Contents
Most data protection regimes ask a business to behave well and prove it afterwards. Egypt’s asks for permission first.
Under Law No. 151 of 2020 and the Executive Regulations issued on 1 November 2025, a controller or processor in Egypt needs a licence or permit from the Personal Data Protection Centre to process personal data at all — with separate instruments for moving data abroad, for direct marketing, for cameras in public places and for sensitive data. Businesses were given one year to regularise their position. That year ends at the end of October 2026.
This is one country’s law, not a continental one, and it is demanding even among the African markets that have built data regimes in the past five years. If you hold customer records in Egypt — or sell to Egyptian customers from outside it — the next month decides whether you operate with a licence or without one.
What is happening?
Egypt’s 2020 data protection law waited five years for its implementing text. On 1 November 2025 the Minister of Communications and Information Technology issued the Executive Regulations by Ministerial Decision No. 816 of 2025; they were published in the Official Gazette and came into force the following day (Digital Policy Alert, 1 November 2025). Article 6 of the law’s issuance articles gives entities in scope one year from that issuance to regularise their position. Firms advising on the regime date the expiry to 31 October or 1 November 2026, depending on how the year is counted (Amereller, 28 April 2026; CMS, 13 January 2026). Either way, it is this month.
What the Regulations build is prior authorisation. Controllers and processors need a licence or permit before processing. Moving personal data outside Egypt requires a separate instrument naming the recipient country, and a change of destination requires fresh approval. Electronic direct marketing, cameras in public places and sensitive data each require their own. Licences run for three years and permits for one. Alongside them come a registered data protection officer, an Egyptian representative for controllers based abroad, breach reporting to the Centre within 72 hours and to affected individuals within three business days, and a duty to ensure that using personal data to train artificial intelligence systems does not harm data subjects or infringe their rights (Shalakany, December 2025).
Fees scale with volume. The Regulations exempt entities processing between 1 and 100,000 personal data records from licensing fees, with escalating fees above that, and price a cross-border transfer licence at 50% of the applicable licence fee (Shand & Partners, 11 January 2026). Not everyone is in scope: the issuance articles exclude data held by the Central Bank of Egypt and entities under its supervision — though not money transfer and currency exchange companies.
What remains uncertain is the mechanism. The Centre’s website has launched, with guidance on consent, lawful bases, records of processing, privacy notices, marketing and licensing. The portal for submitting applications had not opened in the most recent accounts we could read: not operational in January 2026, expected around mid-June 2026 in a May 2026 update. We could not reach pdpc.gov.eg over a verified connection while preparing this piece, so check its state before anything else. No announcement has moved the deadline.
Why it matters economically
Prior authorisation changes the cost of holding data in a way that notification regimes do not. Where you only have to notify, the marginal cost of one more record is near zero, which is why most customer systems default to keeping everything. Egypt’s fee structure puts a price on volume, with a threshold at 100,000 records below which the licensing fee disappears. A decade of duplicates, dead leads and abandoned imports is no longer only an operational irritation. It is a fee tier.
The second cost is latency: a cross-border licence names the destination country, so moving your CRM, help desk or email platform to another region means going back to the regulator.
The third is exposure. Under Law No. 151 of 2020 the penalties are criminal as well as financial: EGP 100,000 to 1,000,000 for processing without legal basis or consent; EGP 200,000 to 2,000,000 for breaching the marketing rules; EGP 500,000 to 5,000,000, with imprisonment of no less than three months as an alternative or an addition, for breaching the cross-border transfer provisions or those on licences and permits. The court must also order publication of a conviction in two newspapers and online at the convicted party’s expense, and penalties double on repetition.
What it means for African businesses
This is Egypt, and it should not be read as where African data regulation has arrived generally: the models differ in kind. Kenya runs a registration system: controllers and processors register with the Office of the Data Protection Commissioner under section 18 of the Data Protection Act, 2019, certificates are valid for 24 months, and in September 2026 the ODPC gave organisations with expired certificates 14 days to renew (CMS Kenya, 11 September 2026). Registration is an administrative step; a licence is a permission that can be refused, conditioned or withdrawn. A business operating across several African markets cannot run one compliance posture and assume it travels — the same lesson as Kenya’s payment law rewrite.
Three groups are affected more than they expect. Businesses outside Egypt selling to Egyptian customers, because neither the representative requirement nor the reach of the offences provisions depends on having an office there. Businesses whose marketing runs on email, SMS and messaging lists, because direct marketing is separately licensed and penalised. And businesses running ordinary software hosted elsewhere, because that is a cross-border transfer whether or not anyone has called it one.
Payments businesses should check the carve-out rather than assume it: the money transfer and currency exchange exception decides which regime they are in, a distinction that recurs across the markets we work in.
