An Egyptian technology project sits under four statutes at once: the Telecommunication Regulation Law No. 10 of 2003 and its regulator, the National Telecommunications Regulatory Authority; the E-Signature Law No. 15 of 2004; the Anti-Cybercrime Law No. 175 of 2018; and the Personal Data Protection Law No. 151 of 2020, whose executive regulations under Ministerial Decision No. 816 of 2025 entered into force in November 2025 and made the licensing regime operational. This article maps what each layer requires of a connectivity, hosting, cloud, platform or software business serving Egyptian customers, and how our firm reviews the stack before launch, contract or change.
Map the service before asking license questions
List what the Egyptian customer actually receives: connectivity, hosting, cloud capacity, a platform, content, payment features or pure software. Record which entity sells, which operates, and which vendors sit underneath, because Law No. 10 of 2003 regulates networks and services, not business labels. A general technology brand tells the regulator nothing; our standing advice is to fix the function of each component against the definitions of Article 1 of that law before any compliance question is answered.
Draw the customer path from signup through billing and support, and compare the company described on the website with the entity named in contracts and invoices. Identify physical and remote components, customer locations and offshore access. If a partner runs part of the service, record what that partner can change and which promises the customer still expects from the seller, because Egyptian enforcement looks through the brand to the operator.
NTRA licensing under Law No. 10 of 2003
Article 21 of Law No. 10 of 2003 prohibits establishing or operating telecommunication networks, providing telecommunication services, bypassing international telephone calls, or announcing any of these, without a license from the NTRA. The single carve-out is a private telecommunication network that uses no radio systems, which needs no license, though the licensed operator whose infrastructure carries it must notify the NTRA. Article 22 sets the process: application on NTRA forms with evidence of technical and financial capability, and a decision within ninety days of a complete file, failing which the application is deemed rejected.
Article 23 leaves license fees and collection rules to the NTRA Board. License conditions are published in the Official Gazette or a widely circulated daily at the licensee's expense under Article 21, and Article 25 imposes general obligations on licensees, while Articles 28 to 33 govern interconnection, mediation, cross-subsidies and agreements between licensees. When we review an Egyptian launch, the first question is always whether any component amounts to operating a network or providing a service under Article 21, because everything else follows from that answer.
Equipment, type approval and spectrum
Hardware is separately controlled. Article 44 of Law No. 10 of 2003 restricts the import, manufacture and assembly of telecommunication equipment to permitted parties, Article 46 prohibits importing and selling used terminal equipment, and Article 48 gives the NTRA the power to set type-approval rules and permits for importing, manufacturing, trading and marketing equipment, with a decision due within ninety days of a complete application. Radio equipment possession and operation without a permit is a criminal matter under Article 77.
Spectrum is managed by the NTRA under Articles 49 to 59: it allocates and assigns frequencies, grants and cancels spectrum licenses under Article 51, sets fees under Article 53, inspects use under Article 55 and maintains the user database under Article 58. Any product that emits radio, from a Wi-Fi system to an IoT device fleet, needs its frequency position confirmed before import or deployment, not after customs or the NTRA intervenes.
Penalties that shape the risk analysis
Article 72 of Law No. 10 of 2003 punishes unlicensed establishment or operation of networks, infrastructure, services, or bypass of international calls with imprisonment of six months to five years and a fine of fifty thousand to five hundred thousand pounds, or either, plus confiscation of equipment. Article 77 punishes importing, manufacturing, possessing or operating radio equipment without a permit with at least one year of imprisonment and a fine of twenty thousand to fifty thousand pounds, or either, with confiscation in all cases.
Article 73 protects the privacy of communications with criminal penalties, and Article 78 punishes deliberate interception of, or interference with, radio waves assigned to others. These are not theoretical risks: the NTRA has inspection and monitoring powers under Articles 55 and 19, and administrative confiscation powers under Article 11. Our reviews treat the penalty map as the baseline for deciding which components of a service must be licensed, permitted or restructured.
Personal data protection under Law No. 151 of 2020
Law No. 151 of 2020 is Egypt's general data protection statute. Article 2 prohibits collecting, processing, disclosing or revealing personal data except with the explicit consent of the data subject or as permitted by law, and grants the data subject rights of access, withdrawal of consent, correction, deletion, limitation, breach notification and objection. Article 3 sets the conditions for lawful collection, processing and retention, including purpose limitation and adequacy. Article 36 fines unauthorized processing between one hundred thousand and one million pounds, with harsher treatment where processing is for material benefit or to harm the data subject.
