Data protection & privacy law in Egypt (2026)
Data protection in Egypt: comprehensive law.
Egypt has a comprehensive, GDPR-inspired personal data protection regime in force. Law No. 151 of 2020 was enacted on 13 July 2020 and took effect on 14 October 2020, but remained largely unenforceable until the long-awaited Executive Regulations (Decree 816/2025) were issued on 1 November 2025 and the Personal Data Protection Center (PDPC) was operationalised. In-scope controllers and processors have a one-year grace period to achieve full compliance by 31 October / 1 November 2026.
Legal framework
Personal Data Protection Law No. 151 of 2020 (PDPL), supplemented by Executive Regulations issued via Prime Ministerial/MCIT Decree No. 816 of 2025 (1 November 2025); supervised by the Personal Data Protection Center (PDPC) under the Ministry of Communications and Information Technology (MCIT).
Key points: data & privacy in Egypt
Primary statute (in force)
Law No. 151 of 2020 Promulgating the Personal Data Protection Law was published in the Official Gazette in July 2020 and entered into force on 14 October 2020, creating Egypt's first comprehensive personal-data regime covering electronic processing of personal data with extraterritorial reach.
Executive Regulations (Decree 816/2025)
MCIT Decree No. 816 of 2025, issued on 1 November 2025, enacted the Executive Regulations to the PDPL — providing detailed operational rules on consent, licensing, record-keeping, breach notification, cross-border transfers, special-category and children's data, and direct electronic marketing.
Supervisory authority (PDPC)
The Personal Data Protection Center (PDPC), affiliated with MCIT, has been established as the sole supervisory authority. It licenses controllers/processors, issues guidance, receives complaints, investigates breaches and imposes administrative sanctions.
Compliance grace period ends 31 October 2026
The Executive Regulations grant in-scope organisations a one-year transitional period; full enforcement of substantive PDPL obligations begins on 31 October / 1 November 2026, by which point controllers and processors must have completed licensing, DPO appointment where required, and record-keeping.
Cross-border transfer regime
Transfers of personal data outside Egypt require a licence or permit from the PDPC, based on an adequacy-style assessment of the destination country, plus the explicit consent of the data subject; limited derogations are available under Article 15 of the PDPL.
Core obligations & data-subject rights
The regime requires lawful basis / prior informed consent, purpose limitation, data minimisation and defined retention, appointment of a Data Protection Officer in prescribed cases, maintenance of processing records, security-by-design, and 72-hour breach notification to the PDPC. Data subjects have GDPR-style rights of access, rectification, erasure, withdrawal of consent and objection.
Sanctions
The PDPL provides for administrative fines up to EGP 5 million and criminal penalties including imprisonment (generally six months or more) for serious violations such as unlawful processing, unauthorised cross-border transfers, or failure to notify breaches.
Timeline of decisions
- LawExecutive Regulations of the Personal Data Protection Law issued
Five years after the PDPL was passed, Egypt issued its Executive Regulations via MCIT Decision No. 81 of 2025 (published in Official Gazette Issue 244), finally operationalizing breach-notification, data-controller registration, cross-border transfer rules and security obligations, with a one-year grace period before full enforcement (~October 2026).
Baker McKenzie
- LawExecutive Regulations to Data Protection Law issued (Decree 816/2025)
Egypt issued the long-delayed implementing regulations for Personal Data Protection Law No. 151/2020 (Official Gazette Issue 244), setting binding rules on data controllers, processors and cross-border transfers that govern data used to train and run AI systems, with a one-year compliance grace period to ~November 2026.
Baker McKenzie
- LawExecutive Regulations to Personal Data Protection Law issued
Prime Ministerial Decree No. 816 issued the long-awaited executive regulations for Law 151/2020, operationalizing licensing, breach-notification (72 hours), and cross-border transfer rules with a one-year compliance grace period (full enforcement expected October 2026).
Al Tamimi & Company
- LawExecutive Regulations of the Personal Data Protection Law issued
Prime Ministerial Decree No. 816 / MCIT Decision No. 81 of 2025 issued the long-awaited implementing regulations, made the Personal Data Protection Center operational, and introduced licensing, breach-notification (72 hours) and tiered-fee rules; a 12-month grace period sets full enforcement for 31 October 2026.
Clyde & Co
- IncidentData of tens of thousands of students reported compromised
A breach exposed personal data of large numbers of Egyptian students, highlighting weak data-security practices in the public sector ahead of the privacy law's enforcement.
Human Rights Watch
- Incident~45 million Egyptian Facebook users hit in global data leak
A scraped dataset exposed names, phone numbers, locations and other details of nearly all Facebook users in Egypt, underscoring the scale of personal-data exposure as the new law took shape.
Egyptian Streets
- Law · officialPersonal Data Protection Law No. 151 of 2020 enters into force
Egypt's first comprehensive data-protection law took effect 90 days after publication, establishing GDPR-inspired rights, lawful processing bases, cross-border transfer controls and the Personal Data Protection Center.
Library of Congress
- IncidentAlleged Vodafone Egypt customer-data leak investigated by NTRA
Claims of a leak of Vodafone Egypt customer data prompted a fact-finding committee under the National Telecom Regulatory Authority, an early test of telecom data-protection oversight.
Egypt Today
- Law · officialPresident al-Sisi ratifies Personal Data Protection Law No. 151 of 2020
Ratification and publication in the Official Gazette (15 July 2020) created Egypt's first standalone personal-data framework, with enforcement set to begin 90 days later.
Ministry of Communications and Information Technology
- LawParliament passes Egypt's first data-privacy bill
The House of Representatives approved the Personal Data Protection bill, modeled in part on the EU GDPR, prohibiting processing of personal data without consent except in defined cases.
IAPP
- Law · officialAnti-Cyber and Information Technology Crimes Law No. 175 of 2018
The cybercrime law imposed a 180-day data-retention duty on telecom/service providers and website-blocking powers, shaping the surveillance-and-data-handling backdrop that the later privacy law operates within.
Library of Congress
- Law2014 Constitution enshrines privacy and personal-data protections
Articles 57 and 99 made private life inviolable, protected confidentiality of communications and treated violations as crimes, providing the constitutional foundation for later data-protection legislation.
ICLG
Sources
- acc.com/sites/default/files/program-materials/upload/Data%20Protection%20Law%
- dlapiperdataprotection.com/?t=law&c=EG
- accesspartnership.com/opinion/egypt-finalises-executive-regulations-to-the-personal-data-pr
- dataguidance.com/news/egypt-pdpc-issues-executive-regulations-personal-data
- tamimi.com/our-knowledge/publications/general/Articles/from-policy-to-practice-e
- shandpartners.com/insights/briefings/telecoms-media-technology/the-issuance-of-the-exec
- bakermckenzie.com/en/insight/publications/2026/01/egypt-important-data-protection-updat
- bakermckenzie.com/-/media/files/insight/publications/2026/01/egypt--important-data-prot
- kennedyslaw.com/en/thought-leadership/article/2026/egypt-s-personal-data-protection-l
- lexology.com/library/detail.aspx?g=334b6157-bbeb-474d-ba67-11140e89cc07
- consortiolawfirm.com/cross-border-data-transfer-egypt-pdpl/
- practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/egypt
- pwc.com/m1/en/services/consulting/technology/cyber-security/navigating-data-p
- signzy.com/regulation-glossary/personal-data-protection-law-151
Next for Egypt: Digital Payments & FintechLicensing regime
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 1 Sept 2026. Methodology & how to cite · State of Technology Regulation 2026