Egypt

The regulator's own slide deck says what happens if you have no office in Egypt. If you use or store personal data about Egyptian citizens, or about people living in Egypt, you must appoint a legal representative in Egypt. You submit that person to the Personal Data Protection Centre for examination and approval. The representative is then your official point of contact with the Centre. Fees are banded by the number of records you hold, where one record means one person. Associations, unions and clubs have their own single fee table. The reach also works the other way. A foreign bank is not automatically caught, because the law expressly leaves out the Central Bank of Egypt and the entities it supervises.

Industry by industry as of 18 August 2026. BANKING: the Central Bank of Egypt and the entities it supervises are left out of the privacy law entirely. Bank data follows central bank rules that we could not retrieve. Money transfer companies and exchange offices are expressly NOT left out and stay inside the privacy law. NON-BANK FINANCE AND PAYMENTS TECHNOLOGY: the Financial Regulatory Authority requires the customer database of a licensed financial-technology firm to sit within Egypt's borders. The firm must tell the Authority within thirty days if it starts moving its head office or its data centre. INSURANCE AND SECURITIES: the same Financial Regulatory Authority decision covers these where the work is done through financial technology. We found no separate general rule forcing ordinary insurers or brokers to keep data in Egypt. HEALTH: human samples taken in clinical research may not enter or leave Egypt without approval from the Supreme Council for Clinical Medical Research. National-security requirements are taken into account. Research data must be open to inspection by the Supreme Council, the Egyptian Drug Authority and the General Intelligence Agency. TELECOM: service providers must keep system logs for one hundred and eighty days. They must also give national security bodies the technical means to do their work. We found no requirement in the text that those logs be held inside Egypt. VIDEO SURVEILLANCE: using or sending public-space camera data outside Egypt is banned, except for reasons set out in law. GOVERNMENT CLOUD, EDUCATION, GAMBLING, MAPPING AND DEFENCE: we found no rule in an official source, checked 18 August 2026, low confidence.

The regulator decides each case one by one. It also plans a list of approved countries, but that list is empty. The Centre's own document uses the future tense. It says it 'will maintain a whitelist of countries deemed to have an adequate level of personal data protection'. No such list appears in the Centre's published material as of 18 August 2026. Nor does a standard contract template. The tab on its website for the Centre's decisions is empty. Alongside the licence route sits a short set of exceptions in the law. All of them still need the person's valid consent. They are: saving a life or providing medical care, defending a legal right in court, entering or performing a contract for the person's benefit, international judicial cooperation, protecting the public interest or complying with a law, making money transfers abroad under the applicable rules, and transfers under a treaty Egypt has signed. A licence lasts three years. You must renew it at least three months before it expires, or it lapses automatically. A permit lasts up to one year and must be renewed at least one month before expiry. Fees are set in tables attached to the detailed rules. The Centre's board can change them by its own decision.

The evidence that the regulator works comes from the Centre's own site. It published Licenses and Permits Guidelines version 1.1 dated 26 January 2026. It published a slide deck on the rules and enforcement dated March 2026. It ran a four-day training programme for data protection officers in February 2026. That was attended by the German Embassy, the European Union Delegation and the African Union. It held a joint session with the State Lawsuits Authority and the British University in Egypt in early 2026 on the new rules. It attended the Global Cross-Border Privacy Rules Forum spring workshop in March 2026. Suzanne El Akabaoui is described as Acting Chief Executive of the Centre. She is also adviser to the Minister of Communications and Information Technology for data governance. We rate the regulator 'waking' rather than 'active' for three reasons. No enforcement decision has been published. The one-year window to get licensed does not close until early November 2026. And the site's own content has not been refreshed since 7 April 2026. The complaints process is set out. The Centre must decide a complaint within thirty working days. The offender then has seven working days to comply. If it does not, the Centre may sue it.

The one-hundred-and-eighty-day duty comes from the Anti-Cyber and Information Technology Crimes Law No. 175 of 2018. It covers data that identifies the user, content data under the provider's control, traffic data, terminal device data, and any further category the telecom regulator's board decides to add. The privacy law's own rule on not keeping data too long is one of seven principles the regulator lists. Sometimes one law tells you to keep data and another tells you to delete it. The licences guideline is clear on this. A licence from the Centre does not replace approvals or duties you owe to other authorities. So the longer keep-time set by law wins. You lock the data down rather than delete it. We could not verify Egypt's general tax and book-keeping keep-times from an official source, so we do not state them here.

A third deadline runs on complaints rather than breaches. Once someone complains, the Centre must issue its decision within thirty working days. Your organisation then has seven working days to put things right and report back. A fourth deadline catches people out in normal day-to-day work. Someone using any of their nine rights must get an answer within six working days of asking. We could not verify whether the telecom regulator's incident response team or the central bank set their own separate incident deadlines. So we do not state any here.

On children. For a child under fifteen you must get written explicit consent from the parent or guardian before collecting anything. That consent must state the purpose and how long you will use the data. A young person aged fifteen to eighteen may hand over the guardian's written explicit consent themselves. Either way the age limit is eighteen, well above the thirteen or sixteen used elsewhere. On the data protection officer. They must be named in the organisation chart. They must report to the highest level of management. They must be independent of decisions about how data is used. They must be entered in the Centre's register after sitting the Centre's examination for one of three categories. They may be Egyptian or foreign. On prison risk in health. Anyone who helps human research samples leave Egypt without prior approval faces imprisonment plus a fine. The fine runs from five hundred thousand to one million Egyptian pounds. That is roughly ten to twenty thousand United States dollars. On state access. When national security bodies ask, telecom and technology service providers must supply all the technical capabilities those bodies need. Clinical research data must also be open to the General Intelligence Agency for audit. On what the regulator can do after granting your licence. It may change your licence terms on public-interest grounds. It may publish proven violations in the media at your expense. It may place you under technical supervision, and you pay the cost.

Powers the government already holds, in order of how much they would change things. One: the list of countries the regulator considers safe enough to receive Egyptian data. It is promised but not published. Publishing it would make transfers to those countries much easier straight away. Two: the recommended contract wording for transfers. Also promised, also not published. Applicants are left guessing what protections will satisfy the regulator. Three: the Centre's decisions page. It is empty today and can be filled at any time with binding rules for any industry. Four: fees, which the Centre's board can change by its own decision. Five: the telecom regulator's board can add new kinds of data to the one-hundred-and-eighty-day keep-time by decision. Six: the Centre may change the terms of a licence you already hold, on public-interest grounds. Egypt attended the Global Cross-Border Privacy Rules Forum spring workshop in March 2026. It says it is seeking mutual recognition with other countries. Movement is possible but nothing is agreed.