In our earlier article, the GLA & Co team took a first look at the Executive Regulations to Egypt’s Personal Data Protection Law No. 151 of 2020 (the “PDPL“). Central to those Regulations is a one-year regularisation period, within which companies must put key compliance building blocks in place, including the appointment of a Data Protection Officer (“DPO“). With that window now about to close, this article sets out what companies need to have finalised, and why it matters.

The Deadline

The PDPL gives everyone within its scope one year from the issuance of the Executive Regulations to regularise their position. The Regulations were issued by Ministerial Decree No. 816 of 2025, published on 1 November 2025 and effective the following day. In practical terms, companies should treat early November 2026 as the deadline.

Key Priority 1: Appointing a Registered DPO

Every controller and processor must have a DPO, appointed by its legal representative and entered in the Personal Data Protection Center’s (“PDPC“) register of DPOs. To qualify for registration, a DPO must:

• hold relevant qualifications and practical experience;
• pass the PDPC’s examinations; and
• have no conviction for a crime involving dishonour or breach of trust.

The PDPC decides on registration within 30 working days of a complete application. Linked group entities may share a single DPO, subject to the PDPC’s approval. The stakes are significant: a legal representative who fails to meet these obligations faces a fine of EGP 200,000 to EGP 2 million.

Key Priority 2: Obtaining a License or Permit

Controllers and processors must also hold a PDPC license (for ongoing processing) or permit (for occasional processing). A license is valid for three years and is renewable; a permit lasts up to one year. Annual fees are tied to the number of records held: entities with up to 100,000 records are exempt, fees are capped at EGP 2 million over three years, and a controller-only or processor-only license costs half the combined fee. Crucially, the two priorities are linked, as the license application must name the DPO and attach the DPO’s contract confirming their independence. Applications are filed through the PDPC’s online portal, and the PDPC has up to 90 days to decide, with silence treated as a rejection. Breaching the licensing provisions carries fines of EGP 500,000 to EGP 5 million.

Enforcement Outlook & The PDPC’s Awareness Drive

Companies that have not regularised by the deadline should expect scrutiny. The PDPC may issue warnings and, where these go unheeded, suspend or revoke a license or permit or publicly disclose the violations. Some leniency may be extended, but it should not be assumed, given the time companies have had to comply.

Raising awareness is one of the PDPC’s statutory duties, delivered through conferences, workshops, training and publications. In line with that mandate, the PDPC has been actively encouraging companies to complete their regularisation on time. It also regularly trains and registers DPOs, and further guidance on key compliance topics is expected in the coming months.

Act Now

Time is short. DPO registration can take up to 30 working days, and a licensing decision up to 90 days. Companies that have not yet started should act now: register a DPO first, then file the license application.

The GLA & Co data privacy practice would be pleased to assess your current readiness and help you navigate the path to compliance.

Authors: Asad Ahmad, Partner and Head of Regulatory, May El-Mahdy, Senior Associate, and Khaled Al-Khashab, Senior Associate.