The data-protection law and your clinic: what changes

This is a general explainer, not legal advice. For your situation, consult a qualified lawyer.

The Executive Regulations of Egypt’s Personal Data Protection Law No. 151 of 2020 were issued by Ministerial Decree No. 816 of 2025, in November 2025. According to published legal commentary, the compliance deadline is 31 October 2026.

In short:

• Health data is sensitive data, with higher protection. Published commentary describes explicit written consent before it is processed.
• A breach has a clock: the Personal Data Protection Center is notified within 72 hours of becoming aware of it, and the people affected within three working days.
• Five questions any clinic can answer this week, and take to its lawyer.

The key points, as published legal commentary describes them.

What does Egypt’s data protection law mean for a clinic?

According to published legal commentary, a clinic that keeps patient data should expect four things: consent handled properly, with explicit written consent for health data; a plan to report a breach to the Personal Data Protection Center within 72 hours and to the patients affected within three working days; a licence from the Center, which the commentary describes for most organisations that hold or process personal data; and a transition reported to end on 31 October 2026, a date the regulator may clarify.

Little of this is technology. Most of it is knowing where patient data is, who opens it, what patients agreed to, and what the clinic would do on a bad day.

Six terms come up in every commentary. In plain language, as this article uses them (the law’s own definitions are what count):

• Personal data: information about a person who can be identified, such as a name, a phone number or a file number.
• Sensitive data: a category with higher protection. Published commentary gives health data as an example, alongside biometric data and religious beliefs.
• Controller and processor: the organisation that decides how data is used, and one that handles it on its behalf, such as a software or storage supplier. Which one you are is worth settling with your lawyer.
• Breach: in this article, patient data reaching someone it should not, or being lost or changed. Whether an incident counts under the regulations is a question for your lawyer.
• Data protection officer: a person registered with the Center who oversees data protection. Commentary describes duties including handling requests from the people whose data is held, and an annual report to the Center.
• Cross-border transfer: personal data sent outside Egypt, which, one commentary notes, includes cloud environments.

What was issued, and when

The law was passed in 2020 and set up the Personal Data Protection Center as its regulator. Its executive regulations, which set out how it is applied, were issued by Ministerial Decree No. 816 of 2025 on 1 November 2025, according to published legal commentary.

The same commentary describes a one-year period to come into line, ending on 31 October 2026. Some commentators note that the regulations were made public weeks after they were issued, and that the regulator may clarify the timeline. Until it does, they advise planning to the earlier date.

One commentary dates the public release to 25 December 2025, and notes some uncertainty over whether the Center may treat the period as running to the end of 2026. It also reports operational guidelines from the Center, on topics including consent, privacy notices, licensing and data protection officers, with more expected.

Key points, according to published sources

• Consent. Clear, informed consent before collecting personal data. One commentary describes valid consent as explicit, informed, specific and freely given, asked for in separate requests, easy to withdraw, and recorded so the organisation can show how and when it was given. It adds that consent is one of six lawful bases, and is not suitable where a person has no real choice.
• Health data is sensitive data, with higher protection. Published commentary describes explicit written consent for processing it, and stricter security requirements.
• Children. For a child under 15, the commentary describes explicit written consent from the legal guardian.
• Purpose and retention. Commentary describes a retention period set for the purpose of collection, and erasure once that purpose is fulfilled unless a legal obligation requires keeping the data. It adds that sector-specific limits on collection and retention still apply.
• Breaches. Notify the Personal Data Protection Center within 72 hours of becoming aware of a breach, and inform the people affected within three working days.
• Licences and permits. Most organisations that hold or process personal data need a licence from the Center, and some activities need an additional licence or permit, including transfers outside Egypt, direct electronic marketing and certain uses of visual surveillance in public places.
• Records. One commentary describes a secure register that includes consent records, and a record of processing activities, for which the Center has published templates.
• A data protection officer. Some organisations must appoint an accredited data protection officer, listed in a register the Center keeps. One commentary describes this for legal entities; another says it depends on the scale and sensitivity of processing.

Which of these applies to a particular clinic, and how, is a question for a lawyer. What follows is a way to start that conversation.

What it means for patients

Published commentary describes a stronger position for patients: health data treated as sensitive, written consent for it, a guardian’s written consent for a child under 15, a way to ask to access, correct or object to the processing of your data, and a message if a breach affects you. If you are not sure how a clinic uses your data, you can ask it.

A breach has a clock

The deadlines, as published commentary describes them.

The 72 hours run from when the clinic becomes aware of the breach. That is why the plan has to exist before anything happens: who inside the clinic is told first, who notifies the Center, and who tells the patients affected.

Commentary expects more guidance from the Center on breach management. Until it comes, a one-page outline is enough to take to your lawyer. It should answer six questions, in order:

1. Who does staff tell, at once? One named person, and a backup for nights and holidays.
2. What is written down first? When the clinic became aware, what happened, and which records and patients may be involved. One commentary notes that the regulations reinforce expectations around incident registers.
3. Who decides whether it must be reported? With your lawyer or data protection officer, the same day.
4. Who notifies the Center, and how? Find out the channel before you need it.
5. Who tells the patients affected, and in what words? A short draft, prepared in advance.
6. What stops it happening again? A changed password, a removed group member, a lost phone locked and wiped.

