Egypt's Personal Data Protection Law, No. 151 of 2020, is not new. But its executive regulations were only published in November 2025, and they came with a one-year grace period. That period ends at the end of this month.
A clinic handles health data every day: names, phone numbers, lab results, scans, prescriptions. The law treats that as sensitive. This post explains what the sources say and turns it into practical steps. It is general information, not legal advice.
What actually happened
According to law firm briefings, the executive regulations were issued by Decree No. 816 of 2025, published in the Official Gazette on 1 November 2025 and in force the next day. The grace period is one year from publication. Sources differ slightly on the last day: some say 31 October 2026, others 1 November 2026. Treat 31 October as your deadline to be safe.
Why clinic data is a special case
The law puts health data in a sensitive category that needs explicit consent and stronger safeguards for processing, storage and transfer. The published text also sets prison terms and/or fines for handling sensitive data without the person's consent or outside what the law allows. So this is not a formality.
The points that matter for a clinic
- Explicit consent and a clear purpose: collect data after the patient agrees and knows why, and only what you need for that purpose.
- Patient rights: to be informed, to access and correct data, to object, and to withdraw consent.
- Don't keep data longer than needed: retention should match the purpose.
- Transfers outside Egypt are restricted: allowed if the destination offers adequate protection, with the person's specific consent, or in other narrow cases. The regulations also mention licensing and explicit consent for cross-border transfers.
- Breach reporting: one law firm's summary of the regulations lists a 72-hour notification duty to the data protection authority.
- Licences: the published text says an entity collecting personal data must hold a licence or permit as a controller or processor. Whether and how that applies to your clinic is something to confirm with a lawyer or the authority.
Turning it into day-to-day work
1. Map where your data lives
List paper files, Excel sheets, the receptionist's personal WhatsApp, your software, and photos patients send. The biggest risk in most clinics is patient data scattered across staff phones.
2. Ask for consent and say why
One short sentence at booking or at the desk is enough to start: we record your details for booking and medical follow-up. What matters is that the patient knows the purpose.
3. Limit who sees what
Reception does not need the doctor's notes or revenue. Set access by role, and remove a leaver's access the same day.
4. Write a breach plan
If a phone is lost or an account is hijacked, who decides, who reports, and how? With a 72-hour window mentioned, the steps need to exist before you need them.
5. Question your tools
Ask any software vendor where data is stored, who can access it, whether there is an access log, and what happens to your data if you cancel. You can see how Kashfy handles this on its privacy page, and compare with any other tool you use.
Common mistakes
- Large WhatsApp groups that contain patient data.
- Sending results to the wrong number or the wrong person.
- One shared login with one password for everyone.
- Keeping ID and lab photos on a personal phone long after the work is done.
Bottom line
Most of what is required is not technical: clear consent, role-based access, minimal data and an emergency plan. Start with the data map and access roles this week, and the rest next week. For your clinic's exact obligations, talk to a specialist lawyer or the Personal Data Protection Centre.
Sources
- Baker McKenzie - Egypt PDPL update
- Amereller - What you need to know ahead of 31 October 2026
- Kennedys - The compliance countdown has begun
- Shalakany - New Executive Regulations
- Shand Partners - Executive Regulations briefing
- Decree 816 of 2025 text (translation)
- Law 151 of 2020 text (translation)
- Signzy - Egypt PDPL guide
