Cybersecurity · Egypt
Cybersecurity law & regulation in Egypt (2026)
Egypt shaded by its cybersecurity status
Cybersecurity in Egypt: sectoral rules.
FrameworkLayered regime: Anti-Cyber and Information Technology Crimes Law No. 175/2018 (cybercrime + telecom/service-provider duties); Personal Data Protection Law No. 151/2020 with Executive Regulations No. 816/2025 (breach notification); Central Bank of Egypt Financial Cybersecurity Framework (EGY-FIN CSF, 2021) for banks; Telecommunications Regulation Law No. 10/2003 governing NTRA/EG-CERT; National Cybersecurity Strategy 2023–2027 overseen by the Supreme Council for Cybersecurity.
Egypt has no single NIS2-style horizontal cybersecurity statute; instead it relies on a combination of a comprehensive cybercrime law (Law 175/2018), a data protection law with security and breach-reporting duties (Law 151/2020, now operational after 2025 executive regulations), and sector-specific frameworks — most notably the Central Bank's mandatory financial cybersecurity framework and NTRA/EG-CERT oversight of telecoms and critical information infrastructure. National direction is set by the Supreme Council for Cybersecurity and the 2023–2027 National Cybersecurity Strategy, and Egypt is ranked in ITU Global Cybersecurity Index Tier 1.
Key points
Egypt's Anti-Cyber and Information Technology Crimes Law criminalises unauthorised access, hacking and online fraud, and imposes obligations on service providers to retain user/traffic data for 180 days and cooperate with authorities on national-security threats.
Controllers and processors must notify the Personal Data Protection Center within 72 hours of becoming aware of a breach (immediately where national security is implicated) and inform affected individuals within three working days. Executive Regulations No. 816/2025 (issued 1 November 2025) activated the regime; full enforcement lands after the one-year grace period on 31 October 2026.
The Central Bank of Egypt issued the Egypt Financial Cybersecurity Framework v1.0 in December 2021, setting mandated controls and maturity levels for banks and financial institutions, and established a sectoral CERT for the financial and banking sector.
The Supreme Council for Cybersecurity, chaired by the Minister of Communications and IT under the Cabinet, launched the National Cybersecurity Strategy 2023–2027. EG-CERT, established by the NTRA in April 2009, provides incident response and early-warning services for government, finance and critical information infrastructure.
The Telecommunications Regulation Law No. 10 of 2003 empowers the NTRA to regulate operators and, under Article 67, place providers under direct state control during national-security incidents, natural disasters or general mobilisation — the principal legal hook for critical information infrastructure resilience.
In the ITU Global Cybersecurity Index 2023–2024, Egypt (represented by NTRA/EG-CERT) is classified in Tier 1 with 100 points, one of 47 countries in the top tier.
Timeline - major decisions & events
Five years after the PDPL was passed, Egypt issued its Executive Regulations via MCIT Decision No. 81 of 2025 (published in Official Gazette Issue 244), finally operationalizing breach-notification, data-controller registration, cross-border transfer rules and security obligations, with a one-year grace period before full enforcement (~October 2026).
Baker McKenzie ↗The Egyptian Supreme Cybersecurity Council launched the second national strategy, aimed at countering rising cyber threats, building cybersecurity human capital, and developing a domestic cybersecurity industry contributing to GDP.
EG-CERT ↗The CBE published Egypt's first comprehensive cybersecurity regulatory framework (EGY-FIN CSF v1.0) for the banking and financial sector, setting mandatory controls and maturity benchmarks for all CBE-licensed entities.
Central Bank of Egypt ↗Egypt's first comprehensive data-protection statute introduced consent requirements, data-subject rights, 72-hour breach notification, mandatory DPOs, and created the Personal Data Protection Center; it entered into force in October 2020.
Ministry of Communications and Information Technology ↗Egypt's principal cybercrime statute criminalized hacking and unauthorized access, imposed 180-day data-retention duties on telecom operators and obligations on service providers, and empowered authorities to block websites threatening national security.
WIPO Lex ↗The Supreme Cybersecurity Council launched Egypt's inaugural national cybersecurity strategy to secure communications and information infrastructure and provide a trusted environment for digital government services.
ITU ↗Prime Ministerial Decree No. 2259 of 2014 created the ESCC, chaired by the MCIT minister with cross-ministry and security-agency membership, mandated to develop and oversee the national cybersecurity strategy.
Egyptian Supreme Cybersecurity Council ↗The National Telecommunications Regulatory Authority founded the Egyptian Computer Emergency Readiness Team to provide 24/7 incident response, forensics, malware analysis and protection of critical information infrastructure.
EG-CERT ↗Egypt's foundational telecom law established the NTRA and, via Article 64, imposed strict controls requiring written approval to use encryption equipment and obliging networks to enable lawful access by security agencies, an early pillar of the cybersecurity/surveillance framework.
NTRA ↗Egypt - other topics
Cybersecurity in other countries
Last verified 9/3/2026 · Orientation, not legal advice - verify against the primary sources linked above. Methodology & how to cite · State of Technology Regulation 2026 · Explore the full world map →