Egypt's Personal Data Protection Law No. 151 of 2020 was issued to set, for the first time, a comprehensive legislative framework for collecting, processing, storing and transferring personal data in Egypt. The law matters to every company that collects its customers' names, phone numbers or email addresses, or its employees' data, which means almost every company, however small. The question today is no longer whether these rules apply to you, but how you prove you are applying them when asked. Many companies treat the subject as a postponed legal file, and then discover that compliance touches their daily work: registration forms, customer lists, employee files and contracts.
In this guide we offer an organized explanation of the most important points in the law: its scope, its basic concepts, data subjects' rights, the obligations of controllers and processors, and the role of the Personal Data Protection Center. At each point we show why it matters, how to apply it correctly, the mistake companies usually make, with a practical example. We close with a checklist and frequently asked questions. We deliberately avoid citing specific article numbers, because the aim is to understand the general logic of the law; the precise details should be reviewed in the official text and its executive regulations with a specialist lawyer.
Why Was the Law Issued, and Why Does It Matter to Your Company Now?
The volume of data companies collect has multiplied in a few years: apps, online stores, messaging campaigns, HR systems and signing platforms. Before the law, this data was collected and traded without clear rules: a phone number was sold within marketing lists, ID card images were kept in shared folders, and the data subject did not know who held their information or why. The law came to establish that personal data is not the absolute property of whoever collected it, and that its owner has rights that must be respected.
The law matters to your company for three practical reasons. The first is legal, because it attaches penalties to violations, including fines and sanctions that may reach those in charge. The second is commercial, because large companies and foreign entities now ask their suppliers about data protection policies before contracting. The third is reputational, because a single leak of customer data can destroy trust built over years. The common mistake here is for a small company to think it is outside the scope because it has no huge database, when in fact a spreadsheet of customer names and numbers is personal data subject to the law.
The Law's Scope: Who Does It Apply To?
The law applies to personal data processed electronically, in whole or in part, which covers most of what companies do today. This includes entities that process the data of natural persons inside Egypt, and it may extend to entities outside it when the processing concerns Egyptians or residents under the rules the law sets. What matters is to understand that the law protects the natural person, that is, the human being, not companies as legal persons. So the data of a corporate customer itself, such as its commercial register, is not its subject, but the name of its manager and his personal phone number are personal data.
There are exceptions the law sets for certain cases, such as some purely personal uses and some matters relating to judicial and security bodies under their own rules. A commercial company should not build its plan on the assumption that it is exempt; the default is that it is within scope. The right approach is to start by listing the activities in which you process people's data, then ask for each activity: what data, why do we collect it, where is it stored, and who can see it.
Example: A small distribution company thinks the law does not concern it because it deals with companies, not individuals. But on inventory it finds that it holds the phone numbers of its customers' purchasing representatives, ID images of its employees, and the footage of the warehouse's surveillance cameras. All of this is personal data, and each activity needs a basis and controls.
The Basic Concepts You Should Know
The law rests on a number of concepts that recur, and understanding them is a precondition for understanding the obligations. The following table summarizes the most important in practical language:
| Concept | Practical meaning | Example |
|---|---|---|
| Personal data | Any information that identifies a natural person or makes identifying them possible | Name, national ID number, phone, email, address, and a device's network address |
| Sensitive data | A more strongly protected category because its disclosure seriously harms its owner | Health data, biometric data such as a face print, financial data, and children's data |
| Processing | Any operation performed on the data | Collecting, recording, storing, modifying, sending and deleting |
| Controller | The entity that determines the purpose and means of processing | The company that collects its customers' data to conclude contracts |
| Processor | The entity that processes data on behalf of the controller and on its instructions | A hosting provider, an email platform or a signing platform |
| Data protection officer | A person within the entity who monitors compliance and communicates with the Center | A specialist employee or an external adviser, depending on the entity's size |
The common mistake is confusing the controller with the processor. A company that uses a cloud platform to store its customers' data remains the controller, and remains responsible to the customer and to the Center; responsibility does not shift to the platform merely because the data is stored with it. That is why there must be a contract between them that sets out the processor's obligations clearly.
The General Principles of Data Processing
The law sets general principles that govern every processing operation, and they are the reference against which any practice is measured. In summary: data must be collected for a legitimate, specific and declared purpose; it must be adequate for that purpose without excess; it must be accurate and up to date; it must not be kept longer than necessary; and it must be secured with appropriate measures. These principles seem self-evident, but applying them requires clear decisions in each activity.
The Specified Purpose Principle
It means knowing why you collect the data before you collect it, telling its owner, and not later using it for another purpose incompatible with the first. If you collected a customer's phone number to send a verification code in a contract, you may not then add it to a marketing campaign without a separate basis. The common mistake is writing a general phrase like "for business purposes" in the registration form, which specifies nothing.
The Data Minimization Principle
Collect only what you actually need. If a service contract needs only the name, email and phone number, there is no need to ask for date of birth and marital status. Every extra field is a burden: it needs protection, it increases the impact of any leak, and you may be asked about it in an inspection. The practical approach is to review all your forms and delete every field whose reason for existing you cannot explain in a single sentence.
