Egypt’s Personal Data Protection Centre (the “PDPC”) has finally launched its online portal, giving businesses a working channel to apply for the licenses and permits required under Personal Data Protection Law No. 151 of 2020 (the “PDPL”). The timing is significant: the one-year grace period for compliance ends on 31 October 2026, and processing personal data without a license or permit after that date will be a breach of the PDPL.
What the Portal Offers Today?
For companies falling within the PDPL’s scope, namely those processing the personal data of Egyptians or of foreigners residing in Egypt, the portal now provides two paths for compliance, as follows:
- Creating the Company’s profile
Through the “My Companies” service, a company can create its legal entity profile, which serves as its formal point of interaction with the PDPC. Registration is anchored to the company’s Commercial Register (“CR”) number, as the PDPC portal is integrated directly with the Commercial Register Authority to validate and ensure that each profile corresponds to a duly registered entity. The company then records its sector, business activity and official contact details, and verifies its email address to activate the account. The PDPC is also expected to introduce additional functionality by the end of November 2026, allowing companies to add further legal representatives to their portal profiles. This will enable companies to designate additional representatives to manage their accounts and undertake relevant activities, without having to refer to the individual whose details are recorded in the “CR” for each such activity. Companies should complete this step carefully, as the activity and sector declared at this stage are likely to inform how the PDPC assesses their processing activities. - Registering the DPO
The portal also enables individuals to sit the PDPC examination and apply for registration in the PDPC’s Register of Data Protection Officers (“DPOs”). Although the DPO must personally submit their registration application, companies are required to appoint a DPO who is registered with the PDPC. The companies license/permit application must include the DPO’s contract, confirming their acceptance of the role and the company’s commitment to safeguarding their independence.
The PDPC applies a tiered approach to DPO qualification, under which the DPO’s category must be commensurate with the scale of the company’s processing activities. It recognizes three categories:
- Entry-Level DPO (Category C) for companies processing up to 100,000 personal data records;
- Advanced DPO (Category B) for those processing up to 2,000,000 records; and
- Lead DPO (Category A) for those exceeding that threshold. Each category is conditional upon passing a PDPC examination of corresponding ratio, with minimum pass marks of 60%, 70%, and 80% respectively.
Furthermore, the PDPC is expected to introduce an online registration and examination process by mid-November 2026 for foreign DPOs and individuals residing out of Egypt. This development is expected to enable eligible candidates to complete the relevant registration procedures and examination remotely, without the need for physical attendance in Egypt.
Companies should therefore assess the volume of data they process before appointing their DPO, as an under-qualified appointment could undermine their license application.
The PDPC decides on a complete registration application within 30 working days, or a little bit more, depending on the readiness of the candidate DPO, after which the DPO receives a unique DPO Code that the company must use when appointing or replacing its DPO. Egyptian nationality or residency are not required, allowing multinational groups to designate an existing regional DPO, subject to PDPC registration.
Taken together, these two steps form the foundation of every company’s compliance journey on the portal. Companies should therefore create their profile and initiate their DPO’s registration without delay.
Who Must Act?
The obligation does not depend on company size. Every company that processes personal data, including customer records, employee files and website forms, needs a license/permit and must appoint a DPO registered with the PDPC. Smaller companies holding up to 100,000 records pay no license fee, but they still need to obtain the license/permit.
Foreign companies are equally covered. However, because registration on the portal requires an Egyptian CR number, foreign companies which do not have a Representative in Egypt cannot currently register online. Accordingly, such companies will be required to submit their applications offline, by contacting the PDPC through email, until the electronic Know Your Customer (eKYC) system is integrated into the portal. Once this functionality becomes available, foreign companies are expected to be able to apply for the relevant licenses and permits directly through the portal, following a process similar to that applicable to Egyptian entities.
What Your Business Should Do Now?
The first priority is the DPO. A company cannot complete its license/permit application without a registered DPO, and the PDPC may take up to 30 working days or a little bit more, depending on the readiness of the candidate DPO, to approve a DPO’s registration. It is therefore the step most likely to cause delay and should begin immediately.
Thereafter, businesses should map the personal data they hold and estimate the number of records, as this determines the license/permit category and the applicable fee.
Given that the grace and transitional period granted to companies to comply with the provisions of the PDPL has now expired, companies that have not yet begun the application process for the relevant licenses and permits are therefore strongly encouraged to do so without delay. Taking steps towards obtaining the necessary licenses/permits may demonstrate their commitment to compliance with the PDPL, particularly in the context of any regulatory inspections or enforcement measures undertaken by the PDPC following 1 November 2026.
Why It Matters?
Operating without a license/permit carries fines of up to EGP 5 million, which are doubled for repeat offences, and managers can be held personally liable. Moreover, the PDPC can take up to 90 days to decide an application, which means that no application filed today will be approved before the deadline. In our view, filing early with a complete file is therefore the safest position a business can take.
How Can We Help?
At Habib Al Mulla and Partners, we support our clients through every stage of compliance with the PDPL. Our Data Protection team can help assessing each company’s processing activities, advising on the different licenses/permits required, and supports and advice on all Data Protection compliance aspects and PDPC portal requirements and process. Our team can also guide the in-house DPO candidate through the PDPC examination and registration process. In doing so, we enable companies to meet their regulatory obligations efficiently and with confidence within the provided deadline, while remaining focused on their core business.
For any legal or business queries, get in touch with our Senior Associate, Mai Khaled, at mai.khaled@habibalmulla.com.
