Protecting Patient Data in Your Clinic and Law 151 of 2020

In short: Personal Data Protection Law 151 of 2020 treats health data as sensitive, so the clinic, as controller of its patients' data, needs the patient's explicit written consent and a licence or permit from the Personal Data Protection Center, and must report any breach to it within 72 hours. Under its published agreement, Synora is the processor; the clinic, the controller.

Prepared by the Synora team, based on the publications of the Personal Data Protection Center and the text of the law listed at the end of this guide. Last updated: 30 September 2026.

This guide summarises what matters to a dental clinic in Law 151 of 2020 and its executive regulations, issued by Ministerial Decision No. 816 of 2025, as the Center presents them. We are not a legal authority, and we read the articles of the law in an unofficial version, because the official version on the ministry’s website is a scanned file whose text could not be copied. Consult a specialised lawyer before relying on any point.

What does Law 151 of 2020 mean for a dental clinic?

The law protects personal data whether or not it is sensitive. According to the Center, sensitive data includes health data (psychological, mental, physical and genetic), biometric data, financial data and children’s data. A dental patient’s file usually holds health data, so the strictest rules apply to it.

The Center has published that the executive regulations (Ministerial Decision 816 of 2025) were published in the Official Gazette on 1 November 2025 and take effect from the day after publication, and that the one-year period to come into compliance starts from the date the regulations took effect. We do not state here the day the grace period ends, because some sources count it from different dates; ask a lawyer for the exact date.

Who is the controller and who is the processor?

The Center defines the controller as whoever has the authority to decide the purposes and means of processing data, and the processor as whoever processes data on the controller’s behalf and according to its instructions, without deciding the purposes or the essential means.

• The clinic is the controller of its patients’ data: it decides what is recorded and why.
• Synora is the processor, according to the terms of use and the Data Processing Agreement (DPA) published on our website: it processes patient data on the clinic’s behalf, only on its instructions and for the purpose of providing the service. Read the full Data Processing Agreement.
• For the clinic’s account data and subscription invoices, the privacy policy describes Synora as the controller.

Do I need the patient’s consent to record their data?

Article 2 of the law does not allow personal data to be collected or processed except with the explicit consent of the person concerned or in the cases the law permits. Article 12 provides that processing sensitive data requires, except in the cases authorised by law, written and explicit consent from the person concerned, and the guardian’s consent if the data belongs to a child.

Synora’s terms of use state that the clinic is responsible for informing the patient and obtaining their consent (or their guardian’s) to recording their data and storing it electronically and in the cloud through a technology provider, and for keeping proof of this. This consent to data processing is not the same as informed consent forms for medical procedures, which are a different subject regulated by other bodies.

How long should patient data be kept?

Article 3 requires that data collected, processed and kept is not kept longer than needed to achieve the specified purpose. In the sources we reviewed, we did not find a general set period for patient records in dental clinics, so we do not give a number. Synora’s terms say the clinic remains responsible for the medical record retention periods the law requires even after it leaves the software, which is why they advise exporting the data before closing the account. The security page states that the clinic owner on the Basic or Pro plan can download a full export from Settings → Data export, and that the free plan allows a written request.

What do I do if there is a data breach?

According to the Center, the controller and the processor must notify the Center within 72 hours of becoming aware of the breach (immediately if it involves national security considerations). The person concerned must be notified within three working days of the date of the notification to the Center. The Center provides forms on its website for notifying the Center and for notifying the person concerned.

Synora’s Data Processing Agreement states that Synora notifies the clinic of any breach affecting its data no later than 24 hours after becoming aware of it, and cooperates so the clinic can notify the Center within 72 hours. But the obligation to notify the Center and the patients remains the clinic’s, as the controller.

Can patient data be stored or transferred outside Egypt?

According to the Center, the law and its regulations prohibit transferring personal data outside Egypt without a prior licence or permit from the Center, or in the exceptional cases set out in Article 15. The types of licence the Center grants include a licence for cross-border data transfer that explicitly covers working with cloud computing providers that store the data on servers outside the country.

Here is what we know about Synora: the privacy policy does not yet state the server location; it says it will be stated before it is confirmed. The Data Processing Agreement states that Synora will not store or transfer the clinic’s data outside Egypt except in accordance with Articles 14 to 16 of the law. If the storage location matters to your decision, ask us before you start.

Which licences and permits does the Center grant?

According to the Center, a licence lasts three years and is renewable, and a permit lasts one year and is renewable. The types include: controller, processor, controller-processor, electronic marketing, cross-border data transfer, and visual surveillance. According to the Center’s guidelines, natural persons can apply for permits only, while legal persons apply for licences or permits.

The Center states that the data protection officer is a natural person appointed by the legal representative of the legal person and entered in the Center’s register of data protection officers. We cannot say for certain whether this applies to a clinic run by an individual dentist, or which category fits your clinic, so ask a lawyer or the Center.

What controls does Synora have to protect patient data?

Here we repeat what our security page says, and nothing more:

• Permissions: each staff member gets what their role allows, and a receptionist with the built-in role does not see the medical history, the dental chart or the images. See staff and permissions.
• Access log: every opening of a patient’s dental chart, medical history or images is logged with who opened it and when, and the log cannot be edited or deleted by the database account the software runs under.
• Accounts: optional two-step verification for each user, account lockout after failed sign-in attempts, and connections over HTTPS only.
• Clinic isolation: each clinic’s data is isolated from the others in the database.
• Share links for patients: they have an expiry date, can be protected with a PIN if you wish, and can be revoked.

The same page says this is a description of how the software is designed, not a compliance certificate, and lists what has not been done yet: an independent penetration test has not been carried out, mandatory two-step verification is not available (it is optional for each user), and the hosting details, including the server location, the backup policy and disk encryption, have not been confirmed yet.

How do I get started in practice?

1. Decide who in your clinic has access to patient files, and give each staff member the least access they need.
2. Make the patient’s consent to recording their data part of your reception routine, and keep proof of it.
3. Write down a plan for what you will do if you suspect a breach, including the 72-hour deadline.
4. Ask a lawyer which licence or permit fits your clinic.

You can try Synora for free: the free plan covers up to 50 patients and one account, the software runs in the browser with nothing to download, and the patient list can be imported from an Excel or CSV file (patients only). See Free dental software, the getting started guide and patient records.

Note: This content is for general awareness and guidance only and is not legal, tax or medical advice. Check with the Dental Syndicate, the Ministry of Health and your accountant.

Sources

1. Personal Data Protection Center (PDPC), FAQ: breaches, data transfers, the data protection officer, licences and the start of the executive regulations (accessed 30 September 2026)
2. Personal Data Protection Center (PDPC), official website, services page and types of licences and permits (accessed 30 September 2026)
3. Personal Data Protection Center, Licenses and Permits guidelines (PDF in English, accessed 30 September 2026)
4. Ministry of Communications and Information Technology, Law No. 151 of 2020 (scanned PDF, availability checked on 30 September 2026)
5. Text of Law 151 of 2020 as published by LawHub, unofficial version (Articles 2, 3 and 12 read on 30 September 2026)