Egypt’s Grace Period Ends. No One Agrees When
Egypt's one-year window to comply with the personal data protection regulations closes this week, but Baker McKenzie says 31 October, CMS and Soliman Hashish say 1 November, and the Centre's acting chief said only November. The decree that started the clock is not public.
An office building in Smart Village, the technology park west of Cairo that hosts much of Egypt’s telecommunications and IT sector; the licensing regime now closing its grace period reaches every organisation processing personal data in the country. Illustrative.
Photo: Mohamed Ouda, CC BY-SA 4.0 · source
Egypt’s one-year window for bringing data processing into line with the Executive Regulations of Law No. 151 of 2020 on the protection of personal data, reproduced by Masaar closes this week. The day is in dispute. Baker McKenzie’s Cairo member firm, Helmy, Hamza & Partners, wrote on 7 October 2026 that the grace period “is set to expire on 31 October 2026”. CMS read the same instrument as starting enforcement on 1 November 2026, and Soliman Hashish & Partners agreed. The Personal Data Protection Centre (PDPC), which issues the licences, has published nothing to settle it.
The two dates are consecutive days. The real gap is between the commentary and an instrument the public cannot read.
Four readings of one clock, and why none can be checked
The instrument is Decision No. 816 of 2025, and every source AI & GPP opened attributes it to the communications ministry: Clyde & Co names the ministry as issuer, PPC Land the signing minister, Amr Talaat.
Where the accounts part is the start date. Clyde & Co, writing on 21 January 2026, gave an effective date of 1 November 2025, a twelve-month grace period and “full enforcement: 31 October 2026”. CMS dated issuance to the same day but noted the regulations “were not made publicly available until 25 December 2025”, and flagged that the Centre “may ultimately treat the grace period as running to the end of 2026” — a third reading. PPC Land places the text in Official Gazette issue 244 dated 10 November 2025, effective on publication — a fourth. None of this reconciles without the decision’s own commencement article, which AI & GPP could not obtain: searches of the Gazette, the ministry and the Centre, in Arabic and in English, returned no text.
What the Centre has actually said, and the portal that came late
The nearest thing to an official position is five months old and secondhand. At a seminar of the Egyptian Businessmen’s Association in May, the Centre’s acting chief executive, Susan El-Oqbawy, said the one-year period ends in November 2026 — reported in those terms by Al-Watan and by Vetogate. Both also report her saying the Centre will start with large entities, and that it holds judicial-police powers to inspect at home and abroad. Neither gives a day.
The portal that makes compliance possible was promised for June 2026. Baker McKenzie reports it opened in early October — four months late, using Digital Egypt credentials tied to an Egyptian national identity number, so a foreign controller or processor must act through an authorised local representative. AI & GPP found no PDPC or ministry statement, and no Gazette entry, extending the period, in Arabic or English, in the fortnight to 25 October 2026.
What binds an AI deployer that does not bind an ordinary controller
| Duty | What it requires | What it rests on | Figure or clock |
|---|---|---|---|
| Licence to process or store, as controller or processor | A Centre licence; licences issue to legal persons for three years, renewable | Law No. 151 of 2020, arts. 1, 19 and 26 (primary): art. 1 fixes the three-year renewable term, art. 19 the Centre’s issuing power; three-year term also per CMS (commentary) | Fee cap EGP 2,000,000 |
| Licence for sensitive personal data | A Centre licence plus written, explicit consent before processing | Art. 12 (primary) | — |
| Licence or permit to send data abroad | Equivalent protection at the destination plus a Centre licence or permit; CMS says the application must set out destination, storage, security, volumes and retention | Arts. 14–16 (primary); application content from CMS (commentary) | — |
| Breach notification | Report to the Centre, then notify affected individuals | Art. 7 (primary) | 72 hours; three working days |
| Local representative | A controller or processor outside Egypt must appoint one in Egypt | Arts. 4(11) and 5(12) (primary) | — |
| Penalties | Licence, sensitive-data and cross-border breaches sit in the top band; the latter two also carry imprisonment of at least three months | Arts. 41, 42 and 45 (primary). Clyde & Co summarises the overall range as EGP 200,000 to EGP 5m; the statute runs lower, to EGP 50,000 under art. 40 where a data protection officer’s failure is negligent | EGP 500,000–5,000,000 |
| Application processing | Review of a complete application | CMS (commentary only) | 90 working days |
Law No. 151 of 2020 contains no provision on automated decision-making. An AI deployer’s exposure arrives instead through three ordinary doors it walks through more often than a conventional controller. Training or inference data sent to a model hosted outside Egypt is a cross-border transfer under Articles 14 to 16, which CMS notes covers cloud environments, and Article 42 attaches imprisonment as well as a fine. A model that infers health, biometric, financial, religious or political attributes from ordinary inputs is processing sensitive data, which Article 12 forbids without a licence and written consent. And a model vendor is a processor: one with no Egyptian establishment owes the Article 5 local-representative duty on its own account, not its customer’s. This is data law doing the regulating, as in Ethiopia’s national data governance proclamation, and the ground floor of Africa’s AI rulebook.
