Egypt has no dedicated artificial intelligence statute in force. Companies that deploy AI, and lawyers who use it, are therefore governed by existing law applied to new facts. The main instrument is Personal Data Protection Law No. 151 of 2020, whose executive regulations were issued by Ministry of Communications and Information Technology Decision No. 816 of 2025 and, according to secondary sources, took effect on 2 November 2025. Around it sit the Intellectual Property Law No. 82 of 2002, the Advocacy Law No. 17 of 1983 and the ordinary rules of contract. At Hind Bin Al Sheikh & Partners we begin every AI engagement by mapping which of these instruments the system actually touches.
There is no AI statute, so the existing law decides
Our first advice to a client is to stop waiting for an AI law. The National Council for Artificial Intelligence published the second edition of the National AI Strategy for 2025-2030, and an earlier Egyptian Charter for Responsible AI sets out guidelines. Both are policy and soft-law documents. Neither creates a penalty or a private right of action, and we do not present them to clients as binding rules.
What binds is the Personal Data Protection Law, the Intellectual Property Law, the Advocacy Law and the contract the parties sign. When we review an AI deployment we therefore ask four plain questions: does the system process personal data, who owns what it produces, who is liable when it is wrong, and does a regulated profession sit behind it. The answers decide the legal work, and they also tell us whether the client needs a data license, a contract rewrite or only a short internal policy.
When an AI system falls inside Law No. 151 of 2020
Article 1 of Law No. 151 of 2020 defines the scope as the electronic processing of personal data of natural persons, wholly or partly. An AI tool that reads customer emails, scores applicants, transcribes calls or profiles users is processing personal data electronically, so the law applies whatever label the vendor puts on the product. Data about companies is outside the definition, but staff, customers and signatories are natural persons.
We also check who is in scope. The law applies to the controller and the processor, and the executive regulations add a duty for a foreign processor with no branch in Egypt to appoint a local representative approved by the Personal Data Protection Center (the Center) under Article 4, item 5, of Ministerial Decision No. 816 of 2025. A foreign AI vendor that hosts or trains on Egyptian data is not outside the regime merely because its servers are abroad.
Consent, purpose and lawful grounds for AI processing
Article 2 of Law No. 151 of 2020 requires the explicit consent of the data subject, and Article 3 requires that data is collected for legitimate, specific and declared purposes, is accurate and is kept no longer than needed. Article 6 sets out the lawful grounds for processing. A consent form that says "data may be used to improve our services" is a weak basis for training a model, because the purpose is neither specific nor declared in a way the data subject can test.
Our standing advice is to write the AI purpose into the notice and the consent separately from the service purpose, and to keep proof of consent in a form that can be produced. Under Article 11, digital evidence has the same probative value as written evidence, so a well-kept electronic consent record is useful in a dispute and a missing one is a problem. We also advise keeping the consent text, its date and the version shown to the user together in one record.
Controller and processor: who answers for the vendor
Article 4 of the law sets the obligations of the controller and Article 5 those of the processor. A processor acts only on written instructions from the controller, must delete the data when the engagement ends and cannot use it for its own purposes. The company that buys an AI tool is normally the controller. The vendor is normally the processor, and the contract has to say so.
The practical point is that responsibility does not transfer with the license. A company that cannot show written instructions to its AI vendor, a deletion obligation and a limit on secondary use is exposed under Articles 4 and 5, and the penalty provisions that follow are aimed at the controller as much as the vendor. When we review a vendor agreement we read these three clauses before the price, and we ask whether the vendor may use client data to improve its own models, because that single permission changes the risk.
AI training and emerging technologies under the executive regulations
Ministerial Decision No. 816 of 2025 speaks to AI directly. Article 4, item 7, requires a processor that handles personal data for AI training and for emerging and innovative technologies to follow principles recognized locally, regionally and internationally, so that the use of the technology causes no harm to the data subject. The regulations do not list those principles, and we do not claim a fixed checklist exists. Clients should expect the Center to read the clause alongside the consent and purpose rules, and we advise against treating it as a stand-alone permission.
In practice we treat the clause as a documented-diligence duty. A processor should be able to show what data entered training, on what consent, how it was minimized, and what controls limit harm to the person. When a client asks whether personal data may train a model, our answer starts with the consent and the declared purpose, and it ends with that Article 4 clause.
Data subject rights and objection to automated outcomes
Article 2 gives the data subject the right to know and access the data, to withdraw consent, to correct it, to restrict processing, to be told of a breach and to object to the processing or its outcomes where these conflict with fundamental rights and freedoms. The words "outcomes of the processing" matter for AI, because they reach decisions that a model produces about a person.
The law caps the fee for exercising these rights at EGP 20,000 under the same Article 2, and refusing a request is an offense under Article 37, with a fine between EGP 100,000 and EGP 1,000,000. A company using AI scoring should therefore have a working route for the data subject to request access, correction and review, and a record of how each request was answered.
Sensitive data and transfers abroad
Article 12 treats sensitive data, including health and financial data and data of children, as a protected category. Processing it requires a license from the Center and written explicit consent. Egypt's executive regulations add that a child under 15 needs the written consent of a guardian. An AI product built for health, credit or education will usually meet this category and must plan for the license early.
