Egypt's Personal Data Protection Law: what fintechs must do before the grace period ends

The PDPL applies to personal data that is processed electronically, in whole or in part, by anyone who holds, controls or processes it, where the data relates to natural persons (issuing law, Art. 1). "Electronic" is broad in practice: a fintech's core banking or ledger system, its customer app, its CRM, its support tooling and its analytics warehouse are all electronic processing. Paper-only records sit outside the definition, but few fintechs keep anything only on paper.

The most important scoping rule for financial services is the carve-out in Article 3(6) of the issuing law. The law does not apply to personal data held by the Central Bank of Egypt and the entities that are subject to its supervision and control, except money-transfer companies and exchange companies. Those two groups must still observe the rules the Central Bank sets for handling personal data (Art. 3(6)).

That carve-out produces three practical groups. A licensed bank, or a payment business supervised by the Central Bank, is mostly outside the PDPL and is governed by the Central Bank's rules instead. A money-transfer or exchange company is inside the Central Bank's perimeter but expressly brought back into the PDPL. Everything else, including non-bank lenders, consumer-finance and insurance businesses, credit-scoring and data platforms, wealth and investment apps, and the technology vendors that process data for banks, should plan on the PDPL applying in full.

StackWeaver view · The carve-out turns on who supervises you, not on what you call yourself. A company that partners with a bank but is not itself supervised by the Central Bank does not inherit the bank's exclusion. Treat your scoping decision as a written legal opinion, not an assumption, and keep it in your evidence pack.

The regulator's own material supports this reading for non-bank fintechs. The PDPC's guideline on data protection officer categories lists "digital wallets, fintech startups, and payment processing platforms (non-bank)" and "financial technology platforms offering credit scoring, loans, or insurance products" as examples in its highest category, and medium-scale non-bank wallets and payment gateways in the next one (PDPC DPO categories; Category B).

Reach beyond Egypt is real. The criminal provisions apply to Egyptians wherever the offence happens and to non-Egyptians outside Egypt when the data concerns Egyptians or foreigners living in Egypt (issuing law, Art. 2). A controller established outside Egypt must appoint a representative inside Egypt (Art. 4(11)). A regional fintech serving Egyptian customers from Dubai, Lagos or Nairobi should therefore assume it is in scope for that customer base.

The law also lists other exclusions: data kept by individuals for personal use, data processed for official statistics or under a legal provision, data processed solely for journalism, data in judicial records and investigations, and data held by national security bodies. None of these is likely to cover a commercial fintech.

The Personal Data Protection Center (PDPC). The law creates the PDPC as a public economic authority that reports to the competent minister (Art. 19), and the Executive Regulations were issued by the Minister of Communications and Information Technology (Decree 816/2025). The PDPC issues licences and permits, keeps the register of data protection officers, receives complaints, inspects data users and checks cross-border transfers. It has published guidelines on key terms, lawful bases, consent, privacy notices, records of processing, data protection officers, breach notification, direct marketing, and licences and permits.

The Central Bank of Egypt. For banks and other entities it supervises, the Central Bank's own rules on personal data apply instead of the PDPL, and money-transfer and exchange companies must follow those rules as well as the PDPL (Art. 3(6)). If your licence comes from the Central Bank, your data-protection programme should be built against its requirements first.

The economic courts. Crimes under the PDPL are heard by Egypt's economic courts (issuing law, Art. 5). That matters because most of the penalties in the law are criminal fines, and several carry prison terms.

StackWeaver view · Non-bank financial firms also answer to the Financial Regulatory Authority, whose FinTech Law adds a confidentiality duty with per-victim fines, plus customer verification and outsourcing rules. Our Egypt FinTech guide covers them.

How the PDPC can act. According to its guidance, the PDPC can warn a non-compliant data user and order the violation cured, suspend a licence in part or in full, revoke it, place the data user under technical supervision at its own cost, and publish proven violations in the media at the violator's expense (Licenses and Permits Guidelines §6).

As of 11 October 2026 we found no enforcement decision published by the PDPC. That is expected during a grace period that the PDPC's own guidance describes as a period to apply for licences and adjust (§7; direct marketing guidance). We will add decisions to this section, each with a link, as the PDPC or reputable outlets publish them.

The penalty schedule in the law tells you what the regulator and the courts can do once the window closes:

• Unlawful collection, processing or disclosure: EGP 100,000 to EGP 1 million (Art. 36).
• Committed for gain or to harm the person: at least six months in prison and EGP 200,000 to EGP 2 million, or either (Art. 36, second paragraph).
• A controller or processor failing its core duties, including breach notification: EGP 300,000 to EGP 3 million (Art. 38).
• No data protection officer: EGP 200,000 to EGP 2 million for the company's legal representative (Art. 39).
• A data protection officer failing the role: EGP 200,000 to EGP 2 million; EGP 50,000 to EGP 500,000 if negligent (Art. 40).
• Sensitive data without consent: at least three months in prison and EGP 500,000 to EGP 5 million, or either (Art. 41).
• Breaking the cross-border rules: the same range as sensitive data (Art. 42).
• Breaching the licence and permit provisions: EGP 500,000 to EGP 5 million (Art. 45).

StackWeaver view · For a fintech, the licensing and cross-border penalties are the ones to plan around. They apply to the most common failure, which is processing customer data in a foreign cloud without the right approval, and they are set at the top of the scale.

We cite the official Arabic text of Law No. 151 of 2020 (Official Gazette No. 28 bis (H), 15 July 2020), Decree No. 816 of 2025 (Al-Waqa'i' al-Misriyya No. 244 (follow-on A), 1 November 2025) and the PDPC's guidelines (Version 1.1, 26 January 2026). The PDPC website did not respond from outside Egypt when we checked, so our links go to the Internet Archive's unaltered copies of the PDPC's own files. English wording of the law is our translation; the Arabic text governs.

Every statement of law on this page is recorded in a public claims ledger with its source, section, retrieval date and the exact supporting words, and our build checks each source before publication. Facts are labelled “Sourced”; opinions and recommendations are labelled “StackWeaver view”, as our editorial policy explains. AI tools helped research and draft this guide; a named person at StackWeaver is accountable for it, and every legal statement was checked against the official text.

Spotted an error? Email [email protected]. More countries are in the Africa Fintech Regulatory Atlas.