Egypt data law compliance window closes in November 2026
Law firms record a licensing duty, written consent for sensitive categories, a registered data protection officer and a 72-hour breach notification, with fines to EGP 5 million.
Egypt data law obligations under Law No. 151 of 2020 reach the end of a one-year compliance window in November 2026, on the reading CMS published on 13 January 2026. Hibridge, a Cairo healthcare consulting firm, states that it assesses personal data handling against that law.
The instrument and its dates#
The executive regulations were issued by decision 816 of 2025, dated 1 November 2025. Al Tamimi & Company and CMS record it as a ministerial decision of the Minister of Communications and Information Technology; Kennedys records it as a prime ministerial decree. CMS states the text was not made publicly available until 25 December 2025, and reads the one-year compliance period as running to 1 November 2026 while noting the regulator may instead run it to the end of 2026 because of the late public release. Kennedys records full enforcement as expected by October 2026. Al Tamimi states no enforcement date.
What the regulations require#
Al Tamimi records that controllers and processors must obtain licences or permits from the Personal Data Protection Center, and that special-category data requires explicit written consent from the data subject. CMS records a general licence normally valid for three years, supplementary permits for cross-border transfers, electronic direct marketing and visual surveillance, a 90-working-day review period for complete applications, mandatory appointment of a registered data protection officer by legal entities, and a register of officers maintained by the regulator with a unique code for each.
Notification and fines#
All three firms record a duty to notify the regulator of a breach within 72 hours. CMS and Kennedys add that affected individuals must then be notified within three days or three working days of the regulator being told, and sooner in national security cases. Kennedys gives fines of approximately EGP 200,000 to EGP 2 million, rising to EGP 5 million for certain offences.
What the Cairo firm's site states#
Hibridge gives 2014 as its founding year and Cairo as its base. Its compliance page states that personal data handling is assessed against Egypt's Personal Data Protection Law, with European rules applying where a European or British parent company is involved, and that an in-house pharmaceutical compliance team reviews scientific claims, promotional code positions and transfer-of-value treatment before work reaches a client. Related company announcements sit with the Sanctions and Risk Desk.
Sources5 sources across 4 domains
- tamimi.comAl Tamimi & CompanyPublished 4 February 2026. Executive regulations of Egypt's Personal Data Protection Law issued by ministerial decree No. 816 of 2025; controllers and processors must obtain licences or permits from the Personal Data Protection Center; special-category data requires explicit written consent; 72-hour breach notification
- cms.lawCMSPublished 13 January 2026. Decision 816 of 2025 dated 1 November 2025, recorded as a ministerial decision of the Minister of Communications and Information Technology, text not publicly available until 25 December 2025, one-year compliance period read as ending 1 November 2026 with possible extension to end-2026, general licence normally valid three years, supplementary permits for cross-border transfers, electronic direct marketing and visual surveillance, 90 working day review, mandatory registered data protection officer for legal entities with a regulator-maintained registry and unique code, 72-hour breach notification and notification of individuals within three days
- kennedyslaw.comKennedysPublished 2026. Records decree No. 816 as prime ministerial, full enforcement expected by October 2026, 72-hour breach notification, and fines of approximately EGP 200,000 to EGP 2 million rising to EGP 5 million for certain offences
- hibridge.egHibridgeHibridge states personal data handling is assessed against Egypt's Personal Data Protection Law with GDPR where an EU or UK parent is involved, and that an in-house pharmaceutical compliance team reviews scientific claims, promotional code positions and transfer-of-value treatment before work reaches the client
- hibridge.egHibridgeHibridge founded 2014, a Cairo healthcare consulting firm
Each source above carries the claim it supports. Links open the publisher's own page; their text is not reproduced here beyond what the claim requires, and their rights remain theirs.
MENA Trade Monitor is published by Arabian Media Network. Pieces are produced by the Sanctions and Risk Desk with AI-assisted synthesis of the cited sources and automated verification against the network's editorial policy. Every piece carries a desk rather than a reporter. Corrections are recorded on the piece and on the corrections page.
Transits, closures, advisories, war risk premia and rerouting cost for Hormuz, Bab el-Mandeb and Suez. Same day, same shape, always numbers.