Egypt's data protection law: the direction is right. Is the road ready?

In a few days, the grace period of Egypt’s Personal Data Protection Law (Law 151 of 2020) ends, and the law applies in full. I write this while my team and I are building tools for this law, so read my questions knowing that.

I support this law, for two reasons:

• Protecting people’s data is essential, not a luxury.
• The law pushes in a direction we need. It does not ban foreign tools, but Article 14 makes moving or storing data outside Egypt conditional on a licence, and on the protection there being no lower than ours. That encourages keeping our data and running it on local tools, rather than depending entirely on foreign solutions.

But the law alone is not enough. The law tells a company “do it”. The question is: does the company have the tool, does the regulator have what it needs to follow up, and does the market understand what is asked of it? I have six questions.

Question one: do compliance tools exist in the Egyptian market?

• Most companies work on tools whose servers are outside Egypt. To this day, no major American cloud provider has a region inside Egypt. The data an Egyptian company keeps in Gmail, Google Drive and Microsoft 365 is always stored abroad, which means Article 14 applies to the company from the first e-mail it sends.
• The only public cloud region inside Egypt is Huawei’s Cairo region, running since May 2024.
• WhatsApp Business data cannot be stored inside Egypt, because Egypt is not on the list of countries where Meta offers local storage.
• And the compliance management tools themselves? The big global tools, such as OneTrust, start at about 10 thousand dollars a year, are in English, and do not cover the details of the Egyptian executive regulations. We found no Egyptian tool built for small businesses.

In short: we ask a shop owner or a small company to comply, and the tools open to them are either foreign, which makes compliance harder, or expensive.

Question two: are the regulator’s own tools ready?

What has been done, to the regulator’s credit:

• The executive regulations were issued in November 2025.
• The Personal Data Protection Center published guidance on licences, privacy notices, consent, and the data protection officer.
• The online licensing portal opened this month.

And the Center’s own plan is realistic. At a seminar of the Egyptian Businessmen’s Association in May 2026, the Center’s acting chief executive said it would start with “the large entities”, then move “gradually to smaller entities”, and that its inspectors have judicial enforcement powers.

The question:

• Egypt has more than 1.7 million formal establishments in the private sector alone, according to the fifth economic census. What does the Center need to follow up on that many, even in stages?
• At that same seminar, the portal was expected to open in June. It opened in October, weeks before the grace period ends. Are those weeks enough for a company that has not started yet?
• And we have not yet found an official statement explaining what happens to small companies on 1 November. A clear announcement of the stages would reassure the market more than any campaign.

Question three: what did others do?

• Saudi Arabia: before full enforcement in September 2024, the Saudi Data and AI Authority (SDAIA) put in place the guidance and a free online register for organizations on a single government platform.
• Europe: between 2016 and 2019, data protection authorities grew their staff by 42 % and their budgets by 49 %, according to the European Commission. Even so, half of these authorities had budgets under 5 million euros, according to a report Brave published in 2020. What helped small companies there was not the fines, but free templates, helplines, and ready-made tools.
• Kenya: exempted small establishments from registration, but the exemption did not exempt them from the law. Among the first fines, in September 2023: a restaurant that posted a customer’s photo, and a school that posted pupils’ photos. By June 2023 the regulator had received 2,831 complaints, admitted 922, and decided only two.
• Nigeria: licensed private local firms for compliance audits and training: 70 firms in the first year, and more than 2,600 jobs according to the regulator. But it later delisted 19 firms for weak capacity. And its head says the country needs a national certification instead of foreign certifications priced in dollars.

The common thread: free tools, an easy register, and qualified local bodies came with enforcement or before it, not after. Where capacity fell short, complaints piled up.

Question four: who will build the tools, and do we encourage them?

The infrastructure is moving: in June 2026 the Minister of Communications announced that the ministry is preparing “an integrated national strategy for data centers and cloud computing” aimed at “strengthening digital sovereignty”. And the National Telecom Regulatory Authority issued 10 data center licences in two years.

The layer above it, the tools, is still waiting:

• We looked for a programme supporting startups that build compliance or data protection tools, at the Information Technology Industry Development Agency (ITIDA), the Technology Innovation and Entrepreneurship Center and Creativa, and found no dedicated programme. There are general programmes that mention cybersecurity among other sectors.
• The Government Contracts Law (Law 182 of 2018, Article 35) gives an Egyptian bid a preference of up to 15 %. But the “Cloud First” policy (2024) gives an Egyptian provider no preference at all.

In short: we are building data centers, and we have not yet started supporting the software that will run in them.

Question five: does the market understand what is asked of it?

• We found not one published survey of Egyptian companies’ readiness for the law in 2025 or 2026, from an association, a chamber or a consultancy.
• The latest figure we found is from 2021, before the regulations were issued: a study of 246 Egyptian companies by Centurion Consulting for Zoho. Only 10 % fully apply customer data protection policies, and only 19 % fully understand the region’s data protection laws.
• And at the same May 2026 seminar, one of the association’s speakers said awareness is the biggest challenge.

In short: we do not know where the market stands. And what we do not measure, we cannot fix.

Some may say…

• “Companies have had since 2020.” The law was issued in 2020, but the regulations that explain what is required were issued in November 2025, and the portal opened in October 2026. The practical time is less than a year.
• “The law does not ban foreign tools.” True. But it makes every transfer abroad conditional on a licence, and that is a burden for a small company that finds no local alternative.
• “Building tools is the market’s job, not the state’s.” Also true. What is asked of the state here is what it did for data centers: a clear signal, and a preference for the local product.

Question six: what do we need?

1. A clear announcement of the stages: who the law applies to and when, by size and sector. The Center said it would start with the large ones; let that be written and published.
2. A simplified path for small establishments: ready templates, an official self-check, and a helpline. That is what helped small companies in Europe.
3. Accredited local bodies that carry the load with the Center: the law allows the Center to accredit consultancies. With quality oversight, and an Egyptian certification at a reasonable price instead of foreign certifications priced in dollars. That is Nigeria’s lesson, both sides of it.
4. A preference for the Egyptian product in the “Cloud First” policy itself, as in the Contracts Law, so it covers the tools and not only the data centers.
5. An annual measure of the market’s readiness with the chambers of commerce and associations, so awareness is built on figures.

Conclusion

On 1 November nothing ends; something begins. The law is in the right direction, and what is needed now is to build the road to it: local tools, a capable regulator, and a market that understands.