Applicability: Controllers, Processors and DPO Duties
Law 151 of 2020 Program
Speak to a GRC expert
If you have any questions or need assistance, please don't hesitate to contact us.
Who Must Comply
The PDPL applies to controllers and processors handling Egyptians' personal data.
Data Controllers
Entities that determine the purpose and means of processing personal data.
Data Processors
Entities that process personal data on behalf of, and under instruction from, controllers.
The DPO Role
A qualified data protection officer must be appointed, registered with the Center, and empowered.
Registered with Center
The DPO must meet eligibility conditions and be registered with the Center.
Scope of Duties
The DPO oversees compliance, handles requests, and reports to the Center.
Ongoing Oversight
Both parties share duties to keep processing lawful and well-documented.
Mapping PDPL Duties Across Controllers and Processors
The PDPL assigns clear duties to controllers and processors across processing.
Controller Duties
Controllers set lawful purposes and ensure valid consent and data subject rights.
Processor Duties
Processors act only on documented instructions and maintain strict security.
Data Handling
Defines how personal data is collected, stored, and processed securely.
DPO Registration
The appointed DPO must be formally registered with the Data Protection Center.
Core Obligations of Controllers and Processors
The PDPL sets specific obligations that every controller and processor must meet.
- Lawful Processing
- Valid Consent
- Data Subject Rights
- Data Minimization
- Processor Oversight
- Transparency Notices
- Purpose Limitation
- Retention Limits
- Cross-Border Transfers
- Marketing Controls
Related pages
Continue Reading
Ready to learn more about Consent, Legal Basis and Data Subject Rights?