Insights

Reading the regulation, so you don't have to.

Short, practical notes on Egypt's Personal Data Protection Law, cross-border transfers, and what an outsourced DPO is actually good for — updated as the framework matures.

September 2026·Regulation

Egypt's PDPL: What the 2025 Executive Regulations Actually Change

Law 151/2020 finally has an operating body. The Executive Regulations, issued under Minister of Telecommunications Decree No. 816 of 2025, establish the Personal Data Protection Center as supervisor, open a compliance runway intoend of October 2026, and set concrete rules: Arabic-language consent, a 72-hour breach notice to the PDPC, three working days to notify affected individuals, and PDPC approval for many cross-border transfers. Penalties range from roughly EGP 200,000 to EGP 5,000,000 for the most serious violations.

September 2026·Practice

Is an Outsourced DPO Right for You?

In-house hires bring institutional memory but rarely the breadth an outsourced DPO builds across multiple sectors — and a full-time role carries salary, training, and continuity costs that don't scale down when your data landscape is modest. Outsourcing trades some of that institutional presence for independence, faster access to cross-sector precedent, and a cost model that tracks the actual scope of work.

September 2026·Checklist

Six Questions Before Your Next Cross-Border Data Transfer

Before personal data leaves Egypt: does the receiving country meet an adequacy standard the PDPC recognizes, or do you need PDPC approval directly? Is consent explicit and specific to this transfer? Do your contracts with the receiving party include real data-protection safeguards, not boilerplate? Have you assessed the vendor's own security posture? Is the transfer necessary, or just convenient? And who signs off before it happens?

Have a question these don't answer?

Most first conversations start with something more specific than a blog post can cover.

Get in touch