Data Breach Reporting Under Egypt’s Law No. 151 of 2020
Under Egyptian law, personal data breaches trigger mandatory reporting obligations, including a strict 72-hour deadline for notifying the PDPC.
Egypt’s Personal Data Protection Law No. 151 of 2020 (PDPL) imposes specific obligations on data controllers and processors following a personal data breach, requiring them to report the incident to the Personal Data Protection Centre (PDPC) and subsequently notify affected individuals. These obligations are further detailed in the Executive Regulations issued under Minister of Communications and Information Technology Decision No. 816 of 2025.
The legal framework raises important questions concerning when the reporting period begins, the information that must be disclosed, and the extent to which organisations may be exempt from notifying affected individuals. These requirements raise important compliance considerations, particularly when compared with the risk-based notification framework under the European Union’s General Data Protection Regulation (GDPR).
The 72-Hour Deadline for Reporting Personal Data Breaches
Article 7 of the PDPL establishes a mandatory reporting obligation for both data controllers and data processors, requiring them, as applicable, to notify the Personal Data Protection Centre of any breach or violation of personal data within seventy-two (72) hours of becoming aware of its occurrence
The statutory deadline runs from the date of awareness of the breach, rather than the date on which the breach initially occurred. Accordingly, an organisation that discovers unauthorised access to personal data several days after the incident took place must calculate the reporting period from the date it became aware of the breach.
An exception applies where the breach relates to national security considerations, in which case the Centre must be notified immediately, without waiting for the expiry of the 72-hour period.
Importantly, Article 7 does not make the reporting obligation conditional upon the breach reaching a particular threshold of severity or risk to the affected individuals. Accordingly, organisations should not assume that incidents involving limited data exposure or seemingly minor consequences fall outside the statutory reporting requirement.
72
HOURS
The statutory period for notifying
the Personal Data Protection Centre.
START
Breach Awareness
The reporting period begins when the
controller or processor becomes aware
of the personal data breach, not when
the incident originally occurred.
WITHIN 72 HOURS
Notify the PDPC
Submit the required notification through
the Centre’s designated electronic portal
or hotline within 72 hours of awareness.
NOTIFICATION REQUIREMENTS
Document the Incident
Include the breach details, anticipated
consequences, corrective measures,
and Data Protection Officer information.
Record the notification in the required
secure electronic register.
Article 5 of the Executive Regulations, issued under Ministerial Decision No. 816 of 2025, sets out the procedural requirements for reporting personal data breaches. The controller or processor, as applicable, must submit the notification to the Centre through its designated electronic portal or hotline within the prescribed 72-hour period.
The notification must be recorded in a secure electronic register maintained for this purpose and must contain the following information:
- Date and time of awareness: The date and time the organisation became aware of the breach, together with the time at which the notification was submitted.
- Nature and timing of the breach: A description of the nature of the breach and the time at which it occurred, enabling the Centre to assess the approximate number of affected personal data records.
- Potential consequences: The anticipated consequences of the breach and the extent of the expected damage.
- Corrective measures: The immediate measures and corrective actions taken to contain and address the breach.
- Data Protection Officer details: The details of the organisation’s Data Protection Officer.
- Additional information: Any further documents, information or data requested by the Centre.
Where the breach relates to national security considerations or the entities responsible for them, the notification must be submitted immediately and must additionally specify the connection to national security, the volume of affected data and an assessment of the resulting damage.
Organisations should therefore maintain an accurate breach register documenting the incident, the date of awareness, the notification submitted and the corrective measures implemented.
Penalties for Failure to Comply with Data Breach Notification Obligations
Article 38 of the PDPL imposes fines ranging from EGP 300,000 to EGP 3 million on data controllers and processors that fail to comply with their obligations under Article 7, including the requirements to report personal data breaches to the Centre and notify affected individuals within the prescribed timeframes.
The severity of these penalties underscores the importance of establishing effective breach detection, internal reporting and incident-response procedures to ensure timely notification and compliance with the PDPL and its Executive Regulations.
