Data protection & privacy law in Egypt (2026)

Law No. 151 of 2020 Promulgating the Personal Data Protection Law was published in the Official Gazette in July 2020 and entered into force on 14 October 2020, creating Egypt's first comprehensive personal-data regime covering electronic processing of personal data with extraterritorial reach.

MCIT Decree No. 816 of 2025, issued on 1 November 2025, enacted the Executive Regulations to the PDPL — providing detailed operational rules on consent, licensing, record-keeping, breach notification, cross-border transfers, special-category and children's data, and direct electronic marketing.

The Personal Data Protection Center (PDPC), affiliated with MCIT, has been established as the sole supervisory authority. It licenses controllers/processors, issues guidance, receives complaints, investigates breaches and imposes administrative sanctions.

The Executive Regulations grant in-scope organisations a one-year transitional period; full enforcement of substantive PDPL obligations begins on 31 October / 1 November 2026, by which point controllers and processors must have completed licensing, DPO appointment where required, and record-keeping.

Transfers of personal data outside Egypt require a licence or permit from the PDPC, based on an adequacy-style assessment of the destination country, plus the explicit consent of the data subject; limited derogations are available under Article 15 of the PDPL.

The regime requires lawful basis / prior informed consent, purpose limitation, data minimisation and defined retention, appointment of a Data Protection Officer in prescribed cases, maintenance of processing records, security-by-design, and 72-hour breach notification to the PDPC. Data subjects have GDPR-style rights of access, rectification, erasure, withdrawal of consent and objection.

The PDPL provides for administrative fines up to EGP 5 million and criminal penalties including imprisonment (generally six months or more) for serious violations such as unlawful processing, unauthorised cross-border transfers, or failure to notify breaches.