The law created the Personal Data Protection Center as regulator, with licensing and permit powers under Article 26. Cross-border transfer is controlled by Articles 14 to 16: transfer, storage or sharing abroad requires an adequate level of protection and a license or permit from the Center, subject to the consent-based and necessity exceptions in Article 15. Article 33 gives data subjects a complaint route to the Center, which must decide within thirty working days, and the respondent must execute the decision within seven working days of notice.
The 2025 executive regulations make it operational
Ministerial Decision No. 816 of 2025 issued the executive regulations of Law No. 151 of 2020, in force from 2 November 2025 according to secondary sources. The regulations create a graduated licensing and permitting regime run by the Center: controllers and processors must hold a license or permit matched to their activity, with tiered fees that rise with the number of personal data records processed, reaching several hundred thousand pounds per year for the largest volumes and capped at two million pounds over a three-year license term. Controller-only or processor-only licenses for legal entities are set at half the table value.
The regulations also operationalize the details: registration of data protection officers, secure electronic processing records, conditions for licenses and permits for cross-border transfers under Articles 24 to 27, a specific license for direct electronic marketing under Article 28, and accreditation certificates valid for three years. Any Egyptian business that collects customer or employee data should now treat Center licensing as a live compliance item, not a future one, and we verify the current fee table and forms against the client's actual record volumes before filing.
Breach notification duties
Article 5 of the executive regulations sets the breach clock: the controller or processor must notify the Center through its electronic portal or hotline within seventy-two hours of becoming aware of a breach or violation, recording the time of awareness, the nature of the breach, an estimate of the compromised data, the expected effects, the corrective measures taken and the data protection officer's contact details. Breaches touching national security must be reported immediately.
The data subject must then be notified within three working days of the Center notification, by the means agreed at collection, such as text message, email or telephone. These deadlines decide how incident response plans must be drafted: detection, assessment and escalation must fit inside seventy-two hours, which means a contractual right to prompt notice from every supplier that holds Egyptian personal data, and a rehearsed internal path to the officer named in the filing.
Cybercrime Law No. 175 of 2018 and the service provider
Law No. 175 of 2018 imposes direct duties on service providers. Article 2 obliges providers to retain and store information system logs continuously for one hundred eighty days, including user identification data, content and traffic data under the provider's control and terminal device data; to preserve the confidentiality of stored data absent a justified judicial order; to secure data against unauthorized access; to display the provider's name, address, contact and licensing information to users and authorities; and to provide technical capabilities to national security agencies as required by law.
Article 7 lets the investigating authority order the blocking of a website, inside or outside Egypt, that broadcasts content constituting a crime under the law and threatening national security or the national economy, with the order placed before the competent court within twenty-four hours and a reasoned decision within seventy-two hours; in urgent cases the NTRA can instruct immediate temporary blocking, which the provider must implement at once. Articles 25 to 27 punish privacy violations, misuse of personal data and the use of sites or accounts to facilitate crime with imprisonment and a fine, or either penalty. Every Egyptian platform needs a blocking-order handling procedure and a log retention architecture that matches Article 2.
Electronic signature and evidence under Law No. 15 of 2004
Law No. 15 of 2004 regulates electronic signatures and established the Information Technology Industry Development Authority, ITIDA. Article 14 gives electronic signatures, within civil, commercial and administrative transactions, the same determinative effect as signatures under the Evidence Law when created and completed in compliance with the law and the technical rules of its executive regulations. Article 15 gives electronic writing the same effect as official and unofficial writing on the same conditions.
Article 18 sets the evidentiary conditions: the signature must be linked to the signatory alone, under their sole control, and any change to the signed data must be detectable. For Egyptian technology contracts, onboarding flows and platform terms, this is the framework that decides whether a click, an OTP flow or a certificate-based signature will stand up in court. When we review contracting architecture, we match each signature flow to Articles 14, 15 and 18 and to the accredited service provider regime that the law and its regulations create.
Align customer promises with the supply chain
Compare advertised availability, response times, security and support with the network, cloud and subcontractor commitments underneath. Assign responsibility for interruptions, planned maintenance, subcontracting and incidents, and test how the customer will be informed and helped if an upstream vendor suspends service. Duties that statutes impose, such as log retention under Article 2 of Law No. 175 of 2018 and breach notification under the data protection regulations, cannot be pushed onto the customer by drafting.
Walk through a sample outage and a sample data request from an authority. Who sees alerts, who can access logs, who authorizes a fix, who tells the customer, and who answers the NTRA or the Personal Data Protection Center? Record escalation contacts and evidence-retention steps. The contract should match the team's actual tools and supplier rights, not promise a response nobody can deliver inside the seventy-two-hour regulatory clock.
