Egypt's Personal Data Protection Law (Law 151 of 2020): what it means for clinics

Short answer: Egypt's Personal Data Protection Law (Law No. 151 of 2020) covers personal data processed electronically, and it treats health data as sensitive data. Processing it needs the patient's explicit written consent, unless the law permits otherwise, and a license or permit from the Personal Data Protection Center. The Executive Regulations were published on 1 November 2025, and their one-year grace period runs from that date. See how this applies to EMR software in Egypt.

This guide is information, not legal advice. Rules, guidance and dates change, so check with the Personal Data Protection Center or a lawyer before you act.

Diagnoses, notes, lab results and prescriptions all reveal health information, so most clinic data falls in the law's strictest category.

What the law is and who enforces it

Law No. 151 of 2020 was issued in July 2020 and published in the Official Gazette on 15 July 2020. It applies to personal data processed electronically, in whole or in part. The Ministry of Communications and Information Technology describes it as in line with international practice, especially the EU's GDPR. For how GDPR and HIPAA relate to clinics in the region, see HIPAA, GDPR and GCC clinics.

The regulator is the Personal Data Protection Center (PDPC). Article 19 sets it up as a public economic authority that reports to the competent minister, defined in the law as the Minister of Communications and Information Technology. The Center issues licenses and permits, keeps the register of data protection officers, receives breach reports and can inspect records.

Law 151 sits alongside health-sector rules. Medical facility licenses are issued by governorate health authorities under the Ministry of Health and Population (MOHP), and the Center's licensing guidelines say its licenses and permits do not replace approvals from other competent authorities.

The Executive Regulations and the deadline

Much of the practical detail, such as license categories and fees, sits in the Executive Regulations. The Minister of Communications and Information Technology issued them by Decree No. 816 of 2025. They were published in Al-Waqa'i' al-Misriyya, the government gazette, on 1 November 2025 and took effect the next day.

The law gives everyone it covers one year from the issue of the Executive Regulations to comply. The grace period runs from 1 November 2025, so it ends on about 1 November 2026 (some commentators read 31 October). After that, the law and its Executive Regulations apply in full; the Center's guidelines say any processing without the required license or permit is then a violation.

The duties at a glance

Health data is sensitive data

Article 1 defines sensitive data to include data that reveals psychological, mental, physical or genetic health, biometric and financial data, and, in all cases, children's data. Article 12 prohibits collecting, storing, transferring, processing or giving access to sensitive data without a license from the Center. Except where the law permits otherwise, it also requires the person's explicit written consent, and a guardian's consent for children.

The Center's consent guidelines add practical rules. Written consent can be on paper or electronic. Requests must be in Arabic first, separate from general terms and privacy notices, and never pre-ticked. Each record must show who agreed, when, to what, how, and any withdrawal. The guidelines also set the age rules for children, so build them into pediatric registration.

Patients can see and get a copy of their data, correct or erase it, withdraw consent, object, and be told about a breach. The law lets the Center set a fee for exercising these rights, except the right to be told of a breach; the Center's consent guideline says withdrawing consent is free. Confirm with the Center.

Licenses and permits for controllers and processors

Articles 4 and 5 require every controller and processor to hold a license or permit from the Center. Under the law's definitions, a license goes to a legal entity and lasts three years, renewable. A permit is temporary, lasts up to one year and can go to an individual or a legal entity. The Center's guidelines add that individuals can apply only for permits.

Applications go through the Center's portal, which has a questionnaire to identify what you need. The Executive Regulations give the Center 90 business days from a complete application by a legal entity, or 90 days for an individual's permit; silence means rejection, so apply early. Supplementary licenses or permits cover transfers abroad, visual surveillance in public places and direct electronic marketing, so check whether your cameras or marketing messages need one.

Fees in the Executive Regulations scale with the number of records, and the smallest band is exempt from the license fee. That reads as a fee exemption, not a license exemption, so confirm with the Center. The portal lists a permit for liberal professions, but the route for a doctor working alone is not spelled out, so ask the Center.

A data protection officer

Under Article 8, a legal entity that controls or processes personal data must appoint a data protection officer (DPO) and register them with the Center. The Center's guidelines say this applies whatever the scale of processing. Under the law and its Executive Regulations, a doctor working alone carries the DPO duties personally; the Center's guidelines and portal also offer a route for an individual professional to appoint a DPO. Confirm with the Center which applies to you.

A DPO needs a relevant degree or professional credentials, must pass the Center's exam and must have no conviction for dishonesty. They oversee compliance, handle patients' requests and complaints, report breaches and file an annual report with the Center.

Breaches: 72 hours, then three business days

Article 7 requires a controller or processor to report a personal data breach to the Center within 72 hours of becoming aware of it, or immediately if national security is involved. The report covers what happened, roughly how many records, the DPO's details, the likely effects and the steps taken. Affected patients must be told within three business days of the report.

Storing or sending data outside Egypt

Article 14 prohibits transferring, storing or sharing personal data abroad unless the destination's protection is no lower than Law 151's and the Center has granted a license or permit. The Center's FAQ also accepts extra guarantees instead of that level of protection. Either way, a license or permit is needed, unless an Article 15 exception applies: these need explicit consent and include protecting the patient's life and providing medical care or treatment. The Center's guidelines say this covers cloud services that store or process data on servers outside Egypt.

So ask every vendor where production data and backups are stored, and whether anyone outside Egypt can access them. If another country is involved, check the cross-border rules with the Center. The UAE's rules for health data differ; see UAE health data law for clinics.

Your software vendor is a processor

A vendor that hosts or processes patient records on your instructions is a processor; the Center's guidelines list cloud providers as an example. Under Article 5, a processor must follow written instructions, stay within the agreed purpose and period, erase or return the data at the end, secure its systems, keep a processing record, hold its own license or permit, and appoint a representative in Egypt if based abroad.

The guidelines advise a written data protection agreement annexed to the main contract. Ask for:

• The purpose of processing and the categories of patient data.
• Each party's duties, and your audit rights.
• Security measures, and where data is stored and accessed from.
• How fast the vendor reports a breach to you.
• Help with patients' requests, and return and deletion of data at the end.
• Your approval before any sub-processor is used.
• The vendor's own license or permit and, if abroad, its representative in Egypt.

Penalties

Offenses under Law 151 are tried by the economic courts. Handling sensitive data without consent, or outside the cases the law allows, is punishable by prison of at least three months and a fine of EGP 500,000 to EGP 5 million, or either penalty (Article 41). Breaking the cross-border rules carries the same penalties (Article 42). Breaching the provisions on licenses or permits is punishable by a fine of EGP 500,000 to EGP 5 million (Article 45). A controller or processor that fails its duties under Articles 4, 5 and 7, including breach reporting, faces a fine of EGP 300,000 to EGP 3 million (Article 38). The Center can also suspend or revoke a license or permit.

Where Helix fits

Software can make these duties easier, but it cannot take them over. The license or permit, the DPO, the consent records and the breach reports stay with the clinic.

Egyptian clinics' data is stored in Egypt. Helix encrypts data in transit and at rest, limits access by role and keeps full audit logs; the Helix security page describes these controls. Helix runs its AI in its own cloud, never on third-party AI APIs. Solo and small practices can look at Helix Clinic.