PDPL guide for SaaS and micro-SaaS founders with Egyptian customers. Controller vs processor, sub-processor lists, DPAs, residency questions, security baseline.
If you process the personal data of people in Egypt, yes. Headquarters location doesn't get you out of it.
If you take Egyptian customer data, yes. Your customers will ask, especially when they're trying to comply themselves. A short, clean DPA is competitive — not optional.
Yes, as a named sub-processor with appropriate contractual safeguards (DPA, no training on customer data, retention limits). Disclose the use in your privacy notice and sub-processor list.
No, not by default. PDPL allows transfers with appropriate safeguards under Article 14. Some regulated sectors push for residency in tenders, which is a commercial — not legal — decision.
Investors increasingly run privacy diligence. Having a DPA, sub-processor list, and a basic ROPA in place removes a category of red flags before they show up in a data room.