The Three-Working-Day Deadline for Notifying Affected Individuals
Reporting a personal data breach to the Centre does not discharge the organisation’s notification obligations. Article 7 of the PDPL further requires the controller and processor, as applicable, to notify the affected data subjects of the breach and the measures taken in response.
While Article 7 refers to a period of three days from the date of reporting the breach, Article 5 of the Executive Regulations expressly clarifies that notification must be made within three working days from the date the breach is reported to the Centre.
The notification must inform affected individuals of the breach and the security measures adopted to address it. It must also be communicated through the agreed method of communication, with the Executive Regulations referring to methods such as text messages, email and telephone calls.
Accordingly, organisations should establish procedures to identify affected individuals and ensure that the required notifications are issued within the prescribed three-working-day period.
Egypt’s PDPL vs. the GDPR
Although both Egypt’s PDPL GDPR impose a 72-hour deadline for reporting personal data breaches, they differ significantly in their notification thresholds, allocation of responsibilities and requirements for notifying affected individuals.
The following table highlights the key differences:
| Compliance Requirement |
Egyptian PDPL |
GDPR |
| Regulatory notification deadline |
Within 72 hours of becoming aware of the breach. |
Within 72 hours of becoming aware of the breach, where notification is required, under Article 33(1). |
| Risk-based reporting threshold |
No express risk-based exemption. Breaches must be reported regardless of their assessed level of risk. |
Under Article 33(1), notification is not required where the breach is unlikely to result in a risk to individuals’ rights and freedoms. |
| Processor reporting obligations |
Article 7 expressly requires both controllers and processors, as applicable, to report breaches to the Centre within 72 hours. |
Under Article 33(2), processors must notify controllers without undue delay. The controller is responsible for regulatory notification. |
| Notification of affected individuals |
Article 7 requires notification within three working days from reporting the breach to the Centre. |
Under Article 34, notification is required without undue delay only where the breach is likely to result in a high risk to individuals’ rights and freedoms. |
| Exemptions from notifying affected individuals |
No equivalent express risk-based exemptions are established under Article 7. |
Article 34(3) provides exemptions where appropriate protective measures were applied, subsequent measures eliminate the high risk, or notification would involve disproportionate effort, subject to public communication or an equivalent measure. |
| Breach documentation |
Article 7 of the PDPL and Article 5 of the Executive Regulations establish breach documentation and electronic register requirements. |
Article 33(5) requires controllers to document personal data breaches, including their circumstances, effects and remedial action taken. |
These differences have significant implications for organisations operating in both Egypt and the European Union. A breach that may qualify for an exemption from regulatory reporting or individual notification under the GDPR may nevertheless trigger mandatory notification obligations under Egyptian law.
Accordingly, multinational organisations should ensure that their incident-response procedures account for the applicable requirements in each jurisdiction rather than relying exclusively on a GDPR-based breach notification framework.
Practical Compliance Considerations for Organisations
The short notification periods under the Egyptian PDPL require organisations to maintain effective procedures for identifying, assessing and responding to personal data breaches. Delaying internal escalation until an incident has been fully investigated may result in the organisation exceeding the statutory notification deadlines.
To mitigate this risk, organisations should implement a formal personal data breach response procedure that establishes clear internal reporting channels, enabling employees to promptly report suspected or confirmed breaches to the relevant internal team and Data Protection Officer. The procedure should also define responsibilities for investigating incidents, assessing their scope, containing the breach and escalating the matter to the appropriate decision-makers.
Particular attention should also be given to third-party processor arrangements. Agreements with service providers should include appropriate incident-reporting and escalation obligations to ensure that organisations receive timely notification of breaches involving outsourced processing activities and can comply with their own statutory deadlines.
Finally, organisations should review their personal data protection policies, incident-response procedures and contractual arrangements to ensure consistency with the requirements of the PDPL and its Executive Regulations.
Conclusion
Egypt’s PDPL establishes strict obligations for controllers and processors following a personal data breach, requiring notification to the Centre within 72 hours of becoming aware of the incident and notification of affected individuals within three working days of reporting the breach.
