Last review date: 8 January 2025
The primary laws relevant to privacy and data protection are:
- Law 151/2020 Promulgating the Personal Data Protection Law ("PDPL") and its Implementing Regulations under Minister of Telecommunications Decree No. 816 of 2025 ("Regulations")
- Constitution of the Arab Republic of Egypt ("Constitution")
- Law 58/1937 Promulgating the Penal Code ("Penal Code")
- Law 175/2018 on Anti-Cyber and Information Technology Crimes ("Cybercrimes Law")
- Executive Regulations 1699/2020 to the Cybercrimes Law ("Cybercrimes Executive Regulations")
The Constitution guarantees an inviolable right to privacy, along with the freedom of communications and the right to privacy in a person's home. The Penal Code criminalizes acts such as defamation, unauthorized monitoring or disclosure of communications, and the unlawful disclosure of confidential information obtained by virtue of one’s profession or position, as set out in Articles 302 to 310 of the Penal Code.
The PDPL establishes a more comprehensive and robust framework for personal data protection, aligning closely with key principles and concepts found in international data protection laws. Although enacted in 2020, the PDPL only became fully operational following the publication of its implementing Regulations in late 2025. The official publication date of 1 November 2025 marked the start of a one-year grace period for organizations to achieve compliance.
Last review date: 8 January 2025
- Law 175/2018 on Anti-Cyber and Information Technology Crimes ("Cybercrimes Law")
- Executive Regulations 1699/2020 to the Cybercrimes Law ("Cybercrimes Executive Regulations")
While the Cybercrimes Law primarily establishes a range of technology-enabled and technology-related criminal offenses (and associated sanctions), it also imposes specific obligations and duties on "Service Providers" regarding information security. For these purposes, "Service Providers" include any party that offers information and communication technology services to the public.
The obligations include retaining identity data, traffic data, and other information; ensuring the confidentiality and non-disclosure of preserved and stored data; providing specified information to consumers and government bodies; providing technical support to national security agencies when required; and collecting certain categories of user data.
The Cybercrimes Executive Regulations apply different standards depending on whether the services provided are general IT services or critical IT services, with more stringent requirements imposed on providers of critical information infrastructure.
Last review date: 8 January 2025
The Cybercrimes Law contains cybersecurity obligations on ICT service providers and establishes a range of cyber offenses that are not specific to personal data.
In addition, various sectoral regulations impose obligations on different categories of data. For example, the Internet of Things Framework published by the National Telecom Regulatory Authority (NTRA) and other telecoms sector regulations impose obligations relating to retention, disclosure, and protection of traffic data, content and technical data. In the financial services sector, the Central Bank and Banking System Law 194/2020 ("Banking Law") obliges licensed financial institutions to provide secure systems that ensure the integrity and confidentiality of customer data and accounts.