Egypt

The regulator's own framework deck states that where an entity has no establishment in Egypt and processes personal data relating to Egyptian data subjects or people resident in Egypt, it must appoint a legal representative in Egypt, submitted to the Personal Data Protection Centre for examination and approval, and that this representative acts as the entity's official interface with the Centre. Fee bands are set by the number of records, where one record equals one data subject, with a separate unified fee table for associations, unions and clubs. Note the reverse of the extraterritorial reach: a foreign bank is not automatically caught, because the law expressly excludes the Central Bank of Egypt and the entities it supervises.

Sector by sector as of 18 August 2026. BANKING: the Central Bank of Egypt and the entities under its supervision are excluded from the privacy law entirely, so bank data is governed by central bank rules we could not retrieve; money transfer companies and exchange offices are expressly NOT excluded and stay inside the privacy law. NON-BANK FINANCE AND PAYMENTS TECHNOLOGY: the Financial Regulatory Authority requires that the customer database of a licensed financial-technology firm sit within Egypt's geographic borders, and that the Authority be told within thirty days if the firm starts moving its head office or its data centre. INSURANCE AND SECURITIES: covered by the same Financial Regulatory Authority decision where the activity is carried on through financial technology; we found no separate general localisation rule for conventional insurers or brokers. HEALTH: human samples taken in clinical research may not enter or leave Egypt without the approval of the Supreme Council for Clinical Medical Research, with national-security requirements taken into account; research data must be open to inspection by the Supreme Council, the Egyptian Drug Authority and the General Intelligence Agency. TELECOM: service providers must keep system logs for one hundred and eighty days and must give national security bodies the technical means to exercise their powers; we found no requirement in the text that those logs be held inside Egypt. VIDEO SURVEILLANCE: processing or transferring public-space camera data outside Egypt is prohibited except for legally prescribed reasons. GOVERNMENT CLOUD, EDUCATION, GAMBLING, MAPPING AND DEFENCE: no rule found in an official source, checked 18 August 2026, confidence low.

This is a case-by-case authorisation model with an allowlist bolted on that is not yet populated. The Centre's own framework document uses the future tense: it 'will maintain a whitelist of countries deemed to have an adequate level of personal data protection'. No such list, and no standard contract template, appears on the Centre's published materials as of 18 August 2026, and the tab on its website for the Centre's decisions is empty. Alongside the licence route sits a narrow set of exceptions in Article 15 of the law which still require the person's valid consent: saving a life or providing medical care, defending a legal right in court, entering or performing a contract for the person's benefit, international judicial cooperation, protecting the public interest or complying with a law, making money transfers abroad under the applicable rules, and transfers under a treaty Egypt has signed. A licence lasts three years and must be renewed at least three months before it expires or it lapses automatically; a permit lasts up to one year and must be renewed at least one month before expiry. Fees are set in financial tables attached to the executive regulations and can be changed by a decision of the Centre's board.

Evidence of a functioning regulator, all from the Centre's own site: Licenses and Permits Guidelines version 1.1 dated 26 January 2026; a framework and enforcement deck dated March 2026; a four-day capacity-building programme for data protection officers in February 2026 attended by the German Embassy, the European Union Delegation and the African Union; a joint session with the State Lawsuits Authority and the British University in Egypt in early 2026 on the new regulations; and attendance at the Global Cross-Border Privacy Rules Forum spring workshop in March 2026. Suzanne El Akabaoui is described as Acting Chief Executive of the Centre and adviser to the Minister of Communications and Information Technology for data governance. The rating is 'waking' rather than 'active' for three reasons: no enforcement decision has been published, the one-year compliance period does not end until early November 2026, and the site's own content has not been refreshed since 7 April 2026. The complaints machinery is defined: the Centre must decide a complaint within thirty working days, the offender has seven working days to comply, and if it does not, the Centre may sue it.

The one-hundred-and-eighty-day duty sits in Article 2 of the Anti-Cyber and Information Technology Crimes Law No. 175 of 2018 and covers data that identifies the user, content data under the provider's control, traffic data, terminal device data, and any further category the telecom regulator's board decides to add. The privacy law's own storage limitation principle is one of seven processing principles the regulator lists. Where a keeping duty and a deleting duty conflict, the licences guideline is explicit that a licence from the Centre does not replace approvals or obligations owed to other authorities, so the longer statutory keeping duty wins and the data must be locked down rather than deleted. We could not verify Egypt's general tax and commercial book-keeping periods from an official source in this run and have not asserted them.

A third clock runs on complaints rather than breaches: once someone complains, the Centre must issue its decision within thirty working days, and the organisation then has seven working days to put things right and report back. A fourth timer catches people out in normal operations: an individual exercising any of their nine rights must get an answer within six working days of asking. We could not verify whether the telecom regulator's incident response team or the central bank impose their own separate incident deadlines on the firms they supervise, and have not asserted any.

On children: for a child under fifteen the organisation must obtain the written explicit consent of the parent or guardian before collecting anything, and that consent must state the purpose and how long the processing will last; for a young person aged fifteen to eighteen, they may themselves hand over the guardian's written explicit consent. Either way an eighteen-year-old threshold governs, well above the thirteen or sixteen used elsewhere. On the data protection officer: they must be named in the organisation chart, report to the highest level of management, be independent of decisions about processing, and be entered in the Centre's register after sitting the Centre's examination for one of three categories; they may be Egyptian or foreign. On criminal exposure in health: anyone who contributes in any way to human research samples leaving Egypt without prior approval faces imprisonment plus a fine of between five hundred thousand and one million Egyptian pounds, roughly ten to twenty thousand United States dollars. On state access: telecom and technology service providers must, when national security bodies ask, supply all the technical capabilities those bodies need to exercise their powers, and clinical research data must be open to the General Intelligence Agency for audit. On the regulator's reach after the fact: it may amend your licence terms after issuing them on public-interest grounds, publish proven violations in the media at your expense, and place you under technical supervision with you paying the cost.

Dormant switches, in order of how much they would change the picture. One: the list of countries the regulator considers safe enough to receive Egyptian data. It is promised, it is not published, and publishing it would instantly make transfers to those countries far easier, while leaving everyone else worse off by comparison. Two: the recommended contract wording for transfers. Also promised, also not published, which leaves applicants guessing what safeguards will satisfy the regulator. Three: the Centre's decisions page, which is empty today and can be filled at any time with binding rules on any sector. Four: fees, which the Centre's board can change by its own decision. Five: the telecom regulator's board can add new categories of data to the one-hundred-and-eighty-day retention duty by decision. Six: the Centre may amend the terms of a licence you already hold, after it has been issued, on public-interest grounds. Egypt attended the Global Cross-Border Privacy Rules Forum spring workshop in March 2026 and says it is pursuing reciprocal adequacy findings, so movement on international recognition is plausible but nothing is agreed.