Where patient data lives in a clinic

“Where is data stored?” sounds like a question for the IT supplier. In many clinics, the honest answer is a list.

Before data can be protected, it has to be found.

Each place on that list is somewhere to ask two questions: who can open it, and does it leave the country? Mapping it is an afternoon, not a project:

1. Walk the clinic, desk by desk. Note every place a patient’s name sits: cabinets, screens, printers, the appointment book.
2. Open the phones. Ask which chat groups carry patient photos, voice notes or results, and who is in each one.
3. List the suppliers. The clinic system, email, backups. Ask each where the data is hosted, since commentary describes a separate licence or permit before data leaves Egypt.
4. Write the access list. For each place, who can open it and why their job needs it. Someone who left last year should not be on it.
5. Mark what you no longer need. One commentary lists data minimisation among the principles the regulations reinforce. Old files kept “just in case” are a retention question for your lawyer.

Collecting less helps too: we wrote about forms that ask for the same details in why every form asks the same questions.

Questions to ask your clinic

• Who accesses patient files, and with what authority?
• Do we collect documented consent, and where is it kept?
• If there is a leak, what do we do in the first 72 hours?
• Do we send promotional messages, and from what lists?
• Where is data stored, and does any of it leave the country?

Answer them for your clinic as it runs today. The tool gives you the list to take to your lawyer or data protection officer:

Bring the map, the access list, your consent form with a note of where signed consents are kept, and the breach outline to that meeting, and add three questions: which licence or permit the clinic needs, whether it needs a registered data protection officer, and which suppliers act as processors.

A worked example: one clinic, one lost phone

A composite example, built from many cases. A clinic with two doctors and three staff runs its bookings from a shared phone. Results arrive as photos in a WhatsApp group the staff made years ago, and a former receptionist is still in it. One evening, the shared phone is lost on the way home.

• Without a plan, the loss is talked about for two days, and nobody knows who should act, or when the 72 hours started.
• With a plan, the staff member tells the named person that night, and the time is written down. The phone is locked and wiped, the former receptionist leaves the group, and the lawyer is called in the morning to decide whether the Center must be notified and what the patients involved should be told.

The map would have found both, months earlier.

Common mistakes

• Treating it as an IT project. Most of the work is deciding who does what, and writing it down.
• One general signature at reception. Commentary describes consent that is specific and freely given, and explicit written consent for health data. Ask your lawyer whether your form does that.
• Forgetting phones and chat groups. They belong on the map like any cabinet.
• Waiting for the date to be clarified. Commentators advise planning to the earlier date.
• Old lists for promotional messages. Commentary describes prior consent, a free and simple way to opt out, and a specific licence for electronic direct marketing.

Where Medigize stands

We describe our controls: consent-based sharing, data minimization and removal of unnecessary identifiers, and an audit trail. We do not claim final compliance with any regulation.

How we approach consent and data is on our governance and privacy page, and what a record shared by consent looks like is in a record that moves with you. Why we say only what we can show is in why we build in public.

Frequently asked questions

When is the deadline to comply with Egypt’s data protection law?

According to published legal commentary, the one-year transition ends on 31 October 2026, with enforcement expected from 1 November 2026. Some commentators note that the regulator may clarify this timeline.

Is health data sensitive data under Egypt’s law?

Yes. Health data is sensitive personal data with a higher level of protection, and published commentary describes explicit written consent for processing it.

How quickly must a clinic report a data breach?

According to published commentary on the executive regulations: to the Personal Data Protection Center within 72 hours of becoming aware of it, and to the people affected within three working days.

Does a clinic need a licence to process patient data?

Published commentary describes a licence from the Center for most organisations that hold or process personal data, and additional licences or permits for activities such as transfers outside Egypt and direct electronic marketing. A lawyer can tell you which apply to your clinic.

Does my clinic need a data protection officer?

Possibly. Commentary describes an officer registered with the Center, for legal entities in one reading and depending on the scale and sensitivity of processing in another. Ask your lawyer which applies to you.

Can a clinic keep patient data on a cloud service outside Egypt?

Commentary describes a separate licence or permit from the Center before personal data is transferred outside Egypt, including to cloud environments, with the application naming the destination, purpose, data and safeguards. Ask your lawyer before data is moved or backed up abroad.

Can a clinic send promotional messages to its patients?

Commentary describes prior consent, a sender who is identified, a free and simple way to opt out, and a specific licence for electronic direct marketing. One notes a “soft opt-in” for existing customers during the grace period.

Is this article legal advice?

No. It is a general explainer. For your situation, consult a qualified lawyer.

This is a general explainer, not legal advice, and the rules may be clarified after publication. For your situation, consult a qualified lawyer. Medigize is a non-diagnostic navigation tool.

References

1. CMS: Egypt’s PDPL executive regulations issued, one-year compliance countdown begins
2. Chambers and Partners: A first look at Egypt’s personal data protection executive regulations
3. Access Partnership: Egypt finalises executive regulations to the Personal Data Protection Law
4. OneTrust DataGuidance: Egypt, PDPC issues executive regulations