Egypt's data protection law and your club

In short

• Keep data about a person only with that person's explicit consent; for a child, the parent's or guardian's.
• Data about children, and about health, are “sensitive” and need a licence from Egypt's Personal Data Protection Centre.
• Keeping data on servers outside Egypt, which is what using Paak means, needs a licence or permit from the Centre and your members' consent to it.

What the law asks of your club

Consent. Personal data may be collected or processed only with the explicit consent of the person, unless the law allows otherwise (Article 2 of the law).

Children and health. The law counts data about children as sensitive in every case, and data about physical or mental health as sensitive too (Article 1). Sensitive data may not be collected, stored or processed without a licence from the Centre and written, explicit consent; for a child, the consent of the parent or guardian (Article 12). The Regulations add: under 15, the guardian's prior written consent, which can be withdrawn; from 15 to 18, the child or the guardian provides the guardian's consent (Article 15 of the Regulations).

Storage abroad. Personal data may not be transferred to a foreign country, or stored there, unless the protection there is not lower than the law's and the Centre has granted a licence or permit (Article 14 of the law). The Regulations also require the consent of the person concerned (Article 16). Paak's servers are in France, so keeping your members on Paak is storage abroad in the sense of this article.

Licences. The law has a licence category for clubs and associations that process their members' data, beside the categories for sensitive data and for transfers abroad (Article 26). The Regulations' fee table sets, for a club, EGP 20,000 a year below 50,000 member records and EGP 50,000 above (Article 19); the licence for transfers abroad costs half of the controller or processor licence fee (Article 27). Applications are made to the Centre, whose portal is portal.pdpc.gov.eg.

The date. The law gives one year from the issue of the Executive Regulations to comply (Article 6 of the issuing law). The Regulations are dated 1 November 2025 in the Official Gazette as read; other dates are reported for their publication, so the end of the year is not certain to the day. Plan for 31 October 2026.

What the consent should cover

Paak does not write legal text for clubs (the same rule as for waivers), so there is no form to copy here. From the articles above, the consent your club collects should at least say, in words your members read:

• who keeps the data (your club) and for what (membership, training, fees, results);
• which data, including any health information you ask for, such as a medical certificate;
• that the data are kept on a service whose servers are in France, outside Egypt;
• for a member under 18, that it is the parent or guardian who consents;
• how to see, correct or delete the data, and how to withdraw the consent.

Once your text is ready, you can make every new registration sign it: Settings → Member sign-up, card Waiver / document to sign (see Waiver). When a parent registers a child, the form says that the parent signs, and Paak keeps the exact text signed, the name and the date.

What Paak does, and does not do

• Paak keeps your club's data on OVHcloud servers in France.
• Paak does not apply for licences, does not contact the Centre and does not collect consent on your club's behalf.
• The law also asks a processor based outside Egypt to appoint a representative in Egypt (Article 5, item 12). Paak, a Swiss company, has not appointed one as of 23 October 2026.
• Your club can export its data as CSV. On a member's request, Paak anonymises the member's record (write to contact@paak.club), as described in GDPR.

FAQ