The compliance grace period under Egypt’s Personal Data Protection Law (PDPL) is scheduled to end on 31 October 2026. For businesses still preparing, the work involves identifying the applicable regulatory approvals and putting appropriate internal procedures into practice.
This concerns startups and smaller businesses as well as established companies. The assessment begins with the personal data handled and the purposes for which it is used.
Who falls within the PDPL’s scope?
The PDPL regulates personal data processed electronically, wholly or partly, subject to specific statutory exclusions.
Routine processing of employee, applicant or contractor information can bring an organization within the framework. Having no customer database, or collecting personal data only as a secondary part of the business, does not itself create an exemption.
The same applies to location and operating status. A company operating in a public or private free zone, or a special economic zone, is not exempt simply because of that status.
The statutory exclusions include personal data held by the Central Bank of Egypt and entities under its supervision, except money transfer and currency exchange companies. Other exclusions concern national security bodies and particular processing purposes, including personal use, official statistics, processing pursuant to a legal provision, judicial records and exclusively journalistic processing subject to specified conditions.
Small businesses, startups and data volume
Neither a small team nor a small database creates a general exemption from the PDPL. A startup may have relevant obligations before building a substantial customer base, including through its handling of employee or applicant information.
The general licensing schedule begins at one personal data record. Its first band, covering 1 to 100 000 records, is exempt from license fees. This is a fee exemption, not an exemption from obtaining the license or complying with the law.
Data volume can affect fees and the appropriate DPO category. It does not, by itself, determine whether a business must comply.
The nature of the information also matters. Financial data, medical information and all children’s personal data are classified as sensitive under Egyptian law. A nursery keeping children’s registration details, a payroll provider handling salaries and bank information, or a real estate agency receiving customers’ financial records may therefore handle sensitive data despite having a small team.
Other personal data remains protected too. The purpose of this assessment is to understand the requirements arising from actual operations.
Five priorities for PDPL compliance
Once a business has assessed how the PDPL applies, that understanding needs to be translated into a compliance program. The following general steps can help organize the work and identify outstanding requirements.
1. Identify the personal data and its uses
Data mapping provides a starting point. A review generally considers:
- The individuals concerned and the information collected about them.
- The purposes of collection and use.
- Storage locations, access permissions and retention periods.
- Sharing with vendors, group companies and other recipients.
- Storage, access or transfers outside Egypt.
The review should follow everyday working practices. Relevant information may appear in business systems, spreadsheets, email, messaging applications and related paper files.
These findings help identify the policies, processing records, contractual arrangements and operational changes that may be needed. They also provide information relevant to licensing and DPO selection.
2. Assess the required licenses and permits
The Personal Data Protection Center (PDPC) administers the licensing and permit framework.
Organizations should assess the general controller or processor license appropriate to their role, together with any additional authorizations required for their activities. These may concern cross-border transfers, direct electronic marketing or video surveillance in public places.
The assessment should address the categories of data handled, including sensitive personal data, and the supporting documentation required under the Executive Regulations.
3. Appoint a registered DPO in the appropriate category
For a company seeking a general controller or processor license, appointing a PDPC-registered Data Protection Officer (DPO) is a prerequisite.
Giving someone the job title “DPO” or assigning privacy responsibilities internally is not sufficient. The appointed individual must be registered with the PDPC, whether serving as an employee or through an external service provider.
The company must also ensure that the individual’s registration category covers the nature and volume of personal data handled. Selecting an appropriate category is therefore part of the appointment assessment.
The appointment needs practical support as well. Access to relevant personnel and information, clear reporting arrangements and sufficient resources help the DPO perform the statutory role.
4. Use the PDPC checklist and confirm current procedures
The compliance checklist published by the PDPC can provide a basis for assessing existing arrangements and developing a compliance program. A copy can be requested from the PDPC or from Shehata & Partners.
The checklist is guidance. It does not replace the PDPL, its Executive Regulations or other applicable requirements. It may change from time to time, so organizations should check that they are using the current version. Completing it does not, by itself, establish compliance.
Application procedures should also be checked at the time of submission. Businesses should confirm which portal functions and submission channels are available then. If technical or procedural difficulties arise, the PDPC should be contacted to clarify the available solution.
5. Document progress and maintain the program
Compliance records help an organization track its work, identify outstanding issues and explain the measures implemented.
Relevant materials may include processing records, policies, training records, application documents and regulatory correspondence. They should accurately distinguish completed measures from work still in progress.
Neither a record of compliance efforts nor a pending application replaces the required approvals.
Priorities should reflect the organization’s operations, including sensitive data, overseas transfers, vendor access and unresolved weaknesses. Businesses dealing with many consumers should also consider how complaints are received and addressed.
The end of the grace period does not end the compliance work. Policies, records, DPO arrangements and internal procedures need to remain current as the business changes.
This article provides general information as of 26 October 2026 and does not constitute legal advice. Applicable requirements depend on the organization’s activities and circumstances.
