The rights conferred on Data Subjects under Egypt’s Personal Data Protection Law No. 151 of 2020 (“PDPL”) form a key component of the country’s data protection regime. While these rights belong to individuals, they create corresponding obligations for the entities that collect, use, store, and otherwise process personal data. For Controllers and Processors alike, compliance is not limited to implementing privacy policies or obtaining consent: Data Users must also put in place appropriate procedures to facilitate the exercise of Data Subject Rights (“DSRs”) and respond to requests within the statutory timeframes the PDPL prescribes.
This article examines the principal DSRs under the PDPL from the perspective of the Data User, considering the obligations imposed on Controllers and Processors under the PDPL, its Executive Regulation issued under Ministerial Decree No. 816 of 2025 (“ER”), and the Data Users Guidelines issued by the Personal Data Protection Centre (“PDPC Guideline”), before briefly comparing the Egyptian framework with the approach adopted under the European Union’s General Data Protection Regulation (“GDPR”).
Key Data Subject Rights Under the PDPL
Pursuant to Article (2) of the PDPL, a number of rights are conferred on Data Subjects in relation to their personal data. These rights may be exercised against any Holder, Controller, or Processor in possession of such data. From a practical perspective, these rights, which are intended to provide individuals with greater transparency and control over how their personal data is collected, used, stored, and disclosed, among the rights granted by the PDPL, are as follows:
- Right to Be Informed: The right to be informed enables a Data Subject to receive clear and adequate information regarding the processing of their personal data. This includes information relating to the identity of the Data User, the purpose of the processing activity, and the manner in which the personal data will be used.
- Right of Access: The right of access allows a Data Subject to determine whether a Data User is processing their personal data and, where applicable, obtain access to that data and information relating to the processing activity.
- Right to Withdraw Consent: Where processing is based on consent, the Data Subject has the right to withdraw that consent at any time. Data Users should therefore ensure that consent can be withdrawn through a clear, simple, and accessible process.
- Right to Rectification: The right to rectification enables a Data Subject to request the correction, amendment, updating, or completion of inaccurate or incomplete personal data.
- Right to Erasure: This right enables a Data Subject to request the deletion of their personal data.
- Right to Restrict Processing: The right to restrict processing enables a Data Subject to require that their personal data be processed only within a limited scope. Unlike erasure, restriction does not necessarily require data to be deleted. Instead, it limits the ways in which the personal data may be used while allowing it to be retained where necessary.
- Right to Object: The right to object enables a Data Subject to challenge the processing of their personal data where such processing, or its results, conflicts with their fundamental rights and freedoms. The PDPC Guideline further describe this right as the right to object to and require the cessation of the processing of personal data.
- Right to Data Portability: Although not expressly listed under Article (2) of the PDPL, the PDPC Guideline recognise a right to data portability. This right allows a Data Subject to request that their personal data be transferred to another Controller in a structured, commonly used, and machine-readable format. The objective is to provide individuals with greater control over their personal data and facilitate movement between service providers.
Controllers’/Processors’ Obligations with regard to DSRs Under the PDPL
Controllers bear primary responsibility for enabling Data Subjects to exercise their rights. Being the party determining for what purposes and via which means personal data is processed, the Controller remains responsible for ensuring compliance with the DSRs under the PDPL framework.
Under Article (4) of the PDPL and the corresponding provisions of Article 3 of the ER, Controllers are required to establish a mechanism – approved by the PDPC – through which Data Subjects are able to exercise their rights, including: right of access, rectification, restriction, objection, and withdrawal of consent. Controllers must also maintain a secure electronic record of all requests received from Data Subjects, the respective action(s) taken in response, and the justification for any rejection.
Additionally, Controllers are further required to delete personal data records when the purpose, for which they were collected, no longer exists. They are also required to notify Data Subjects when such deletion occurs, unless they are obliged to retain such records or data under the applicable law. This reflects the broader principle that personal data should not be retained indefinitely without a legitimate justification. Importantly, appointing a Processor does not transfer responsibility for compliance. Whether a Controller engages a payroll provider, cloud service provider, call centre operator, or another third-party service provider, the Controller remains responsible for ensuring that DSRs can be effectively exercised.
In addition to the obligations specifically applicable to Controllers and Processors, the PDPL imposes additional general requirements which all Data Users must comply with. These obligations aim to ensure that personal data is well protected throughout its lifecycle, and that Data Subjects are supported to effectively exercise their rights.
