Sources updated: 1 November 2026.

Short answer: beneficiary data protection in Egypt is not achieved by placing a privacy policy on a website. An NGO should know what it collects and why, determine its legal role in each processing activity, document the relevant legal basis and consents, protect sensitive and children’s data, control vendors and partners, review overseas storage or access, and establish procedures for data-subject requests, incidents and deletion.

Egypt’s Personal Data Protection Law No. 151 of 2020 applies to personal data relating to natural persons when processed electronically, wholly or partly. Its Executive Regulations were issued by Minister of Communications and Information Technology Decree No. 816 of 2025. Article 6 of the issuing provisions requires regulated persons to regularise their position within one year from the issuance of the Regulations, and that period reached its endpoint at the beginning of November 2026. NGOs that have not completed their review should therefore act immediately and check the latest Personal Data Protection Center decisions and guidance before filing an application or taking a final step.

Why is NGO data particularly sensitive?

An NGO may collect identity, contact, income, social, health, disability, photographic, complaint and children’s data, then share selected information with a donor, local partner, evaluator or cloud provider. Some of these categories are sensitive personal data, and children’s data is treated as sensitive. Risk is not limited to a cyberattack. It also arises when an organisation collects more information than it needs, uses a beneficiary’s story in a report or campaign without a proper basis, retains outdated files, or sends names to an unauthorised party.

A practical ten-step compliance plan

1. Inventory data flows. Record paper forms later entered into a system, Excel files, email and WhatsApp use, registration platforms, beneficiary-management systems, CCTV, backups and staff devices.
2. Define the purpose before the fields. Link every data category to a legitimate, specific and declared purpose. Do not request a national ID number, medical report or household data merely because it may become useful later.
3. Determine the legal roles. The NGO may be a controller when it decides why and how data is collected. A software vendor or call centre may be a processor acting on its instructions. A partner may become an independent controller if it determines new purposes.
4. Document the legal basis and notice. Assess whether processing relies on explicit consent, a legal or contractual obligation, legitimate interest or another basis permitted by law. The privacy notice should state the organisation’s identity, purposes, data categories, retention, sharing, data-subject rights and contact method.
5. Apply higher safeguards to sensitive and children’s data. Restrict access to health, disability, financial, religious, biometric and children’s records. Document guardian consent where applicable, and do not publish a child’s or beneficiary’s identifying image or story without a valid basis and clear safeguards.
6. Review vendors and partners. The contract should define the subject and duration of processing, the NGO’s instructions, confidentiality, security, incidents and return or deletion at the end of the service. A supplier’s general claim that it is “compliant” is not a substitute for verifiable obligations.
7. Map cross-border handling. Cloud storage or access by an overseas headquarters may constitute cross-border handling. The Regulations include controls relating to a licence or permit, adequacy, consent, specified countries and security. Review the actual data route, not only the vendor’s registered office.
8. Create a data-subject rights channel. Establish a procedure for requests to be informed, access or obtain a copy, correct or update data, erase it, withdraw consent, object or restrict processing where applicable. Record the request, decision and implementation.
9. Prepare an incident plan. Staff should know who receives a report, how to contain the incident, preserve evidence and assess harm. The Law and Regulations provide for notification to the Center within 72 hours of awareness and notification to the data subject within three business days after the Center is notified, with stricter treatment for national-security cases.
10. Review the DPO, licences and records. The Center’s guidance states that legal persons acting as data users must appoint a data protection officer regardless of processing scale. The NGO should also identify the applicable licence or permit category and maintain secure records evidencing consents, purposes, retention periods, requests, incidents, and technical and organisational measures.

Documents to prepare

• A record of processing activities and a map of data flows, systems and recipients.
• Privacy notices and consent forms, including specific forms for sensitive data and guardian consent where needed.
• A retention, deletion or anonymisation schedule for each data category.
• Processing agreements and data-protection clauses with vendors, partners, researchers and consultants.
• A register of countries, cloud services, international transfers, legal bases, approvals and safeguards.
• A data-subject request procedure, response log and complaint process.
• An incident-response plan, assessment and notification template, and test log.
• The DPO appointment decision, role description, independence safeguards and reporting line.

Common mistakes that increase risk

• Copying a generic privacy policy that does not reflect the NGO’s actual systems or programmes.
• Treating beneficiary consent as open-ended approval for every future use or donor.
• Sending name lists, passports or medical reports by email or messaging apps without access controls, encryption and deletion rules.
• Confusing genuinely anonymised statistics with coded data that can still be re-linked to an individual.
• Assuming that an overseas server disapplies Egyptian law or that a donor agreement replaces a required permit.
• Leaving multiple copies on staff devices after the programme or relationship ends.

How can an NGO start within one week?

Hold one meeting with legal, IT, programmes, HR and finance. Select one high-risk programme and trace its data from the first form to deletion. Immediately stop any collection with no clear purpose, identify vendors and countries that can access the data, review the consent form and privacy notice, and open a gap log with owners and deadlines. Once this pathway has been tested, apply the same model to the remaining programmes.

Frequently asked questions

Is beneficiary consent enough?

No. Consent may be one legal basis, but it does not displace purpose limitation, data minimisation, security, retention, rights, or any required licence or permit. When processing relies on consent, it should be explicit, specific, demonstrable and withdrawable.

May a donor report include beneficiary names?

First assess whether names are necessary, the purpose and legal basis, the donor’s role, the access location, and contractual and technical safeguards. In many cases, aggregated or anonymised data can achieve the reporting purpose with less risk.

Does using Google Drive or Microsoft 365 amount to an international transfer?

The product name alone does not answer the question. Review storage and backup locations, support access, authorised recipients, contractual arrangements and the actual data route, then apply the cross-border requirements relevant to that situation.

Do the rules apply to a small association?

Organisation size does not eliminate responsibility. Certain procedures or fee categories may vary with the nature and volume of processing, but sensitive or children’s data can make even a small programme high risk.

Official and professional references

• Ministry of Communications and Information Technology: Personal Data Protection Law No. 151 of 2020.
• Egyptian Gazette: Decree No. 816 of 2025 issuing the Executive Regulations.
• Personal Data Protection Center: DPO registration and appointment guidance.
• Personal Data Protection Center: Privacy Notice Guidelines.
• MCIT: Data-protection programme for NGOs, 13 August 2026.
• Ministry of Social Solidarity: 2026 workshop on the data-protection law and beneficiary-data safeguards.
• Ministry of Social Solidarity: Central Unit for Associations and Civil Work.

Legal support for NGOs in Egypt

Legal Protector assists international organisations, NGOs and associations with reviewing data flows, contracts, policies and regulatory filings within the legal framework applicable to their activities. See our Legal Support for International and Non-Governmental Organizations.

For an initial assessment: send a brief description of the programmes, beneficiary categories, systems, storage locations, partners and countries that can access the data. Do not send personal data or sensitive documents in the first message.

This article provides general legal information and does not constitute legal advice. Applicable legislation, Center decisions, guidance and current permits should be reviewed for the organisation’s specific position and data activities.