What does the tool show?
Egypt's Personal Data Protection Law 151 of 2020 now has Executive Regulations. Law-firm summaries describe licences for controllers and processors, separate permits for transfers abroad, visual surveillance and direct marketing, a data protection officer, and a 72-hour breach notice. A fleet with trackers and cameras meets several of these at once.
The tool turns eight answers into ten topics. Each topic gets one reading: raise it with the PDPC, ask the PDPC or your adviser, ask your service company, find out first, prepare now, or not indicated by your answers.
What rows are on file?
Twelve rows, checked on 3 Nov 2026 against the decree text in a law-library copy, with two law-firm summaries for the grace period. We could not reach the Official Gazette copy, so treat every row as secondary until you check it in the official text.
| Topic | What the text says, in our words | Source |
|---|---|---|
| Law and regulations | Personal Data Protection Law 151 of 2020. Its Executive Regulations were issued by Ministerial Decision 816 of 2025, published in the Official Gazette (issue 244 bis) on 1 Nov 2025 and in force from the next day. Law firms report a one-year grace period: on a strict reading it ended about 1 Nov 2026, and CMS notes a possible reading of end 2026. | CMS (13 Jan 2026) and Al Tamimi (4 Feb 2026) |
| Licences for controllers and processors | Controllers and processors need a licence or a permit from the PDPC (Articles 3 and 4). The decree text read sets no general licence term: permits run for at most one calendar year (Article 20), a visual-surveillance licence covers 3 years (Article 31), and the licence fee cap is counted over 3 years (Article 19). | Decree 816 of 2025, law-library copy |
| Cross-border transfer | Transferring personal data outside Egypt, including hosting abroad, needs a licence or permit from the PDPC (Articles 16 and 23 to 25). | Decree 816 of 2025, law-library copy |
| Visual surveillance | A licence or permit is needed for visual surveillance in public places, with visible notices that cameras are present (Article 31). Cameras of private homes that stay within their boundaries are excluded. The text does not say whether cameras inside vehicles are covered. | Decree 816 of 2025, law-library copy |
| Direct electronic marketing | A licence is needed for direct electronic marketing, in two categories: marketing your own business and marketing for others (Articles 18 and 28 to 30). | Decree 816 of 2025, law-library copy |
| Data protection officer | A licence application by a legal entity includes a contract with a data protection officer registered with the PDPC (Articles 8 and 21). The PDPC decides a DPO registration within 30 working days (Article 8). | Decree 816 of 2025, law-library copy |
| Review time | The PDPC decides a cross-border transfer application within 90 working days of a complete file, and no answer counts as a refusal (Article 26). The text read gives no review time for other licences. | Decree 816 of 2025, law-library copy |
| Breach notice | A breach is reported to the PDPC within 72 hours of becoming aware of it, and to the people affected within 3 working days of notifying the PDPC (Article 5). | Decree 816 of 2025, law-library copy |
| Fees | Annual licence fees for legal entities rise with the number of records: up to 100,000 records exempt, EGP 200 for 101,000 to 200,000 records, EGP 300 for 201,000 to 300,000, and higher bands above (Article 19). Visual surveillance: EGP 1,000 every 3 years for a licence, EGP 500 a year for a permit (Article 31). Cross-border transfer: 50% of the fee (Article 27). | Decree 816 of 2025, law-library copy |
| Company established abroad | A controller or processor outside Egypt with no branch or office there appoints a representative inside Egypt (Articles 3 and 4). | Decree 816 of 2025, law-library copy |
| Children | Data of children under 15 needs the explicit written consent of a guardian (Article 15). A child's data may not be used for classification, tracking or behavioural monitoring when the child takes part in a game or contest (Article 14). | Decree 816 of 2025, law-library copy |
| What the summaries do not cover | Location data and employee monitoring are not addressed explicitly in the decree text read or in the summaries. Biometric driver ID is not covered by these rows either. | Decree 816 of 2025, law-library copy |
Do in-vehicle cameras need the surveillance permit?
The decree text and the summaries we read do not say. Article 31 of the decree describes the visual-surveillance licence for public places with a visible notice. A cabin camera and a DSM camera record a driver at work, and a road camera records people and plates in the street. So the tool marks cameras as a question for the PDPC or your adviser, not as a requirement.
Which dates does the tool use?
The regulations were reported as issued on 1 Nov 2025 with a one-year grace period, so the strict reading ends about 1 Nov 2026. One firm notes that an end-2026 reading is possible. Article 26 of the decree gives the PDPC 90 working days to decide a transfer application. All three are inputs you can change.
Worked example
A logistics fleet in Cairo uses a tracking service company whose servers are abroad, with cabin and DSM cameras. No children, no marketing, no biometric ID, and the company is Egyptian.
- Raise with the PDPC: the controller licence, the cross-border transfer permit and the data protection officer. That is 3.
- Ask: the camera question. Ask your service company: its processor licence. That is 2 more.
- Prepare now: the breach plan, including how fast the service company tells you.
- Dates on 31 Oct 2026: 1 day to the strict grace end. A file sent that day, with a 90-working-day review, would be answered around 4 Mar 2027.
Know what your devices send
Every answer above depends on the data your devices create: positions and their interval, ignition and alarm events, driver ID, video on the SD card and on the server, and sometimes audio. Write that list for each device model before you meet your adviser. It also answers the first questions the PDPC is likely to ask about your processing.
Assumptions and limits
The tool reads twelve rows checked against a law-library copy of the decree. It does not know the PDPC's forms or your exact fee band, and it does not decide whether you are a controller, a processor or both. Location data and employee monitoring are not addressed explicitly in that text. It is not legal advice and it does not say that you comply. Verify against the current official text and ask an Egyptian legal adviser.