Article 14 allows transfer abroad only to a country that gives a level of protection not lower than Egyptian law and only with a license or permit from the Center. Article 15 allows a transfer to a country without that level only with the data subject's explicit consent plus one of the listed cases, including medical care, legal claims, a contract in the data subject's interest, public health and international agreements. Article 16 deals with making data available abroad. Many AI services run on foreign cloud infrastructure, including hosted chat and document tools, so a transfer is often built into the product. We map where data is stored and processed before we advise on go-live, and we ask the vendor to confirm in writing which locations and sub-processors touch the data.
Breach notice, the data protection officer and the Center
Under Article 7 of the law, the controller and the processor must notify the Center within 72 hours of learning of a data breach, and immediately where the breach concerns national security, and Article 5 of Ministerial Decision No. 816 of 2025 sets the route through the Center's portal or hotline and requires a record. Articles 8 and 9 deal with the Data Protection Officer, and the executive regulations set the registration conditions for those officers.
An AI incident, such as a model that exposes one customer's data to another, is a breach in this sense. We advise clients to hold a written incident procedure, to name the officer and to test the 72-hour clock in advance, because the clock runs from the moment the controller learns of the breach and not from the end of an internal review.
Penalties for getting it wrong
The penalties in Law No. 151 of 2020 are material. Article 36 provides a fine of EGP 100,000 to EGP 1,000,000 for unlawful handling of personal data, rising to at least six months' imprisonment and a fine of EGP 200,000 to EGP 2,000,000, or either penalty, where there is a gain or an intent to harm. Article 38 sets EGP 300,000 to EGP 3,000,000 for breaching Articles 4, 5 and 7.
Article 41 covers sensitive data, with imprisonment of at least three months and a fine of EGP 500,000 to EGP 5,000,000, or either penalty, and Article 42 sets the same range for unlawful transfer abroad. Under Article 5 of the issuing law, the economic courts have jurisdiction over these crimes. We tell boards that these figures are the reason an AI data map is cheaper than an AI incident, and a board that has seen the numbers usually approves the review without delay.
Who owns AI output, and what the contract must say
Article 138 of the Intellectual Property Law No. 82 of 2002 defines the author as the person who created the work, and Egyptian practice looks for the imprint of the author's personality. The law contains no rule that gives authorship to a machine, and we have not found Egyptian case law that does. Ownership of AI output should therefore be settled by contract and not assumed from the tool.
Our standing advice is to state in the vendor agreement who owns the output, who owns the inputs, whether the vendor may train on client data, and who bears liability for infringing output. Where output carries commercial value, we recommend that a human author contributes recognizable creative choices and that the file records them.
Lawyers and AI: confidentiality and professional duty
Article 65 of the Advocacy Law No. 17 of 1983 requires a lawyer to refrain from testifying about facts and information learned through the profession when the person who disclosed them asks for confidentiality, unless they were disclosed to commit a felony or misdemeanor. That duty does not pause when a lawyer pastes a client document into a public AI tool.
When we use AI in our own work, we treat the tool as a third-party processor: no client facts go into a service that retains or trains on them without a written processor agreement, and a lawyer remains personally responsible for checking every citation and every draft. We advise other firms and in-house teams to adopt the same rule.
What we review in an AI deployment in Egypt
When we review an AI deployment in Egypt, we read the vendor contract, the consent notice and the data map against Articles 2 to 7 of Law No. 151 of 2020. We check the controller and processor roles, the AI training clause in Ministerial Decision No. 816 of 2025, any license needed for sensitive data or transfer, the breach procedure and the ownership terms for output, and we record the result in a short decision file.
See also: our Egypt data protection guide and our Egypt intellectual property guide, plus our commercial and corporate practice.
Frequently asked questions
Is there an AI law in Egypt?
No. No dedicated AI statute is in force. The National AI Strategy 2025-2030 and the Egyptian Charter for Responsible AI are policy documents, and the binding rules come from Law No. 151 of 2020, the Intellectual Property Law and the contract.
Does Law No. 151 of 2020 apply to an AI tool?
Yes, when it processes personal data of natural persons electronically, as Article 1 provides. The vendor's label for the product is irrelevant to that test.
Can we train a model on customer data?
Only with explicit consent under Article 2, a specific declared purpose under Article 3, and a processor that follows the Article 4 duty in Ministerial Decision No. 816 of 2025 on AI training. Without those, we advise against it.
How fast must we report a breach?
To the Center within 72 hours of learning of the breach, and immediately if it concerns national security, under Article 7 of the law and Article 5 of Ministerial Decision No. 816 of 2025, and the report must be recorded.
Can the data go to a foreign AI provider?
Generally only if the destination meets the adequacy test and the Center grants a license or permit under Article 14; Article 15 lists narrow exceptions that need the data subject's explicit consent. Plan the license before the launch date, not after.
Who owns what the AI produces?
The law does not give authorship to a machine, since Article 138 of Law No. 82 of 2002 speaks of the person who created the work. Put ownership in the contract.
May a lawyer use a public AI tool for client files?
Not with confidential material. Article 65 of the Advocacy Law protects what a client discloses, and a public tool is an uncontrolled third party.
Can Hind Bin Al Sheikh & Partners review our AI contracts and data map?
Yes. Use the contact page and tell us which systems and vendors are involved, and we will confirm the scope and next steps.