Key summary — What to know
Saudi Arabia's Personal Data Protection Law has been fully enforceable since September 2024, and Egypt's one-year compliance period ended on 31 October 2026. Saudi Arabia's law covers personal data in any form, paper included. Egypt's covers data processed electronically, which takes in scanned HR files, customer files and ID copies. You can't protect what you can't find.
Picture a compliance team that has finished its privacy notices, consent forms and website cookie banner. Then someone asks a simple question: how many personnel files with national ID copies does the institution hold, and who can open them?
The answer is somewhere in 400 boxes and three shared drives.
This article is general information, not legal advice. Confirm your obligations with qualified counsel.
Where the Two Laws Stand Now
Saudi Arabia. The Personal Data Protection Law has been fully enforceable since 14 September 2024. By mid-January 2026, SDAIA had announced 48 enforcement decisions, and penalties can reach SAR 5 million, doubled for repeat violations.
Egypt. Law No. 151 of 2020 on the Protection of Personal Data got its executive regulations through Ministerial Decision No. 816 of 2025, issued on 1 November 2025 and made public on 25 December 2025. The one-year compliance period ended on 31 October 2026, and the Personal Data Protection Center can now inspect and enforce. Among the obligations:
- Keep records of your processing activities.
- Keep personal data no longer than the purpose of processing requires.
- Notify the Personal Data Protection Center of a breach within 72 hours.
- Obtain the Center's license or permit before transferring data outside Egypt, and check whether your cloud hosting counts as a transfer.
- Appoint a data protection officer registered with the Center.
Sources: Clyde & Co — Saudi PDPL enforcement, March 2026 · CMS — Egypt PDPL executive regulations
Why the Archive Is the Hardest Part
Most data protection programs start with systems people use every day: CRM, HR software, the website. The archive comes last, and it's usually where the most personal data sits.
- HR archives. Contracts, IDs, medical certificates, salary letters, disciplinary records.
- Customer files. Account opening forms, ID copies, signed agreements.
- Case and correspondence files. Letters and complaints that name individuals.
Much of it is on paper or in scans with no index data. That means three questions every regulator asks are hard to answer: what personal data do you hold, who can see it, and how long do you keep it?
Five Archive Checks Before an Inspector Asks
1. Can you list where personal data sits? Pick one category, like personnel files. Can you say how many there are, where they are and in what format?
2. Can you find one person's records? Take a former employee's name. Can you find every document that mentions them, paper and digital, within a day?
3. Who can open them? Check who can view, download or print HR and customer files. If the answer is "anyone with access to the shared folder", that's a gap.
4. Do you know how long you keep them? Your retention periods need to exist on paper and be applied to the actual records.
5. Could you show who accessed a file? If a breach or complaint comes in, can you show who viewed or changed a record and when?
Each "no" is a finding. Each finding is easier to fix before an inspection than during one.
How ELArchive Helps You Answer Those Questions
ELArchive, our archiving platform, has run in production since 2008 at government and private-sector institutions in Egypt and Saudi Arabia. It doesn't make an institution compliant on its own. It gives you the control and visibility over records that compliance depends on.
Know what you hold. Administrators define document types and folder types, such as personnel files or customer files, with required index fields. Paper backlogs are scanned, indexed and checked directly on the platform, so personal data in old boxes becomes something you can count and find.
Find one person's records. Four search screens cover documents, text inside documents, files and text inside files. ELArchive reads the text on scanned pages in Arabic and English, so a name inside a letter is searchable too.
Control who sees what. You decide who can view, download or print each file, by user and group, and which departments' files each user can see. Confidentiality levels restrict sensitive files further, and users sign in with their existing Active Directory accounts.
Show who did what. Views, edits, borrowing and approvals each go on record with a name and a time. Earlier versions of a document stay underneath, with a record of who changed what.
Keep the trigger dates. Retention periods often start from an event, like an employee leaving. You can make that date a required index field, so it's there when the retention period needs to be applied.
Start With One Category of Personal Data
Don't try to map every record at once. Pick the category with the most sensitive data and the most volume, which in most institutions is HR. Run the five checks on it, list the gaps and fix them in order. Then move to customer files.
If your compliance team is working through PDPL or Egypt's new regulations, bring us your first category. We'll show you what it takes to make those records findable, controlled and traceable.
Frequently Asked Questions
When did Saudi Arabia's PDPL take effect?
It has been fully enforceable since 14 September 2024, and SDAIA has been issuing enforcement decisions since.
When do Egypt's data protection regulations apply?
The executive regulations of Law No. 151 of 2020 were issued on 1 November 2025 with a one-year compliance period, which ended on 31 October 2026. They now apply in full. Confirm what that means for your organization with legal counsel.
Do data protection laws cover paper records?
Saudi Arabia's PDPL covers personal data in any form, including paper. Egypt's law applies to personal data processed electronically, in whole or in part, so scanned and digitized records are covered. Ask legal counsel how it treats files that exist only on paper.
What is a record of processing activities?
It's a register of the personal data an organization processes, why, how long it's kept and how it's protected. Egypt's law and regulations require controllers and processors to keep records of their processing.
Can ELArchive make us compliant?
No platform can do that alone. ELArchive gives you control over who sees each record, visibility over what you hold, and a record of who accessed what, which a compliance program depends on.
Does ELArchive support Arabic?
Yes. The interface, indexing and full-text search work in Arabic and English, and ELArchive reads the text on scanned pages in both languages.
Working through PDPL with paper files still in the way?
Start with your HR archive. We'll show you what it takes to make it findable and controlled.
Book a scoping call