Egypt's data protection law has executive regulations from November 2025

Egypt's Personal Data Protection Law 151/2020 established the principles of lawful processing, data subject rights and cross-border transfer control. What it lacked for five years was the implementing detail that makes a compliance programme possible.

Decree No. 816 of 2025 issued those executive regulations. The decree was published in the Egyptian Official Gazette (al-Waqa'i al-Misriyya) on 1 November 2025, in issue 244, annex "A", and takes effect from 2 November 2025.

Published accounts differ on the issuing authority: the gazette entry records it as a decision of the Minister of Communications and Information Technology, while several legal commentaries describe it as a Prime Ministerial decree. Cairo Stream reports the decree number and gazette date, which are not in dispute, and does not assert one issuing authority over the other.

What changes in practice

Organisations handling personal data in Egypt now face defined expectations on how consent is captured, how records are kept, how breaches are handled and how transfers outside the country are treated. These are operational requirements, not policy statements. Legal analyses of the text describe a one-year window in which existing controllers and processors are expected to bring operations into line.

Who is affected first

Sectors that process personal data at scale feel it first: telecom operators, banks and payment providers, healthcare organisations and any platform holding customer identity records. The fintech services described in our report on digital payments adoption sit squarely inside that group.

The infrastructure angle

Rules on cross-border transfer are one of the practical arguments for hosting data domestically, a trend discussed in our data centre coverage.

What to watch

Enforcement, not text. The regulations' significance will be visible in supervisory activity and in whether organisations publish substantive privacy notices rather than boilerplate.