What a DPO appointment actually requires in Egypt

Every organisation processing personal data in Egypt should plan to appoint a Data Protection Officer registered with the Personal Data Protection Centre (PDPC). The officer must hold relevant qualifications and experience, pass the Centre's tests, and be given real independence in writing. Because the officer has to be identified in licence submissions, the appointment has the longest lead time of anything in a PDPL programme.

This briefing sets out what the Executive Regulations require of the role and what that means for organisations planning to rely on a group DPO abroad. It is not legal advice.

1Who needs one

Practitioner analyses read the regime as requiring a DPO for every legal entity, with no risk-based threshold. That differs from GDPR, where the requirement depends on the type and scale of processing. The licensing process reinforces it in practice: licence submissions include identification of the appointed officer and, under Article 21(5), the contractual document governing the relationship with them.

2Who can be appointed

The Executive Regulations set qualification and testing requirements. In the English rendering of Article 7, an applicant for registration must:

• hold academic qualifications or professional certificates, together with practical experience in the relevant fields
• pass the tests approved by the Centre

Practitioner reports add a clean criminal record and registration with the Centre, with an identification code tied to the volume and categories of data the officer is accredited for.

3Independence has to be documented

Article 21(5) asks for proof of the organisation's commitment to give the officer the independence needed to do the job. A title added to an existing role, with no authority to challenge decisions, is unlikely to meet that. The appointment should be in writing, set out reporting lines, and avoid conflicts with the officer's other duties.

4What the officer does

Article 12 lists the duties. They include monitoring the organisation's data security policies, receiving complaints from data subjects, verifying and acting on requests for erasure, correction or addition, avoiding conflicts of interest, and, for groups, establishing systems to oversee several entities separately.

In practice the officer also owns the six-working-day response clock for data subject requests and the seventy-two-hour breach notification clock, both covered in our pillar briefing.

5The group DPO in London

A group officer abroad who has not passed the Centre's tests and registered with it does not satisfy the Egyptian requirement. Practitioners report that the Centre has already flagged difficulty with foreign-appointed officers. Multinationals can still coordinate through a group function, but the Egyptian entity needs an officer who meets the Egyptian conditions.

6Planning the appointment

1. Decide internal or external. An external officer can serve where no internal candidate has the qualifications or independence.
2. Check the candidate against Article 7 before committing, including readiness for the Centre's tests.
3. Write the appointment, with independence, reporting line and resources stated.
4. Register the officer with the Centre as early as possible, because licence applications depend on it.
5. Give the officer the map of systems and data flows, without which none of the duties in Article 12 can be performed.

7Where we might be wrong

• Registration term. Practitioner sources describe renewable two-year registration terms; the article-level rendering we reviewed does not state a duration explicitly.
• Every entity. The "every legal entity, no threshold" reading comes from practitioner analysis. Confirm with counsel whether any exemption applies to your structure.
• Tests. We could not confirm from public sources how often the Centre runs its tests or how long registration takes in practice.
• Article numbering. English renderings differ in places. Check article numbers against the Arabic text.

The officer's first job is knowing where the data is. Our 90-minute data audit produces that map.

Sources

Executive Regulations, article level: Consortio Law Firm English rendering, ID Law Firm overview

Practitioner alerts: Baker McKenzie, Clyde & Co, Kennedys, Amereller