Executive Regulations of the Personal Data Protection Law: Assessing the Translation of General Rules into Enforceable Obligations
Read the full legal commentary here!
Background
On July 15, 2020, the Personal Data Protection Law No. 151 of 2020 was promulgated as the first Egyptian regulatory framework establishing rules governing the processing of personal data, partially or fully, electronically. The Law entered into force three months following its publication, thereby becoming effective in October 2020. The legislator further mandated that the Minister of Communications and Information Technology issue the Executive Regulations within six months of the Law’s entry into force.
The Law has been drafted by breaking down a significant number of rules and obligations into broad general provisions, the details, procedures, and technical standards of which are to be determined by the Executive Regulations. Consequently, it was hardly possible to immediately implement many of the regulatory provisions, since their practical application necessarily requires specific procedural and technical standards that can be relied upon for assessment, verification of compliance, and the estab lishment of legal liability in the event of a violation.
This legislative design exclusively placed the regulation of a quite significant set of rules in the hands of the executive authority -represented by the Ministry of Communications- thereby making it the pri mary controller of how the law is applied and how many of its provisions are interpreted. As a result, the law has lost considerable regulatory autonomy and its capacity for direct application, independent of later referencing or commentary on the regulatory rules and decisions issued by the executive au thority through the Executive Regulations.
The impact of this legislative choice was evident in the topics delegated to the Executive Regulations. These Executive Regulations were entrusted with elaborating the details of several pivotal files, fore most among them: regulating the system of licensing, authorization, and accreditation for data collec tion and processing activities; determining the categories of such licenses, as well as the procedures for their issuance, renewal, and associated fees; in addition to establishing the technical standards and procedural rules for securing data within Egypt and in cross-border contexts. The Regulations also address the registration and delineation of the data protection officers’ responsibilities.
Such delegations further extended to matters affecting enforcement and evidentiary standards, such as the determination of the conditions governing the probative value of digital evidence derived from personal data. They further encompass the controls, standards, and precautionary procedures relating to crossborder data transfers, as well as the necessary safeguards for making such data available to a controller or processor located outside the country.
The delayed issuance of the Executive Regulations has disrupted a substantial portion of the Law’s op erational framework and postponed its transition from a general legislative framework to enforceable rules capable of practical application and accountability. The preparatory process for these Regulations remained unclear regarding its stages, timeline, and consultation mechanisms until they were officially promulgated on the 1st of November 2025 by virtue of the Minister of Communications and Infor mation Technology Decree No. 816 of 2025, issuing the Executive Regulations of the Personal Data Protection Law.
