Data privacy in real estate: Egypt PDPL compliance guide

Egypt's Personal Data Protection Law (PDPL), Law No. 151 of 2020 and its executive regulations (Decree No. 816 of 2025), came into full effect and now applies directly to real estate businesses that process customer data.

Who is affected

Any real estate brokerage, developer, or call center operating in Egypt that processes personal data — names, phone numbers, email addresses, national IDs, financial information — is subject to the PDPL. This includes data stored in WhatsApp, Excel sheets, or cloud CRMs.

Key requirements for real estate businesses

1. Lawful basis: You must have a lawful basis for processing data. For real estate, the primary bases are: contract (the client contacted you for a transaction), consent (marketing), and legitimate interest (lead follow-up within a reasonable window).

2. Data minimization: Only collect the data you need. In real estate, this means: name, phone, email, budget, preferred area — but not national ID unless required for a specific transaction.

3. Retention limits: Personal data should not be retained longer than necessary. PDPL suggests data related to transactions be kept for 5 years (aligned with Egyptian commercial law), then deleted.

4. Access controls: Implement role-based access so agents can only see data they need. Your sales manager should not be able to export your entire lead database.

5. Audit logs: The PDPL requires maintaining access logs for sensitive data. Every time a user accesses or exports personal data, the action must be logged with the user's identity, timestamp, and what was accessed.

How Zold handles PDPL compliance

Zold is built with PDPL compliance as a first-class feature: all data is encrypted at rest (AES-256) and in transit (TLS 1.3); access is role-based with granular permissions per resource; a full audit log records every data access event; data retention policies can be configured per tenant; and a data export/delete workflow enables compliance with data subject requests.