The absence of express risk-based exemptions equivalent to those under the GDPR makes it particularly important for organisations to understand and comply with the specific requirements of Egyptian law. Effective breach detection, timely internal escalation, appropriate contractual safeguards and accurate documentation are essential to meeting these obligations and mitigating potential regulatory exposure.
Frequently Asked Questions
What are the data breach reporting obligations under Egypt’s PDPL?
+
Under Article 7 of Egypt’s Personal Data Protection Law
No. 151 of 2020, data controllers and processors, as
applicable, must notify the Personal Data Protection
Centre (PDPC) of a personal data breach within 72 hours
of becoming aware of its occurrence. Organisations must
also notify affected individuals within the timeframe
prescribed by the Executive Regulations.
When does the 72-hour data breach reporting period begin?
+
The 72-hour reporting period begins when the organisation
becomes aware of the personal data breach, rather than
when the breach originally occurred. For example, if
unauthorised access is discovered several days after the
incident, the reporting period is calculated from the
date of awareness.
What information must be included in a data breach notification?
+
Article 5 of the Executive Regulations requires the
notification to include information concerning the
breach and the organisation’s response, including:
-
The date and time the organisation became aware
of the breach and submitted the notification.
-
The nature and timing of the breach and the
approximate number of affected personal data records.
-
The anticipated consequences and expected damage.
-
The immediate measures and corrective actions taken.
-
The organisation’s Data Protection Officer details.
-
Any additional information requested by the Centre.
The notification must be submitted through the Centre’s
designated electronic portal or hotline and recorded
in the required secure electronic register.
When must affected individuals be notified of a data breach?
+
Article 7 of the PDPL requires affected individuals
to be notified following a personal data breach.
Article 5 of the Executive Regulations clarifies
that notification must occur within three working days
from the date the breach is reported to the PDPC.
The notification must inform affected individuals
of the breach and the security measures adopted
in response, using the agreed communication method,
such as email, text message, or telephone.
Are minor data breaches exempt from reporting under Egyptian law?
+
Article 7 of the PDPL does not establish an express
risk-based exemption from the reporting obligation.
Accordingly, organisations should not assume that
a breach involving limited data exposure or seemingly
minor consequences is exempt from notification.
This differs from the GDPR, which provides a
risk-based threshold for regulatory reporting.
What penalties apply for failing to report a personal data breach?
+
Under Article 38 of Egypt’s PDPL, failure to comply
with the obligations established under Article 7,
including the required notifications to the PDPC
and affected individuals, may result in fines
ranging from EGP 300,000 to EGP 3 million.
How do Egypt’s data breach notification rules differ from the GDPR?
+
Although both frameworks establish a 72-hour
regulatory notification deadline, they differ
in several respects. Egypt’s PDPL does not
provide an express risk-based exemption from
reporting, whereas Article 33 of the GDPR
generally requires notification unless the
breach is unlikely to result in a risk to
individuals’ rights and freedoms.
In addition, Egypt’s PDPL expressly imposes
reporting obligations on controllers and
processors, as applicable, while the GDPR
requires processors to notify controllers
without undue delay.
Notification of affected individuals also
differs. Under Egypt’s Executive Regulations,
it must occur within three working days of
reporting the breach to the Centre, whereas
the GDPR generally requires notification
without undue delay where a breach is likely
to result in a high risk to individuals’
rights and freedoms.
What measures should organisations take to comply with data breach reporting requirements?
+
Organisations should implement formal incident-response
procedures to ensure timely detection, internal escalation,
assessment, containment, and reporting of personal
data breaches.
These procedures should establish clear responsibilities
for relevant teams and the Data Protection Officer,
maintain a secure electronic breach register, and
provide mechanisms for notifying the Centre and
affected individuals within the prescribed deadlines.
Organisations should also review agreements with
third-party processors to ensure that incidents
involving outsourced processing activities are
communicated promptly.
Add Andersen in Egypt to Google Preferred Sources
Make us your preferred source to ensure you always get accurate
information. Access our peer-reviewed, highly reputable, and
unique research directly through Google.
Add
To find out more, please fill out the form or email us at: info@eg.Andersen.com
Contact Us