The Retention Period Principle
Data is not kept forever. Set a period for each type linked to its reason: contracts are kept for a period sufficient to prove rights under limitation periods, rejected job applicants' records are deleted after a reasonable period, and so on. The common mistake is keeping all data indefinitely "in case it is needed," which violates the principle and multiplies the risks.
Grounds for Lawful Processing and Consent
Processing is lawful only if it rests on a ground recognized by the law. The best-known of these grounds is the data subject's consent, but it is not the only one. There is also processing necessary to perform a contract to which the data subject is a party, processing necessary to comply with a legal obligation, and others the law specifies. Understanding this variety matters, because relying on consent alone for everything puts a company in difficulty when a person withdraws their consent.
When consent is the ground, it must be explicit, free, specific and informed. That is, the person must know what they are agreeing to, and must agree by a clear positive act, not a pre-ticked box or silence. And the company must be able to prove that consent later: when it was given, on what text, and through which channel.
A suggested wording for separate marketing consent: "I agree that the company may use my phone number and email address to send offers and information about its services, and I understand that I can withdraw this consent at any time through the unsubscribe link or by contacting the company."
The common mistake is folding marketing consent into the terms of service, so the customer is forced to accept it in order to get the service itself. The right approach is for it to be separate and optional. Example: An education platform puts two checkboxes in its registration form; the first is mandatory to accept the terms and privacy policy, and the second is optional to receive offers. It keeps with each account a record of the text the user agreed to and its date.
The Data Subject's Rights
The law gives the data subject rights that a company must be able to honor within reasonable periods. The most important are the right to know what data is held about them and to access it, the right to have it corrected if it is wrong, the right to request its erasure or the restriction of its processing in the cases the law specifies, the right to withdraw consent, the right to object to processing in certain cases, and the right to be informed of any breach affecting their data.
| Right | What the person asks | How the company responds |
|---|---|---|
| Access | "What data do you hold about me?" | Gathers their data from all systems and gives them a clear copy after verifying their identity |
| Correction | "My address has changed" | Updates the data in all systems, not in a single system |
| Erasure | "Delete my data" | Deletes what does not need to be kept, and explains what must be kept by law or contract |
| Withdrawal of consent | "I don't want marketing messages" | Stops processing that is based on consent immediately |
The delicate point here is the relationship between the right of erasure and signed contracts. A customer who signed a contract and then asked for his data to be deleted does not necessarily have his contract deleted, because the company may need it to prove its rights or to meet legal obligations. The right approach is to explain this to him in writing, and delete everything else, such as marketing data. The common mistake is either ignoring the request entirely, or deleting everything including the evidence of contracts.
Example: A former employee asks for a copy of all his data. The well-organized company knows where to look: the payroll system, the employee file, the email, and the signing platform on which his contract was signed. The disorganized company spends weeks searching, and may forget an entire source.
The Obligations of the Controller and the Processor
The controller bears the greater burden, because it is the decision-maker. Its core obligations include obtaining data on a lawful basis, defining and declaring the purpose, taking appropriate security measures, keeping a record of processing operations, contracting with processors under contracts that oblige them to protect the data, appointing a data protection officer when the law requires it, and obtaining a license or permit from the Center in the cases the law requires.
The processor is obliged to work within the controller's instructions, to secure the data, not to use it for its own purposes, and to notify the controller of any breach. The contract between them is what translates these obligations into enforceable clauses.
A suggested clause in a contract with a service provider: "The service provider undertakes to process the personal data it receives from the client solely for the purpose of providing the service and in accordance with the client's written instructions, to take appropriate technical and organizational measures to protect it, to notify the client without delay of any breach affecting it, and to return or delete it upon the termination of the contract."
The common mistake is that a company contracts with dozens of providers, from hosting to messaging services, without a single clause about personal data in any of the contracts. The right approach is to prepare a list of all providers who receive personal data, and review their contracts one by one.
Sensitive Data: Stronger Protection
The law subjects sensitive data to stricter rules, because its disclosure may expose its owner to discrimination or financial or psychological harm. This category usually includes health, genetic, biometric and financial data, children's data, and some data relating to beliefs and opinions. Processing it generally requires explicit written consent, additional controls and a license from the Center.
An important point arises here for anyone who uses identity verification in contracts: the face image taken for matching against the ID card is biometric data. If you ask signatories to verify their identity, you must know who processes this data, where it is stored and for how long, and tell the signatory before starting. On Wthaiq, identity verification is carried out through a specialized external provider, and the signatory is shown what will happen before they begin, so they know that their face image and document will be used for verification.
The common mistake is to collect ID card images over WhatsApp and keep them on employees' phones, so sensitive data spreads with no control. Example: A real estate office asks every tenant for an image of his ID card on WhatsApp. After a year, every employee's phone holds hundreds of images, and an employee leaves and takes his phone with him. The alternative is to collect documents through a single secured system with defined permissions.
