Egypt now has a full data protection regime. The Personal Data Protection Law No. 151 of 2020 sets the rules, and the Minister of Communications and Information Technology issued its Executive Regulations by Decision No. 816 of 2025, which started the one-year period for businesses to regularize their position. That period ends at the turn of October to November 2026, so the regime is about to become enforceable in practice. From our Cairo office we advise controllers and processors on what the law requires: consent, individual rights, licenses and permits, the data protection officer, breach reporting, cross-border transfers, marketing and penalties. This article sets out those duties by statute and article number.
The framework: Law 151 of 2020, its Executive Regulations and the Cybercrime Law
Law No. 151 of 2020 protects personal data processed electronically, in whole or in part, by any holder, controller or processor, and it protects natural persons only. It created the Personal Data Protection Center, a public economic authority attached to the Minister of Communications and Information Technology, which issues licenses and permits, receives complaints and breach notices, inspects and sanctions. The Executive Regulations, issued by Ministerial Decision No. 816 of 2025 and in force from the day after their publication in the Official Gazette, fix the procedures, fees and technical standards the law left open.
Law No. 175 of 2018 on combating information technology crimes sits beside the data protection law. Article 2 requires service providers to keep user identification, traffic and terminal data for 180 days and to keep that data confidential, and Article 25 punishes anyone who infringes privacy or supplies personal data to an electronic system or website to promote goods or services without consent. The two laws overlap, so an incident can trigger regulatory duties under Law 151 and criminal exposure under Law 175 at the same time.
Scope: who is covered and what is excluded
The issuing articles of Law No. 151 of 2020 extend its criminal provisions to Egyptians wherever they act, to non-Egyptians residing in Egypt, and to non-Egyptians abroad where the act is also criminal in the place committed and the data concerns Egyptians or foreigners residing in Egypt. The Economic Courts have jurisdiction over the offenses. A foreign business that handles Egyptian users' data therefore cannot treat the law as a purely local matter, and Article 4 requires a controller located abroad to appoint a representative in Egypt as the Executive Regulations specify.
The law excludes data kept by natural persons for personal use, data processed for official statistics, data processed exclusively for journalistic or media purposes where it is accurate, data in judicial seizure records, investigations and court proceedings, data held by the national security authorities, and data held by the Central Bank of Egypt and the entities it supervises, other than money transfer and currency exchange companies. We check each exclusion against the facts before a client relies on it, because exclusions are read narrowly.
The grace period and the November 2026 deadline
Article 6 of the issuing law gives entities subject to the law one year from the issue of the Executive Regulations to regularize their position. According to law-firm and press reports, the Regulations were issued on 1 November 2025 (we found no official gazette copy), so firms report the deadline as 31 October or 1 November 2026, depending on how the year is counted. The Regulations were not made publicly available until late December 2025, and some commentators have asked whether the Center might apply a later date. We advise clients to plan on the statutory date and not to rely on any extension, because none has been announced in the sources we reviewed.
The Center has opened an electronic portal for license, permit and accreditation applications. Creating a profile and filing applications require authentication through the Egyptian government's Digital Egypt platform, which is linked to an Egyptian national ID, so a foreign controller needs a duly authorized local representative. Article 27 of the law allows the Center ninety days to decide a complete application, and silence counts as rejection. A business that files late may still be unlicensed when the grace period ends, and our advice is to file now.
Consent and lawful processing
Article 2 of Law No. 151 of 2020 prohibits collecting, processing, disclosing or revealing personal data by any means without the data subject's explicit consent, unless the law allows it. Article 3 requires that data be collected for legitimate, specific and declared purposes, be accurate and secure, be processed lawfully and in line with its purposes, and not be kept longer than necessary. Article 6 treats processing as lawful where there is explicit consent, necessity for a contract or legal claim, a legal obligation or judicial order, or the controller's legitimate right where it does not override the data subject's fundamental rights.
Article 2 of the Executive Regulations adds that a natural person who supplies data to receive a lawful service is taken to consent to collection and processing for that purpose only, and the data may not be used for other purposes without prior consent. The regulations also require the Center's approval of the mechanism used to collect data and to obtain consent, including a guardian's consent for children. In our review, we test every consent screen against these two articles, because a notice that does not match the actual purposes is the commonest defect.
