A deadline with real teeth for companies
Egypt's Personal Data Protection Centre (PDPC) launched its electronic portal in early October 2026, according to Baker McKenzie. The portal takes applications for accreditation, licences and permits. The one-year grace period that began with the Executive Regulations (Decree No. 816 of 2025, issued 1 November 2025) ends on 31 October 2026. By then every controller and processor under Law 151 of 2020 must be fully compliant.
The case for this regime is strong, and it deserves a fair statement. Egypt went years with a data protection statute whose machinery did not exist. A working licensing portal, published guidelines and a hard date give businesses certainty and give citizens a regulator they can in principle complain to. Biometric data is among the most sensitive categories, because a leaked face cannot be reset like a password. Licensing its processing is a defensible way to force organisations to justify collection before it happens.
What the portal does, and what it demands
Baker McKenzie reports that creating a profile and filing applications requires authentication through Digital Egypt, which is tied to an Egyptian National ID. Foreign controllers and processors therefore need an authorised local representative to file for them. That is a real friction cost for foreign startups and SaaS providers serving Egyptian users, and it falls hardest on small firms with no local entity.
Clyde & Co summarises the licensing scope as covering cross-border transfers, direct electronic marketing, and visual surveillance such as CCTV in public places. It puts fines at EGP 200,000 to EGP 5 million. We could not confirm the visual-surveillance licence against the PDPC's own text. Treat it as reported by secondary sources, not as verified regulation.
The exemption that matters for facial recognition
The hardest question is who the licence actually binds. Per the English translation of Law No. 151 of 2020, the law's exclusions cover personal data held by national security authorities, and data those authorities exclude for other considerations they determine. The same text lets the Centre, at the request of national security authorities, direct a controller or processor to amend, erase, withhold or suspend handling of personal data. The translation is unofficial and we could not read the full PDF, so the exact wording should be checked against the Official Gazette.
If that reading holds, the structure is lopsided. A private mall operator or a retailer running face-matching at its entrance must apply for a licence and justify the data. A police or security deployment of the same technology may fall under a carve-out defined by the security bodies themselves. Access Now argued in 2020 that exempted bodies, including the Ministry of Interior and intelligence services, should not escape data protection duties. It also noted that the PDPC board is appointed by the Minister and includes defence, interior and intelligence representatives, which it said does not amount to independent oversight.
Why this is a policy problem, not just a privacy one
The pro-innovation position is not that facial recognition should be banned. Used with limits, it can help find missing children or identify suspects in serious crimes. The position is that the rules should be proportionate, and that proportionality has to apply to the actor with the most power. A regime that burdens commercial users heavily and leaves state use to discretion pushes legitimate innovation into compliance costs while leaving the highest-risk deployments least examined.
The risks of weak oversight are not hypothetical, even in mature democracies. In October 2026 the EFF reported on a Department of Homeland Security inspector general audit of the US Transportation Security Administration's facial recognition programme. The audit found that a vendor could access and extract sensitive passenger data, including licence and passport images, without TSA's knowledge. TSA also could not verify that extracted data was deleted. That was a country with an independent inspector general and a public audit. Egypt's framework offers fewer visible equivalents.
What a proportionate fix looks like
Egypt does not need to repeal its exemption to improve it. Four steps would help:
- Narrow the carve-out. Limit it to specified operations and require written, time-limited authorisation, rather than letting the exempted bodies define their own scope.
- Publish a deployment register. Disclose where public-space facial recognition operates, by which agency, and under what legal basis, even if operational detail is withheld.
- Mandate vendor controls. The TSA audit shows that contractor access is where biometric data leaks. Require logging and verified deletion for any vendor handling state biometric data.
- Give the regulator independence. A board that includes the agencies it supervises cannot credibly review them.
It would also help if the PDPC published the primary text and fee schedule for the visual-surveillance licence in one place, so businesses and observers can verify what is actually required.
The bottom line
The 31 October deadline is a genuine step toward a functioning data regime, and businesses should prepare now, especially foreign firms that need a local representative. But the credibility of Egypt's biometric rules will be judged by whether they constrain the police cameras that watch public spaces, not only the shops that install them. On the current text, that question is still open.