EgyptLaw No. 151 of 2020 Promulgating the Personal Data Protection Law
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 16 October 2020.
A comprehensive regime rule binding public and private bodies.
As of 19 September 2026.
What it requires
- Obtain the data subject's explicit consent before processing their personal data unless another lawful ground applies, such as performing a contract, complying with a legal obligation, or acting under a judicial order.
- Collect Personal Data only for legitimate, specific purposes that are transparent to the Data Subject, keep it correct, valid and secured, and do not retain it longer than that purpose needs.
- Adopt technical and regulatory procedures and the necessary standard criteria to protect Personal Data and keep it confidential, preventing any hack, damage, alteration or manipulation.
- Delete Personal Data once the purpose it was collected for is satisfied, or hold it in a form that does not allow the Data Subject to be identified, and correct any error immediately on being told of it or becoming aware of it.
- Maintain a record of the Personal Data in your possession, describing its categories, the persons it may be disclosed to, and the basis, duration, restrictions and scope of that disclosure.
- Appoint a Data Protection Officer, have the officer registered in the Center's register, and let the officer carry out the duties articles 9 and 13 set.
- Mark any electronic communication sent for direct marketing as articles 17 and 18 require, identifying its sender and giving the recipient a way to refuse it.
What it reaches
Obligation class
Consent, Security, Retention, Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Article 3 sets the conditions for collecting, processing and retaining Personal Data: it must be collected for legitimate, specific purposes transparent to the Data Subject, be correct, valid and secured, be processed legitimately and in compliance with the purposes it was collected for, and not be retained longer than that purpose needs.
Article 4 lists the Controller's obligations, among them obtaining the Data Subject's consent before receiving the data, ensuring its validity and sufficiency for the purpose, adopting technical and regulatory procedures to protect it and prevent any hack, damage, alteration or manipulation, deleting it once the purpose is satisfied or holding it in a form that no longer identifies the Data Subject, correcting an error immediately on becoming aware of it, and maintaining a record of the Personal Data in its possession.
Article 5 lists the Processor's obligations. Article 6 fixes when electronic processing is legitimate. Articles 8, 9 and 13 require a Data Protection Officer, register the officer with the Center and set the officer's duties. Article 10 governs a request to disclose Personal Data and article 11 gives digital evidence derived from Personal Data its evidentiary weight. Articles 17 and 18 govern electronic communication for direct marketing.
Article 7 of the promulgating law brings the annexed Personal Data Protection Law into force three months after the day following its publication in the Official Gazette, and the law was issued at the Presidency on 13 July 2020, so these provisions have bound since 16 October 2020.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.