Individual rights, requests and complaints
Article 2 gives the data subject the right to know and access their data, to withdraw consent, to ask for correction, modification, deletion, addition or updating, to restrict processing to a defined scope, to be notified of a breach, and to object to processing that conflicts with their fundamental rights and freedoms. Except for the right to breach notification, the data subject bears the cost of the service, and the Center sets the fees up to a ceiling of EGP 20,000. Articles 10 and 32 require a written request to be decided within six working days, and a refusal must be reasoned, and silence counts as refusal.
Article 33 lets a data subject or a person with a direct interest complain to the Center, which investigates and decides within thirty working days. The party complained against must implement the decision within seven working days of notice and send the Center evidence of compliance. Article 37 fines a holder, controller or processor between EGP 100,000 and EGP 1,000,000 for unlawfully refusing to enable these rights. We therefore build a request procedure with a six-day clock, identity checks and a logged reason for every refusal.
Controller and processor duties and the data protection officer
Article 4 requires a controller to obtain data lawfully, check accuracy and relevance, apply technical and organizational measures, erase data when its purpose ends unless it is kept in non-identifiable form, correct inaccuracies, keep a record of data categories, recipients, deletion mechanisms, transfers and security measures, obtain a license or permit from the Center and allow inspection. Article 5 sets parallel duties for processors, who act under a written agreement. Where several controllers are involved, each is individually responsible for full compliance.
Article 8 requires the legal representative of a controller or processor that is a legal entity to appoint a qualified employee as data protection officer, register that person in the Center's register and disclose the appointment publicly. Article 9 sets the officer's duties: periodic audits, contact with the Center, handling data subject requests, breach notification and staff training. Articles 7 to 12 of the Executive Regulations require qualifications, a Center test, a clean record, a unique officer code and fifteen days' notice to the Center before an officer is replaced.
Licenses and permits
Article 26 of the law lets the Center issue licenses and permits to controllers and processors, for direct electronic marketing, for visual surveillance in public spaces, for sensitive data and for cross-border transfers, and accreditation to data protection consultants. It caps license fees at EGP 2,000,000 and permit and accreditation fees at EGP 500,000. Article 19 of the Executive Regulations provides a consolidated annual license for legal entities with fees scaled to the number of records held, and for the largest holders sets the fee at the legal maximum of EGP 666,666 a year, EGP 2,000,000 over three years.
A permit under Article 20 of the Regulations is temporary and lasts no more than one year. License applications must evidence the consent mechanism, the electronic records, security measures, the officer's contract and independence, and compliance for sensitive and children's data under Article 21. The Center must decide within ninety days of a complete file under Article 27 of the law. Operating without a license is an offense under Article 45, punishable by a fine of EGP 500,000 to EGP 5,000,000, so classification of the license type comes first in every engagement.
Breach notification: 72 hours and three working days
Article 7 of the law requires a controller or processor to notify the Center within seventy-two hours of becoming aware of any breach of personal data in its possession, and immediately if the breach touches national security. Within the same seventy-two hours it must give the Center a description of the nature, form, causes and estimated volume, the officer's contact details, the likely consequences, the measures taken and the documentation of the incident. It must notify the data subject within three working days of notifying the Center.
Article 5 of the Executive Regulations requires notice through the Center's electronic portal or hotline, recorded with the time of awareness and the time of reporting, and adds that the notice to the data subject must describe the security measures taken. Failure to comply with Article 7 is punishable under Article 38 by a fine of EGP 300,000 to EGP 3,000,000. In practice the seventy-two hours run from awareness, not from confirmation of cause, so an incident plan needs a named decision-maker and an evidence log from the first hour.
Cross-border transfers
Article 14 of the law prohibits transferring personal data abroad, or storing or sharing it there, unless the destination offers protection no lower than the law provides and the Center licenses or authorizes the transfer. Article 15 lists exceptions that need the data subject's explicit consent, including medical care, legal claims, performance of a contract in the data subject's favor, judicial cooperation, financial transfers and international agreements. Article 16 allows data to be made available to another controller outside Egypt only under a license, where activities are consistent, there is a legitimate interest and protection is not lower.
Article 16 of the Executive Regulations requires a license or permit and the data subject's consent, limits transfers to the countries named in the license, and has the Center publish the countries it considers adequate based on their legislation, security measures and compensation rules. The Center decides within ninety business days under Article 26 of the Regulations. Violating these rules is punishable under Article 42 by imprisonment of at least three months and a fine of EGP 500,000 to EGP 5,000,000, or one of them. Cloud hosting abroad is a transfer, so we map every system and sub-processor location before filing.
