Egypt’s Personal Data Protection Law sets the rules for personal data. Thiqa’s agent maps its duties to your controls and collects the evidence, so you’re ready before the deadline.
PDPL is a fixed list of duties, not a stream of new requirements. The agent maps each one onto the controls you already operate, so PDPL becomes a view of your existing controls.
7
duties in Law 151 of 2020, from a lawful basis to the licence to process. Each maps onto a control you run.
Don’t rebuild evidence for an audit. The agent collects it from your systems on each control’s own cadence, so what reaches the regulator is assembled, and ISO 27001 or PCI DSS work counts once.
PDPC
the Personal Data Protection Center. It enforces the law, licenses processors and registers their DPOs.
Nothing reaches the regulator until a named approver signs it off. If you need a data protection officer, Thiqa can appoint one to the entity, working inside your workspace.
Nov 2026
the end of the one-year compliance period the executive regulations started in November 2025.
Read the new CBE requirements, pull out every obligation and route it to the controls it applies to.
Don’t collect the same evidence twice. Thiqa attaches each PDPL artefact to every control it proves, across frameworks.
Law 151 of 2020, Egypt’s Personal Data Protection Law. It governs how personal data is collected, processed, stored and moved. The Personal Data Protection Center enforces it: it licenses the organisations that process data, registers their data protection officers and investigates complaints.
If you process personal data about people in Egypt, assume it does until your counsel says otherwise. It follows the data, not the office: an organisation with no Egyptian premises can still be inside it, and an Egyptian payroll is enough on its own.
Possibly not, and it is worth settling first rather than last. Data held by the Central Bank of Egypt and by entities under its supervision sits outside the law, with money transfer companies and exchange offices named as exceptions that stay inside it. Confirm your own status with counsel before assuming either way.
November 2026. The executive regulations took effect in November 2025 and started a one-year compliance period, so that’s the date to work back from.
Possibly, and counsel should confirm it. The law provides for one, appointed to the entity and registered with the Personal Data Protection Center. If you need one, Thiqa can provide the officer.
