Egypt: Executive Regulations of the Personal Data Protection Law (Decision No. 816 of 2025) including organisational requirements entered into force

On 2 November 2025, the Executive Regulations of the Personal Data Protection Law issued by Law No. 151 of 2020 entered into force on the day following their publication in the Official Gazette, as issued by Minister of Communications and Information Technology Decision No. 816 of 2025. The Executive Regulations require data controllers to establish internal policies and procedures for preparing electronic records that document data subject requests to add, modify, or erase personal data, including the scope of permissible modification or erasure and the mechanisms to inform the person concerned. They require recording personal data retained for legal or national security reasons in a manner that enables inspection by the Personal Data Protection Center (PDPC) while preventing unauthorised identification of the person concerned. The Executive Regulations require personal data processors located outside the Arab Republic of Egypt to appoint and maintain an accredited local representative or agent within Egypt for the duration of the authorisation. They require the personal data protection official to submit reports to the PDPC on the state of personal data protection and to notify the PDPC within fifteen days in cases of replacement or change of the personal data protection official.