Cross-Border Data Transfer
The law restricts the transfer of personal data outside Egypt: it is permitted only to countries that provide a level of protection no lower than the law provides, or under controls and licenses set by the Center. This point touches every company that uses global cloud services, because servers are often outside the country. The right approach is to know where your customers' data is actually stored, to review your providers' position, and to consult a specialist on licensing requirements.
The common mistake is for a company to assume that using a well-known service means automatic compliance. A provider's fame does not replace knowing where the servers are and the legal basis for the transfer. Example: A company uses a customer relationship management system whose servers are in another country, so it needs to assess and document this transfer before being asked about it.
Data Breaches: What Do You Do When One Occurs?
The law requires notifying the Center of any breach affecting personal data within a short period that it specifies, and notifying data subjects in certain cases. So a company must have a plan ready before an incident happens, not improvise one afterward. The plan includes: who is notified internally first, how the scope of the breach is determined, who contacts the Center, and what message is sent to those affected.
- Containing the breach: stopping unauthorized access and changing passwords and keys.
- Assessing the scope: what data was affected, how many people, and how serious it is.
- Documentation: recording what happened, when it was discovered and what actions were taken.
- Notification: notifying the Center within the specified period, and notifying those affected when required.
- Remediation: fixing the root cause and reviewing controls so it does not recur.
The common mistake is concealment in the hope that nobody will find out, which multiplies liability when the matter is later discovered. Example: An employee sends a file containing the data of two hundred customers to the wrong email address. The well-organized company asks the recipient to delete it and documents that, assesses whether the matter requires notification, and then reviews its file-sending procedures.
The Role of the Personal Data Protection Center
The law created a Personal Data Protection Center to supervise its application. Among its tasks are issuing licenses and permits, setting standards and controls, receiving and investigating complaints, and monitoring compliance. This means that a data subject who feels their right has been violated has a body to complain to, and that a company may be asked about its practices at any time.
In practice, a company should follow the decisions and controls issued by the Center, because the executive regulations and regulatory decisions set many of the procedural details, such as types of licenses and their durations. The common mistake is to build a plan on an outdated reading or on a general article without referring to the latest issued.
How Does the Law Affect Electronic Contracts?
Contracts are among the documents richest in personal data: full name, national ID number, address, phone, email, and sometimes financial data. When contracts move to electronic form, a company needs a platform that lets it control who sees what, keep a clear record of what happened to each contract, and avoid scattering data across email and phones.
Wthaiq helps in this area: the contract is sent to the signatory by a private link, the verification code is sent to their email or WhatsApp, an audit trail is kept showing when the contract was opened and when it was signed, and team members' permissions are set so that not every employee sees every contract. This does not mean the platform spares the company its own policy: the company remains the responsible controller, but the platform makes applying the policy easier and clearer.
A Practical Plan to Start in Your Company
- Inventory: Prepare a list of every activity in which personal data is processed, its source, where it is stored, and who can see it.
- Legal basis: Determine each activity's basis: contract, legal obligation or consent.
- Minimization: Delete from forms every field you do not need.
- Privacy policy: Write a clear policy in plain language and publish it.
- Provider contracts: Add data protection clauses to every contract with a processor.
- Permissions: Limit access to those who need it.
- Retention periods: Set a period for each type of data and apply deletion.
- Breach plan: Write it and train the team on it.
- The officer: Appoint someone to follow the file and communicate with the Center.
Quick Checklist
- Do we know all the places where customer and employee data is stored?
- Does each type of data have a written purpose and legal basis?
- Is marketing consent separate, optional and recorded?
- Can we respond to an access request within a reasonable period?
- Do provider contracts include data protection clauses?
- Is sensitive data confined to a secured system with permissions?
- Do we know where our data is stored geographically?
- Do we have a written plan for handling a breach?
Frequently Asked Questions
Does the law apply to small companies?
Yes. The criterion is processing the data of natural persons, not the company's size. Some procedural requirements may differ according to the scale and nature of processing, but the general principles apply to everyone.
Is consent required for every processing activity?
No. Consent is one of the lawful grounds, and there are other grounds such as performing a contract and complying with a legal obligation. What matters is to determine the right ground for each activity.
Can a customer ask to delete his signed contract?
He may request erasure, but the company may keep the contract if it is needed to prove its rights or to meet a legal obligation, explaining that to him and deleting other unnecessary data.
Is the face image in identity verification sensitive data?
The face image used for matching counts as biometric data, one of the categories the law gives stronger protection, so it needs clear notice and appropriate controls.
Does using a cloud platform transfer responsibility to it?
No. The company remains a responsible controller, and the platform is a processor working on its behalf, and the contract between them must set out the protection obligations.
Conclusion
The Personal Data Protection Law is not a file you complete once and forget, but a way of working that touches every form, every contract and every provider. A company that starts with inventory, minimization and documentation covers most of the way. If your contracts are a large part of your data, start by organizing them in one place with controlled permissions and a clear record. Try Wthaiq to send, sign and store your contracts with a complete audit trail.
This article is for general awareness and does not constitute legal advice.