising and ensuring compliance with the PDPL and its executive regulations  Issuing licenses and permits for data controllers and processors  Handling complaints and investigating data breaches  Promoting awareness and providing guidance on data protection practices

Certain types of data processing are exempt from the PDPL, including:  Processing carried out by individuals for personal or household purposes  Processing necessary for national security or defense purposes  Processing for judicial, prosecutorial, or law enforcement functions  Processing for media, artistic, or literary purposes, provided freedom of expression is upheld  Processing of anonymized or aggregated statistical data  These exemptions are subject to conditions and oversight as defined by the executive regulations.

Violations of the PDPL can result in administrative fines and criminal penalties, depending on the nature and severity of the breach. Organizations that process personal data without proper consent, transfer data abroad without approval, or fail to implement adequate data security measures may face substantial fines and possible imprisonment for responsible individuals. 

For official updates, guidance, and regulatory details, visit the Ministry of Communications and Information Technology (MCIT) website or refer to the executive regulations of Law No. 151 of 2020, which outline the detailed compliance and enforcement procedures.