Data Subjects exercising their rights may generate corresponding obligations for Data Users. For instance, under Article (32) of the PDPL, a Data User must respond to a request – submitted by Data Subject –within six (6) working days from the date of submission.
Another corresponding obligation is that Data Users are also required to maintain appropriate practices for the retention of personal data. Articles 4(7) and 5(6) of the PDPL, together with Article 3(4) of the ER, require Data Users retaining personal data – beyond its original purpose – to ensure that the retained information does not permit the identification of the Data Subjects. This may be achieved through techniques such as anonymization or pseudonymization.
In addition, Data Users must take appropriate measures to safeguard personal data and preserve its quality throughout the processing lifecycle. Article (3) of the PDPL requires personal data to be accurate, secure, and processed in a manner that preserves its integrity. Although neither the PDPL, nor the ER, expressly refers to the internationally recognized principles of confidentiality, integrity, and availability (Known as “CIA Triad”), these concepts are reflected in the security obligations imposed by the Egyptian Laws and Regulations. In practice, Data Users should ensure that personal data remains protected against unauthorized access or disclosure (confidentiality), unauthorized alteration or corruption (integrity), and loss of accessibility where the data is required for legitimate processing purposes (availability).
Finally, Data Subjects have the right to be informed where a breach or violation affects their personal data. To support this right, Article (7) of the PDPL requires Controllers and Processors to notify the PDPC of a personal data breach within seventy-two (72) hours of becoming aware of it. In addition, affected Data Subjects must be notified within three (3) working days following notification to the PDPC, as further reflected in Article (5) of the ER. The purpose of this obligation is to enable affected individuals to take appropriate measures to mitigate any risks arising from the breach incident.
Comparative Analysis of the PDPL and GDPR
Although the PDPL and the GDPR share a common objective of enhancing individual control over personal data, the GDPR adopts a more detailed and prescriptive approach to DSRs in several key areas.
One of the most notable differences relates to automated decision-making. Article 22 of the GDPR grants individuals the right not to be subject to a decision based solely on automated processing, including profiling, where such decision produces legal effects concerning them or similarly significantly affects them. While the GDPR permits automated decision-making in certain circumstances, it generally requires the implementation of appropriate safeguards, including the right for the individual to obtain human intervention, express their point of view, and contest the decision. By contrast, the PDPL does not currently contain an equivalent standalone right, notwithstanding the increasing use of artificial intelligence (AI) and automated decision-making tools across a range of sectors.
The GDPR also provides greater procedural detail in relation to several fundamental DSRs. For instance, the rights to erasure and restriction of processing are governed by detailed statutory grounds, conditions, and exceptions under Articles 17 and 18 of the GDPR. By contrast, the PDPL recognizes broadly comparable rights but does not prescribe the same level of detail regarding the circumstances in which such rights may be exercised, restricted, or refused.
Data Portability is also addressed in greater detail under the GDPR. Article 20 expressly grants individuals the right to receive personal data in a structured, commonly used, and machine-readable format and, where technically feasible, to have that data transmitted directly from one Controller to another. Although the PDPC Guideline recognizes a right to Data Portability, neither the PDPL nor the ER presently sets out an equivalent framework governing the conditions and requirements for direct Controller-to-Controller transfers.
Conclusion
The PDPL grants Data Subjects a broad range of rights designed to provide greater transparency and control over the processing of personal data. For Data Users, however, these rights are not merely statutory entitlements granted to individuals; they give rise to practical obligations requiring appropriate governance structures, internal procedures, and clear allocation of responsibilities. Controllers and Processors should therefore ensure that appropriate mechanisms and governance structures are in place to facilitate the effective exercise of DSRs and to respond to requests within the strict timelines prescribed under the PDPL.
At Habib Al Mulla and Partners, our Data Protection team advises local, regional, and multinational clients on a broad range of data protection and privacy matters including PDPL implementation, privacy governance frameworks, DSRs management, regulatory investigations, cybersecurity incidents, and AI-related compliance matters.
Seek Legal Counsel
For legal advice and support in Egypt, get in touch with our Partner and Head of the Egypt Office, Dr. Kamel Elshendidy. Our team is available to understand your requirements and provide guidance tailored to your legal and business needs.
************
Disclaimer: This content is provided for general information only and does not constitute legal advice. Please seek professional advice tailored to your specific circumstances.