Technology and AI implications
Much of what the Regulations ask for is work software does well: records of processing activities, consent logs dated to each change, retention enforced by the system rather than by memory, erasure when a purpose expires, a trail of data subject requests, a breach log timed against a 72-hour clock. A business whose customer data lives in one system with those fields built in produces its evidence as a by-product of operating normally. A business whose data is spread across a spreadsheet, a mailbox, a WhatsApp history and two marketing tools cannot produce it at all — the problem described in why growing businesses outgrow spreadsheets.
Three things technology does not do here. It does not get you a licence: the application, the documentation, the named destinations and the registered officer are organisational work, and a vendor marketing its product as making you compliant with Egypt’s regime is describing something that does not exist. It does not decide your lawful basis or your purpose. And AI does not reduce the obligation — it adds one.
The Regulations address the use of personal data to train AI systems directly, requiring that it not harm data subjects or infringe their rights. Sending customer records to a model provider hosted outside Egypt is a cross-border transfer and a purpose question at once. That does not make AI unusable; it makes the design question specific. Work on anonymised or aggregated data, or on records already covered by a transfer licence, is a different proposition from pushing a raw customer table into a third-party tool — the distinction to settle first if you are weighing where AI and automation fit in an Egyptian operation.
Practical business implications
Work worth doing whenever the portal opens:
- Map what you hold. Every system holding personal data of people in Egypt, what is in it, why, and for how long.
- Count the records. The 1–100,000 band is exempt from licensing fees. Which side you sit on, and whether deleting unused data moves you, is a decision with a number attached.
- List every country your data touches. Cloud regions, CRM, email and SMS platforms, analytics, support desk, backups, outsourced processing. A licence names destinations; you cannot name what you have not listed.
- Separate out marketing. It needs its own licence, prior consent, a clear sender identity and address, a stated marketing purpose, an easy opt-out, and consent records kept for three years from the last message sent.
- Appoint and register a data protection officer, and the Egyptian representative if the business is based elsewhere.
- Write the breach runbook: who declares an incident, what is recorded, who notifies the Centre within 72 hours and individuals within three business days.
- Reopen vendor contracts, so the controller–processor split is on paper.
- Check the Centre’s site directly for the application route.
If that reads as a systems project rather than a legal one, that is because most of it is. The filing is the last step; the first is a customer system that records consent, purpose and retention as fields rather than intentions.
RevenueStack perspective
Our view is that the fee structure is the most interesting part of this law, and the part most businesses will overlook while they watch the deadline. By pricing a licence against the number of records held, Egypt has put a visible cost on hoarding data. Every other argument for holding less is real but diffuse, which is why it loses to the instinct to keep everything. A fee tier is neither diffuse nor arguable: it turns a governance principle into a line a finance director can read.
The second observation is about timing. A hard legal deadline running ahead of the regulator’s own machinery is a familiar pattern, and the wrong response is to wait. The data map, the consent records, the retention rules, the officer and the contracts all have to exist before any application can be filed. Treat the licence as the project and you will be late; treat the systems as the project and you will be ready to file on the day the portal opens.
The third is a design point we apply generally in how we approach systems: build for the fewest named destinations you can live with. Every additional country in your data path is another approval and another re-filing when a vendor changes region. Architectural simplicity is usually an engineering preference. Under prior authorisation it is a commercial one.
Conclusion
Egypt has made the holding of personal data a licensed activity, and the year it gave businesses to adjust runs out at the end of this month. The immediate task is not legal drafting but inventory: what you hold, why, where it goes, and who else processes it. A business that can answer those four questions can file whenever the route opens and account for itself in the meantime. A business that cannot stays exposed to a regime whose penalties are criminal, public and doubled on repetition.
Sources
- Law No. 151 of 2020, Concerning the Issuance of the Personal Data Protection Law (English translation) — Arab Republic of Egypt / Andersen Egypt, 2020
- Minister of Communications and Information Technology adopted Executive Regulations of the Personal Data Protection Law (Decision No. 816 of 2025) — Digital Policy Alert, 2025-11-01
- New Executive Regulations for Egypt's Personal Data Protection Law — Shalakany Law Office, 2025-12
- The Issuance of the Executive Regulations of the Data Protection Law and the Establishment of the Data Protection Centre — Shand & Partners, 2026-01-11
- Egypt's PDPL: Executive regulations issued — one year compliance countdown begins — CMS, 2026-01-13
- The Egyptian Personal Data Protection Regime — What You Need to Know Ahead of 31 October 2026 — Amereller, 2026-04-28
- Egypt Personal Data Protection Law: New Compliance Developments — Shand & Partners, 2026-05-06
- ODPC Gives Data Controllers and Processors 14 Days to Renew Expired Registration Certificates — CMS Kenya, 2026-09-11