Egypt’s data protection deadline: a regulator inside the executive and a triple lock on data transfers

North Africa has some of the continent’s oldest data protection laws, and Egypt has one of its most consequential. Egypt’s Personal Data Protection Law, Law No. 151 of 2020, was published in July 2020.¹ Its executive regulations, issued as Decree No. 816 of 2025 by the Minister of Communications and Information Technology, were dated 1 November 2025 but released publicly only on 25 December 2025.² Organisations have one year from the regulations to comply, which brings Egypt’s regime into full effect around 1 November 2026.³

That deadline makes this the moment to look closely at how the regime is built. Three features stand out: where the regulator sits, what the law leaves out, and how it treats data leaving the country.

A regulator inside the executive

The law creates a Personal Data Protection Centre as a “public economic authority” attached to the Minister of Communications and Information Technology. The Minister chairs its board, which also includes representatives of the Ministries of Defence and Interior, the General Intelligence Service, the Administrative Control Authority, the IT industry development agency and the telecommunications regulator.⁴ As of January 2026 the board had not yet been constituted, and the Centre is led by an acting chief executive who is also an adviser to the Minister.⁵

Egyptian and regional civil society groups have questioned whether this structure allows independent oversight. Access Now argued in 2020 that a board of this composition “does not represent independent oversight of this regulatory function”, and in 2026 the Egyptian Initiative for Personal Rights and Masaar raised “practical concerns about its independence”.⁶ The concern is practical as well as principled. A regulator that sits within the ministry responsible for digital government will find it hard to enforce the law against that government.

What the law leaves out

The law does not apply to personal data held by the national security authorities, defined as the Presidency, the Ministries of Defence and Interior, the General Intelligence Directorate and the Administrative Control Authority. It also excludes data held by the Central Bank and the institutions it supervises, apart from money-transfer and currency-exchange companies.⁷

The exemption goes further than exclusion. At the request of the security authorities, the Centre must notify controllers to “modify, delete, hide, make available” personal data.⁸ In most data protection systems the regulator stands between the individual and the state. Here the law also makes it a channel for the state’s instructions to controllers. The Egyptian Initiative for Personal Rights and Masaar warn that the broadly worded exemption leaves “areas effectively beyond the reach of the Law”.⁹

A data protection authority should stand between citizens and the state’s demands for their data, not relay those demands.

A triple lock on transfers

Egypt treats data leaving the country as the exception. Under the law, personal data may be transferred abroad only where the destination’s level of protection meets or exceeds Egypt’s, and only with a licence or permit from the Centre.¹⁰ The regulations add the data subject’s consent and require the licence to name the destination countries, so adding a country means updating the licence.¹¹ A transfer licence costs half the fee of the underlying controller or processor licence, the Centre has 90 working days to decide, and silence counts as refusal.¹² Breaking the transfer rules can be punished by at least three months’ imprisonment, a fine of up to EGP 5 million, or both.¹³

The regulations provide no standard contractual clauses, and Egypt has not published a list of countries with adequate protection.¹⁴ For organisations that run services across borders, including African businesses serving Egyptian customers, each new destination becomes an administrative application with an uncertain outcome.

This sits uneasily with the direction of African trade policy. The African Continental Free Trade Area’s Protocol on Digital Trade, adopted in February 2024, requires its parties to allow cross-border transfers of data, including personal data, subject to an annex on data transfers and to exceptions for legitimate public policy and essential security interests.¹⁵ The Centre says it is pursuing “reciprocal adequacy decisions” to ease transfers.¹⁶ That is the right instinct. African partners should be first in line.

Implementation and redress

With weeks to go, visible implementation is thin. The Centre presented online services for licence applications and the registration of data protection officers in February 2026, but when we checked its website on 25 September 2026 it had published no decisions, and the status of its application portal was unclear.¹⁷ The most significant redress so far has come from the courts: in September 2025 the Alexandria Economic Court ordered EGP 10 million in compensation over a compromise of customer data.¹⁸

Morocco and Tunisia: a different anchor

Morocco and Tunisia took a different path. Morocco’s Law 09-08 of 2009 is enforced by the National Commission for the Control of the Protection of Personal Data (CNDP), a seven-member body appointed by the King, six of them on the proposal of the Prime Minister and the presidents of the two houses of Parliament, for five-year terms renewable once.¹⁹ Tunisia’s Organic Law 2004-63 is enforced by its national authority, the INPDP.²⁰ Both countries have acceded to the Council of Europe’s Convention 108, which gives them an external standard to measure themselves against.²¹

Their laws are not without state carve-outs: Morocco’s does not apply to processing for national defence and state security.²² The CNDP has also taken a considered position on a contested technology. After a moratorium, it decided in December 2020 to allow facial recognition only case by case, following prior authorisation.²³

But both reform agendas have stalled. The CNDP planned to send the government a draft replacement for Law 09-08 in October 2022, and no definitive text had been adopted by April 2026. A draft law modelled on the GDPR was introduced in Tunisia’s Parliament in March 2018 and has not been passed.²⁴

Recommendations

1. Give Egypt’s Centre independent leadership. Constitute the board with a majority of independent members, appoint a permanent chief executive through open competition, and detach the Centre from the Ministry it will need to regulate.
2. Put security requests under judicial control. Requests by security bodies to modify, disclose or delete personal data should require a court order, and the exemptions should be narrowed to what is necessary for national security.
3. Replace the triple lock with workable safeguards. Publish a list of adequate countries, adopt standard contractual clauses, and drop the consent requirement where another safeguard applies. A late decision on a transfer licence should not count as a refusal.
4. Publish decisions from the start. The Centre should publish its licensing and enforcement decisions, and confirm how organisations can apply, before the compliance deadline takes effect.
5. Finish the reforms in Morocco and Tunisia. Both countries should complete the modernisation of their laws, and North African states should pursue reciprocal adequacy with African partners in line with the AfCFTA Digital Trade Protocol.

Quotations from Egyptian and Moroccan legal texts are taken from unofficial English translations or translated by ACTPOL.