If your business collects names, phone numbers or emails from people in Egypt, through a website form, a CRM, WhatsApp or an AI chatbot, there's a date you need in your calendar: 31 October 2026. That's when the one-year grace period to comply with Egypt's Personal Data Protection Law ends.
The short version: Egypt's Personal Data Protection Law (Law No. 151 of 2020) applies to almost every business that processes personal data of people in Egypt, including companies based abroad. Its Executive Regulations were issued in November 2025, and the grace period ends on 31 October 2026. Businesses need a legal basis (usually explicit consent), a licence or permit from the Personal Data Protection Center, a data protection officer, a 72-hour breach procedure, and clear rules for marketing, cookies and transfers abroad.
This article is a practical overview for business owners, not legal advice. For your specific situation, consult a lawyer who specializes in Egyptian data protection law.
What is Egypt's Personal Data Protection Law?
Law No. 151 of 2020, usually called the PDPL, regulates how personal data is collected, stored, used and transferred in Egypt. For years it existed without Executive Regulations, so most businesses treated it as a future problem.
That changed on 1 November 2025, when the Minister of Communications and Information Technology issued Decree No. 816 of 2025 with the regulations, and the one-year grace period began.
The regulator is the Personal Data Protection Center (PDPC). In October 2026, it launched an electronic portal that receives applications for licences, permits and accreditation, and publishes guidance for businesses.
Who has to comply?
- Companies and other private entities that process personal data, whether on computers or on paper.
- Businesses outside Egypt that process data of Egyptians or of foreigners living in Egypt. Foreign controllers and processors are expected to deal with the Center through an authorized local representative.
- Some public bodies, for their non-sovereign activities.
The law excludes certain institutions, such as the Central Bank of Egypt and the entities it supervises (except money transfer and currency exchange companies), and specific state security bodies.
If you have a website with a contact form, a customer list or a WhatsApp business number, you are very likely in scope.
What the law requires, in plain language
A legal basis, usually explicit consent
Personal data may only be processed with the person's explicit consent or where the law allows it, for example to perform a contract or meet a legal obligation. Keep records of consent that you can produce when asked.
Sensitive data, such as health or financial information, needs explicit written consent and a permit or licence from the Center. Children's data has extra rules: for children under 15, a guardian's written consent is required.
A licence or permit
Controllers and processors need to be licensed by the Center, and the way you collect data and obtain consent may need its approval. Applications now go through the PDPC portal.
A data protection officer
Organizations are expected to appoint a data protection officer (DPO) in writing, with enough training and independence to do the job, as part of registering with the Center.
Respect for people's rights
People can ask to know what you hold about them, get a copy, correct or delete it, withdraw their consent, limit how it's processed, and object to processing. They also have the right to be told about breaches that affect them.
A breach plan with a 72-hour clock
A personal data breach must be reported to the Center within 72 hours of becoming aware of it, or immediately if national security is involved. Affected individuals must then be informed within three working days of notifying the Center.
Rules for direct marketing
Electronic direct marketing needs consent. Each message must identify the sender, make clear that it's marketing, give a valid contact address, and include an easy way to unsubscribe. Messages disguised as personal messages aren't allowed, and consent records must be kept for three years from the last marketing message. Personalized advertising based on profiling needs prior explicit consent.
Cookies and tracking
Cookies, SDKs and device identifiers need prior, explicit and valid consent. Pre-ticked boxes and other "dark patterns" make consent invalid.
Transfers outside Egypt
Sending personal data abroad is restricted. The destination must offer protection at least equal to Egyptian law, and transfers generally need a licence or permit from the Center as well as the person's consent. The Center decides within 90 working days of receiving a complete application.
What are the penalties?
Fines under the law range from EGP 50,000 to EGP 5 million, and some violations carry criminal penalties, including imprisonment. Administrative measures range from warnings to suspending or revoking a licence.
Courts are also willing to award damages. In September 2025, the Economic Court of Alexandria ordered a telecom operator to pay EGP 10 million in compensation.
Your checklist before 31 October 2026
Website
- Add a clear, unticked consent checkbox and a link to your privacy policy on every form that collects personal data.
- Publish an up-to-date privacy policy: what you collect, why, how long you keep it, who you share it with, and how people can exercise their rights.
- Show a cookie banner that blocks analytics and advertising cookies until the visitor agrees, with "Reject" as easy to click as "Accept".
- Remove trackers and plugins you don't actually use.
CRM and customer data
- Map where personal data lives: CRM, spreadsheets, phones, email and accounting.
- Record the consent or legal basis for each contact, with the date and source.
- Limit access by role, log who views and exports data, and remove access for people who have left.
- Set retention periods, and delete or anonymize data you no longer need.
- Make sure you can find, export, correct and delete one person's data quickly when they ask.
WhatsApp, SMS and email marketing
- Send marketing only to people who agreed to receive it, and keep proof of consent for three years after the last message.
- Identify your business in every message and include an opt-out that actually works.
- Keep service messages, such as order updates, separate from marketing.
AI tools and chatbots
- List every AI tool that receives customer data: chatbots, transcription, CRM assistants and analytics.
- Check where each provider processes and stores data. If it's outside Egypt, the transfer rules may apply.
- Share the minimum data needed, and keep sensitive data out of general-purpose AI tools.
- Tell users when they're talking to an AI assistant and how their messages are used.
Egypt doesn't have a standalone AI law yet. Using personal data to train or run AI systems falls under the PDPL, and the national AI charter issued by the government sets out principles for responsible use.
People and process
- Appoint a DPO and give them the authority to act.
- Write a breach response plan with names, phone numbers and the 72-hour deadline.
- Sign data processing agreements with suppliers who handle your customers' data: hosting, CRM, marketing, payments and AI.
- Train the people who handle customer data, especially sales and support.
- Apply for your licence or permit through the PDPC portal.
Frequently asked questions
When is the deadline to comply with Egypt's data protection law?
The one-year grace period that followed the Executive Regulations ends on 31 October 2026, so businesses are expected to be fully compliant from 1 November 2026.
Does the law apply to small businesses?
The law doesn't exempt small businesses. Licence and permit fees depend on the volume of data processed, and early enforcement is expected to focus on organizations that hold large amounts of personal data. Even so, the basics (consent, a privacy policy, access control and a breach plan) are worth having at any size.
Does the law apply to companies outside Egypt?
Yes, if they process personal data of Egyptian citizens or of foreigners living in Egypt. Foreign controllers and processors are expected to appoint an authorized local representative to deal with the Center.
Can I use ChatGPT or other AI tools with customer data?
The law doesn't ban AI tools, but sending personal data through them is still processing under the PDPL. You need a legal basis, should share only the minimum data, and must check whether the provider stores data outside Egypt, since the transfer rules may apply.
Where to go from here
Compliance is mostly about knowing where your data is and controlling how it moves. That's exactly what a well-designed system gives you: one place for customer data, consent records, role-based access and audit logs.
At GTech, we build CRM systems and websites with consent, access control and data export built in. If you're not sure where your business stands, talk to us and we'll help you map your data before the deadline.
