Egypt’s data protection law: the compliance period ends around 1 November 2026

About a month remains before the compliance period under Egypt's Personal Data Protection Law, Law 151 of 2020, comes to an end. Clinics, labs and medical centres handle patient data every day, so this month deserves an organised review.

The dates as published

• The law's executive regulations were issued by Ministerial Decree 816 of 2025.
• They took effect on 2 November 2025 and were published on 25 December 2025.
• They allow one year to comply, ending around 1 November 2026, according to the law firms CMS and Al Tamimi.

What the regulations cover

The regulations deal with the following, and each touches the work of a medical facility:

• Consent to collect and process data.
• Licences for those who process data.
• Processing records: what data you collect, why, where you keep it and who can see it.
• Notification when a data breach happens.
• Sensitive data.
• Children's data.
• Direct electronic marketing, such as promotional offers and messages.

What to expect from the data protection centre

According to a January 2026 update from Clyde & Co, the Personal Data Protection Centre is expected to accept licence applications from November, with an early focus on helping organisations comply. Fines under the law range from EGP 200,000 to EGP 5 million.

A checklist for the month ahead

1. Draw a simple map of patient data: where it comes in (front desk, website form, WhatsApp, the lab), where it is stored and who can reach it. This map is the start of your processing record.
2. Start with medical records and test results. In any medical facility, they are the first thing to review under sensitive data.
3. Review consent forms at the front desk and on your website. State each purpose clearly: treatment, appointment contact and promotional messages each get their own consent.
4. Review your promotional lists on WhatsApp, SMS and email. Keep proof of each patient's consent, and give an easy way to unsubscribe.
5. Decide how you handle children's data, especially in paediatric and dental clinics: who signs consent and what is kept.
6. Write a short breach plan: who spots it, who is told internally, who contacts the authority, and within what time.
7. Check with your lawyer whether your facility needs a licence from the centre, and prepare your papers before applications open.

A note for facilities in Saudi Arabia

The Saudi Personal Data Protection Law is being enforced. According to Clyde & Co in March 2026, SDAIA committees issued 48 violation decisions in the year to January 2026, and breaches must be reported within 72 hours. Groups working in both countries can build one data map and one breach plan, then add each country's requirements.

How to check progress

Five yes-or-no questions to review every week until the end of October:

• Do we have a written map of every point where patient data comes in?
• Does every consent form separate treatment, contact and promotion?
• What share of our promotional list has stored consent? The target is 100%.
• Is the breach plan written down, with one named person responsible?
• Have we settled the licence question with our lawyer?

This is a general reading of what law firms have published so far, and the binding detail is in the regulations themselves. Confirm it with your lawyer or the Personal Data Protection Centre. If you would like to review your website forms and promotional lists from this angle, the Naqar team can help.

Sources

• CMS: Egypt's PDPL executive regulations issued, one-year compliance countdown begins (law firm summary, no link)
• Al Tamimi: from policy to practice, Egypt issues executive regulations of the Personal Data Protection Law (law firm summary, no link)
• Clyde & Co: Egypt regulatory update on data privacy, January 2026 (law firm summary, no link)
• Clyde & Co: enforcement of the Saudi PDP Law, March 2026 (law firm summary, no link)