Data Processing Agreement in Egypt: Template, Key Clauses and Local Law (2026)

A data processing agreement (DPA) in Egypt is the contract a data controller signs with a data processor to make sure personal data is handled in line with Egypt's Personal Data Protection Law (Law No. 151 of 2020), often called the PDPL. The controller decides why and how personal data is processed. The processor handles the data on the controller's behalf. The DPA writes that relationship down and binds the processor to the security, confidentiality and compliance duties the law expects. This guide explains what an Egyptian DPA should contain, the clauses that matter, and the local-law points to check. It is general information, not legal advice. For a specific deal, confirm the current position with an Egyptian lawyer. ## When you need a DPA in Egypt You need a DPA whenever one organisation processes personal data on behalf of another. Common examples are a cloud or SaaS vendor, a payroll or HR provider, a marketing or analytics service, or an outsourced support team. The PDPL keeps the controller responsible, so the contract is how the controller passes clear instructions down and keeps evidence that the processor is bound. ## What law governs a DPA in Egypt The core statute is the Personal Data Protection Law (Law No. 151 of 2020). The key points for a DPA are: - The law applies to personal data of natural persons that is processed electronically, in whole or in part.

• A controller is a party that obtains personal data and decides the purposes and means of processing. A processor processes personal data for its own benefit or on a controller's behalf.
• The law is principles-based and relies on its Executive Regulations for the detailed operational, organisational and record-keeping requirements.
• It provides for appointing a data protection officer, and for a licensing regime overseen by the Personal Data Protection Center for certain data activities. Confirm the current licensing and registration position, as the regulator's practice has been developing.
• Some bodies are carved out, including national security authorities and the Central Bank of Egypt and the entities it supervises. General contract law in the Civil Code (Law No. 131 of 1948) sits underneath the PDPL and governs formation, breach and remedies. ## Key clauses in an Egyptian DPA ### Subject matter and instructions State the data processed, the categories of data subjects, the purpose, and the duration. Make clear the processor acts only on the controller's documented instructions. ### Security measures Require appropriate technical and organisational security suited to the risk, in line with the PDPL and its Executive Regulations. Name concrete controls where you can. ### Confidentiality Bind the processor and its authorised staff to confidentiality over the personal data. ### Sub-processors Set whether sub-processors are allowed, require approval or notice, and flow the same duties down to any sub-processor. ### Breach handling and notification Require the processor to notify the controller without undue delay after a breach, with enough detail for the controller to meet its own obligations to the Personal Data Protection Center and affected individuals. ### Data subject rights Require the processor to help the controller answer requests from data subjects, such as access, correction and erasure. ### Cross-border transfer If personal data leaves Egypt, record the lawful basis and any conditions the PDPL and its regulations require for transfers abroad. ### Return or deletion and audit At the end of the contract, require return or deletion of the data, and give the controller audit or evidence rights. ## A simple drafting checklist - Name the controller and processor and confirm which is which.
• Describe the data, data subjects, purpose and retention.
• Limit processing to the controller's documented instructions.
• Set the security standard and the breach-notice process.
• Deal with sub-processors and any transfers out of Egypt.
• Cover data subject rights, audit, and return or deletion on exit.
• Confirm the current DPO and licensing position with the regulator. ## Keeping your DPAs in order A DPA only helps if you can find it, prove what it says, and track its obligations. When signed DPAs are scattered across inboxes, the breach-notice duties and audit rights get lost. Keeping contracts in one workspace, where clauses, obligations and key dates are structured instead of buried in flat text, makes compliance far easier to run. Tools such as Adira bring drafting, review and obligation tracking together in a single place. Adira's depth is strongest for India today, with other jurisdictions on its roadmap, so for Egyptian-law specifics confirm the position with local counsel.