Egypt's one-year grace period under the Executive Regulations of its Personal Data Protection Law ended at the turn of October and November 2026. Baker McKenzie puts the deadline at 31 October 2026; CMS and Digital Policy Alert count enforcement from 1 November. Either way, it has passed. Controllers and processors that handle Egyptian personal data now need a licence or permit from the Personal Data Protection Center (PDPC), registered data protection officers, and the ability to report breaches within 72 hours. I found no source confirming an extension or any enforcement action since the deadline.
What changed, and why it is a fair goal
Law No. 151 of 2020 was Egypt's first comprehensive data protection statute. Its Executive Regulations, Ministerial Decision No. 816 of 2025, were issued on 1 November 2025 but, according to CMS, were not made publicly available until 25 December 2025. They set up the operating machinery: general licences for controllers, processors or combined roles, usually valid for three years, plus supplementary permits for cross-border transfers, electronic direct marketing and visual surveillance. CMS also reports a 90-working-day review period once an application is complete, mandatory DPO appointments for legal entities with a PDPC-maintained registry, and breach notification to the PDPC within 72 hours.
The strongest case for all this is easy to state. A statute without a working regulator is a promise, not a protection, and Egypt waited five years for this one to become operational. Citizens in a fast-digitising economy deserve a body that can receive breach reports, keep a register of who processes their data, and sanction misuse. A grace year is also a generous runway; it is not a surprise ambush. Clyde & Co notes that fees vary with database size and that smaller databases benefit from exemptions, which suggests the drafters thought about proportionality.
Where the design creates friction
The problems are in the sequencing and the gatekeeping, not the goal.
First, the portal. Baker McKenzie reports that the PDPC launched its electronic portal in October 2026, and that creating a profile and submitting applications requires authentication through the government's Digital Egypt platform, whose credentials are linked to an Egyptian National ID. Baker McKenzie reads this as confirming that foreign controllers and processors must appoint a duly authorised local representative, who can authenticate with their own credentials. That is a workable path for a multinational with an Egyptian subsidiary. It is a real barrier for a foreign start-up or a small non-Egyptian SaaS firm with Egyptian users but no local presence: it must find, contract and trust a local agent before it can even open an application.
Second, the timing. The portal went live only weeks before the deadline, and the regulations were public for less than ten months of the twelve-month window. A 90-working-day review period is roughly four and a half months. A firm that began its application on the day the portal opened could not expect a decision before the grace period lapsed. Regulators sometimes manage this by signalling forbearance for good-faith applicants; I found no such public signal.
Third, the penalty exposure. Clyde & Co reports fines of EGP 200,000 to EGP 5 million, potential criminal liability in certain cases, and mandatory public disclosure of violations. US Commerce Department market intelligence states that the law imposes licensing requirements for data processing, data control, sensitive data, electronic marketing and cross-border transfers, and that four categories of acts can lead to imprisonment. When licensing is a precondition for lawful processing and the licensing queue is still new, uncertainty about who will be pursued first becomes a cost in itself.
The licensing-discretion question
Licensing regimes concentrate discretion in one body, and Egypt's recent record with other licences should make observers attentive. In a separate matter, the EFF reports that Mada Masr editor Lina Attalah was convicted on 27 October for managing an unlicensed news website, after the outlet's repeated licence applications went unacknowledged, and was fined the maximum EGP 3 million. That case concerns media law, not the PDPL, and nothing I found suggests the PDPC will use its powers that way. But it illustrates why open-internet advocates care about whether licence decisions are time-bound, reasoned and appealable. A data protection licence that can be delayed without explanation is, in principle, a lever over who can process data and therefore who can operate online.
What proportionate implementation would look like
None of this requires weakening the law. It requires the PDPC to do four things:
- Publish the decision criteria and review timelines in its guidelines, and honour the 90-working-day limit.
- State publicly how it will treat applicants with pending, complete applications after the grace period.
- Offer a route for foreign firms that does not depend on a National ID-linked login, or at least document the local-representative route clearly in English and Arabic.
- Prioritise enforcement on serious harms, such as breaches and unlawful sensitive-data processing, over paperwork lapses by small operators.
The Digital Policy Alert tracker records that the PDPC released its Licences and Permits Guidelines, Version 1.1, on 26 January 2026. That is a good start. The next test is practical: whether applications are processed on schedule, and whether the first enforcement actions target real harm. Until then, firms serving Egyptian users should apply now, document the date, and appoint a local representative and DPO. Egypt's regulator should answer with clarity, not silence.