EGYPT Law and Practice Contributed by: Ibrahim Shehata, Hesham Kamel, Mohamed Abed and Omar Selim, Shehata & Partners
1.8 Enforcement Proceedings and Fines As indicated in 1.7 Regulators , the Center is not cur - rently utilising its full powers, due to the grace period extending until 31 October 2026. The PDPL allows the Center to initiate investigations and enforcement actions under the PDPL. Proceed - ings may also be triggered by complaints submitted by data subjects, or data breach notifications filed by controllers or processors. The Center may refer the cases it handles to the eco - nomic courts, which are the competent courts with respect to applying the criminal sanctions contained in the PDPL. This is without prejudice to the claimant’s right to request civil compensation. The Center may also apply administrative sanctions. This starts by delivering a warning to the person found to be in violation of the PDPL, requiring them to com - ply with its provisions within a specified duration. If this duration lapses without such person having com - plied with the PDPL, the Center may deliver another warning, suspend or revoke the licence/permit, and subject the person concerned to its scrutiny. 1.9 Enforcement Trends Effective Enforcement of the PDPL The most significant development has been the issu - ance and entry into force of the Regulations in Novem - ber 2025, which triggered the grace period extending until 31 October 2025, while starting to implement the PDPL. Launch of the Center’s Online Platform The launch of the Center’s official online platform (pdpc.gov.eg) represents an important step in opera - tionalising the data protection framework. The plat - form shall function as a central point for regulatory information, guidance, licensing-related updates, and communication with regulated entities, enhancing transparency and accessibility. Issuance of Guidelines by the Center The Center has published new guidelines and model forms, with the purpose of spreading awareness of the implementation of the PDPL. By way of illustration, the guidelines include an explanation of core concepts
such as the data subject’s consent, the legal founda - tions for processing data, the role of a DPO, privacy policies, and permits and licences. While these guidelines are not legally binding, they reflect the orientations of the Center in the implemen - tation of the PDPL.
2. Privacy Litigation 2.1 Privacy Litigation Overview
Privacy and data protection litigation in Egypt remains at an early stage. To date, judicial practices are limit - ed. There has been a recent case before the Economic Court of Alexandria (see 2.2 Recent Case Law ), but this still does not yet amount to a settled or consist - ent line of case law. However, it reflects an emerging judicial willingness to engage with privacy and data protection arguments, especially in regulated sectors that process large volumes of personal data. Compensation for Non-Material Damage Egyptian law expressly recognises compensation for non-material damage, including psychological, repu - tational and emotional harm arising from privacy vio - lations. Such damage is considered compensable in privacy-related claims. Non-material damage is assessed at the discretion of the court, taking into account the seriousness of the violation, the nature and sensitivity of the data involved, and the impact of the infringement on the claimant’s dignity, privacy and mental well-being. Possibility of Privacy Claims Affected individuals may file a complaint with the Center, and can also bring a civil claim directly before the competent courts seeking compensation, without prejudice to their right to pursue judicial remedies. 2.2 Recent Case Law In September 2025, prior to the issuance of the Regu - lation, the Economic Court of Alexandria issued a land - mark judgment ordering the defendant to pay EGP10 million in compensation for the unlawful compromise of a customer’s personal data. Although the case was
77 CHAMBERS.COM
Powered by FlippingBook