Exit, change and the evidence file
Specify export formats, migration help, notice periods, deletion evidence and the treatment of domains, accounts or numbers before dependence builds, and test an export before the contract ends. A supplier's promise to return data has little value if the customer cannot read the format or map it to its own records, and deletion promises must be reconciled with the one-hundred-eighty-day log retention duty in Article 2 of Law No. 175 of 2018.
A new payment path, local content source or network feature can change the license, data and cybercrime analysis at once. Require an updated review when the product changes, and keep a dated version of decisions and open issues: service maps, NTRA correspondence, Center filings, supplier terms and incident records. That dated file is what regulators, courts and acquirers ask for first, and it is what makes the difference between a defensible launch and an expensive reconstruction.
What we review before an Egyptian technology launch or change
Our first-review file for an Egyptian technology service covers: the service and entity map; the Article 21 licensing analysis under Law No. 10 of 2003, including the private-network carve-out; equipment, type-approval and spectrum checks under Articles 44 to 59; the penalty map in Articles 72 to 78; the data inventory against Law No. 151 of 2020 and the licensing, fee, breach-notification and officer-registration duties of Decision No. 816 of 2025; cross-border transfer structuring under Articles 14 to 16; Article 2 retention and Article 7 blocking readiness under Law No. 175 of 2018; signature flows under Law No. 15 of 2004; and supplier contracts against customer promises, with dated Egyptian advice on every open issue.
See also: our Egypt data protection guide and our Egypt intellectual property guide, plus our commercial and corporate practice.
Frequently asked questions
Does every IT business in Egypt need an NTRA license?
No. Article 21 of Law No. 10 of 2003 requires a license for establishing or operating telecommunication networks, providing telecommunication services or bypassing international calls. A business that only develops software or resells applications, without operating networks or providing telecom services, generally needs no NTRA license, though equipment imports still need permits under Articles 44 and 48 and a private network using radio systems is not within the carve-out.
What happens if a service operates without an NTRA license?
Article 72 of Law No. 10 of 2003 makes unlicensed network operation, service provision or international call bypass a criminal offense carrying six months to five years of imprisonment and a fine of fifty thousand to five hundred thousand pounds, or either, with confiscation of the equipment used. Restructuring after an investigation is far costlier than a licensing analysis before launch.
Is the Egyptian data protection law actually being enforced now?
Yes. Law No. 151 of 2020 has been in force since 2020, and Ministerial Decision No. 816 of 2025 brought the executive regulations into force, according to secondary sources on 2 November 2025, activating the Personal Data Protection Center's licensing and permitting regime, tiered fees, data protection officer registration and breach notification duties. Controllers and processors of Egyptian personal data should treat licensing as a current obligation.
How fast must a data breach be reported in Egypt?
Article 5 of the 2025 executive regulations requires the controller or processor to notify the Personal Data Protection Center within seventy-two hours of becoming aware of a breach, and to notify the affected data subjects within three working days after that, using the contact means agreed at collection. Incident response plans and supplier contracts must be built to fit inside that clock.
Can personal data be transferred outside Egypt?
Only within Articles 14 to 16 of Law No. 151 of 2020: cross-border transfer, storage or sharing requires an adequate protection level abroad and a license or permit from the Center, unless an exception in Article 15 applies, such as explicit consent for the listed cases or performance of a contract benefiting the data subject. The 2025 regulations set the application conditions, and we structure transfers around them.
Are electronic signatures valid in Egypt?
Yes. Article 14 of Law No. 15 of 2004 gives compliant electronic signatures the same determinative effect as handwritten signatures under the Evidence Law in civil, commercial and administrative transactions, and Article 15 does the same for electronic writing. Article 18 requires the signature to be uniquely linked to and solely controlled by the signatory, with any alteration detectable, so the flow and the certificate architecture matter as much as the signature itself.
What must a platform do about website blocking orders?
Article 7 of Law No. 175 of 2018 allows investigating authorities to order blocking of sites broadcasting criminal content that threatens national security or the economy, subject to court review within twenty-four hours and a decision within seventy-two hours, and in urgent cases the NTRA can require immediate temporary blocking. Service providers must implement such notifications at once, so every provider needs a documented intake and execution procedure.
How do we engage the firm on an Egyptian technology matter?
Send the service description, draft contracts and supplier list through the contact page, and we will scope a first review covering NTRA licensing, data protection, cybercrime duties and contracting as described above. Our Cairo office handles these reviews routinely, and early scoping is materially cheaper than restructuring after the NTRA or the Center raises the issue.