Sensitive data, children and direct marketing
Article 12 prohibits collecting, transferring, storing or processing sensitive personal data without a Center license and, except in cases the law allows, written and explicit consent. Sensitive data covers health, genetic and biometric data, financial data, religious beliefs, political opinions and security status, and children's data is always treated as sensitive. Article 15 of the Executive Regulations requires a guardian's written consent for children under fifteen and a guardian's consent for those from fifteen to eighteen. Article 41 punishes unlawful handling of sensitive data with at least three months' imprisonment and a fine of EGP 500,000 to EGP 5,000,000, or either penalty.
Article 17 allows electronic direct marketing only with prior consent, a clearly identified sender and valid address, an explicit marketing label and an easy opt-out. Article 18 forbids disclosing the recipient's contact details and requires consent records for three years from the last message. Article 18 of the Executive Regulations adds a marketing license and deletion on withdrawal. Article 43 fines violations between EGP 200,000 and EGP 2,000,000. We audit lists, opt-out handling and agency contracts before any campaign is licensed.
Penalties, liability and settlement
Article 36 fines unlawful collection, processing, disclosure or transfer without consent or legal authority between EGP 100,000 and EGP 1,000,000, and where the act is for gain or intended to harm the data subject, imprisonment of at least six months and a fine of EGP 200,000 to EGP 2,000,000, or either penalty. Article 39 fines a legal representative who fails to appoint the officer, and Article 40 fines an officer who neglects the duties of Article 9. Under Article 47, the person who actually manages the entity is punished too, where aware of the violation, and the entity is jointly liable for compensation.
Article 30 gives the Center administrative sanctions after a warning: suspension, withdrawal or cancellation of a license, publication of the violations and technical supervision at the violator's expense. Article 48 doubles penalties for recidivism and orders publication of convictions. Article 49 permits settlement with the Center or the victim at any stage before a final judgment for most offenses, on payment of half the minimum fine before the case is filed, or half the maximum fine afterwards. Settlement ends the criminal case, so early engagement with the Center can reduce exposure.
What we review in an Egypt data protection and privacy file
When we review an Egypt data protection file, we first decide whether the client is a controller, a processor or both, and which licenses and permits follow. We then test consent wording against Articles 2, 3 and 6, check the six-day request procedure, confirm the data protection officer appointment under Articles 8 and 9, and rehearse the seventy-two hour breach route under Article 7. We map every transfer abroad against Articles 14 to 16, review marketing flows against Articles 17 and 18, and prepare the license file for the Center's portal before the deadline.
See also: our guide to Investment Law 72 of 2017 incentives and our Egypt company formation guide, plus our commercial and corporate practice.
Frequently asked questions
Is Egypt's data protection law in force?
Yes. Law No. 151 of 2020 is in force and its Executive Regulations were issued by Decision No. 816 of 2025. Article 6 of the issuing law gave entities one year from the issue of those Regulations to regularize, which ends at the turn of October to November 2026.
Do I need a license from the Personal Data Protection Center?
Generally yes. Article 4 of the law requires a controller to hold a license or permit, and Article 45 fines violations of the licensing provisions between EGP 500,000 and EGP 5,000,000. Separate licenses or permits apply to marketing, surveillance and cross-border transfers.
Do I need a data protection officer?
Yes, if you are a legal entity. Article 8 requires the legal representative to appoint a qualified employee, register the officer with the Center and disclose the appointment, and Article 39 fines failure to do so between EGP 200,000 and EGP 2,000,000.
How fast must a breach be reported?
Within seventy-two hours of becoming aware under Article 7, and immediately where national security is involved. The data subject must be told within three working days of the notice to the Center.
Can I store Egyptian customer data abroad?
Only with a Center license or permit and the data subject's consent, to a country the Center considers adequately protected, under Article 14 of the law and Article 16 of the Executive Regulations. Unauthorized transfer is an offense under Article 42.
How long do I have to answer an access request?
Six working days from submission under Articles 10 and 32, with reasons for any refusal. A complaint to the Center is decided within thirty working days under Article 33.
What are the maximum penalties?
They depend on the breach. Fines reach EGP 5,000,000 and imprisonment applies to sensitive data and transfer offenses under Articles 41 and 42, penalties double for repeat offenses under Article 48, and Law No. 175 of 2018 adds separate criminal penalties for privacy violations.
Do you advise on Egypt data protection compliance?
Yes. We classify your role, prepare license and permit files, draft consent and privacy documents, set up breach procedures and represent clients before the Center. Please contact us through our contact page to discuss your situation.