What to do this week, and the one announcement to watch
Work backwards from the review period, not the date. If CMS is right that the Centre takes 90 working days on a complete application, an organisation filing this week is unlicensed into March — which argues for filing now; Soliman Hashish’s note expects “substantive and good faith compliance” after the period ends. Three things are worth finishing first: a list of every flow of personal data out of the country, model APIs included; an authorised local representative, without which a foreign entity cannot reach the portal; and the breach clocks written into vendor contracts, since the controller owes them whoever caused the breach.
One announcement would settle it: a PDPC statement, or a Gazette entry. An extension would concede that a portal four months late left too little time. Compare Morocco, which this month gained an owner for the subject rather than a clock: on 16 October King Mohammed VI appointed a government in which Ahmed Rahhou holds a ministry for artificial intelligence, digital transformation and administration reform. Of the three routes to an AI rulebook AI & GPP has traced across the continent, Egypt’s is the one that binds — if only its regulator would say from when.
Sources
- Egypt: Personal Data Protection Law Update — Baker McKenzie (Helmy, Hamza & Partners, Cairo), 7 October 2026
- Egypt’s PDPL: Executive regulations issued – one year compliance countdown begins — CMS, 13 January 2026
- Egypt Personal Data Protection Law: New Compliance Developments — Soliman Hashish & Partners, via Mondaq, 14 May 2026 (free registration may be requested)
- Egypt: regulatory update on data privacy — Clyde & Co, 21 January 2026
- قانون حماية البيانات الشخصية رقم 151 لسنة 2020 (Law No. 151 of 2020 on the Protection of Personal Data, full text) — Masaar (Technology and Law Community), law published in the Official Gazette no. 28 bis (E), 15 July 2020 (reproduction of the gazette text; in Arabic; translation by AI & GPP)
- جمعية «رجال الأعمال»: إطلاق منصة إلكترونية لتراخيص حماية البيانات الشخصية في يونيو المقبل — Al-Watan (El Watan News), 14 May 2026 (in Arabic; translation by AI & GPP)
- ندوة جمعية رجال الأعمال المصريين عن حماية البيانات — Vetogate, 14 May 2026 (in Arabic; translation by AI & GPP)
- Egypt finally implements data protection law after five-year delay — PPC Land, 27 December 2025
- HM the King chairs new government appointment ceremony — Maroc.ma (Kingdom of Morocco official portal), 16 October 2026
Claim ledger (piece 11)
| Claim | Source URL | Publisher | Pub. date | Accessed | Primary/Secondary | Single-source? |
|---|---|---|---|---|---|---|
| Grace period “is set to expire on 31 October 2026” | https://www.bakermckenzie.com/en/insight/publications/2026/10/egypt-personal-data-protection-law-update | Baker McKenzie / Helmy, Hamza & Partners | 7 Oct 2026 | 25 Oct 2026 | Secondary | Yes (for 31 Oct as expiry wording) |
| PDPC portal opened early October 2026; Digital Egypt credentials tied to Egyptian national ID; local representative may authenticate for a foreign party | same as above | Baker McKenzie | 7 Oct 2026 | 25 Oct 2026 | Secondary | Yes |
| Decision No. 816 of 2025 issues the Executive Regulations | same as above; corroborated by Clyde & Co and PPC Land | Baker McKenzie | 7 Oct 2026 | 25 Oct 2026 | Secondary | No |
| Regulations formally issued 1 November 2025; not publicly available until 25 December 2025; enforcement “to begin on 1 November 2026”; Centre “may ultimately treat the grace period as running to the end of 2026” | https://cms.law/en/are/legal-updates/egypt-s-pdpl-executive-regulations-issued-one-year-compliance-countdown-begins | CMS | 13 Jan 2026 | 25 Oct 2026 | Secondary | Yes |
| Licences usually valid three years; 90-working-day review of a complete application; cross-border applications must describe destination, storage, security, volumes, retention; cloud environments included | same as above | CMS | 13 Jan 2026 | 25 Oct 2026 | Secondary | Yes (90 days and application content) |
| Grace period ends 1 November 2026; “substantive and good faith compliance” expected after that date | https://www.mondaq.com/privacy-protection/1786854/egypt-personal-data-protection-law-new-compliance-developments | Soliman Hashish & Partners, via Mondaq | 14 May 2026 | 25 Oct 2026 | Secondary | No (1 Nov shared with CMS) |
| Issuer is the Ministry of Communications and Information Technology; effective date 1 Nov 2025; 12-month grace; “Full enforcement: 31 October 2026”; penalty range EGP 200,000–5m | https://www.clydeco.com/en/insights/2026/01/egypt-regulatory-update-on-data-privacy | Clyde & Co | 21 Jan 2026 | 25 Oct 2026 | Secondary | Yes (the 200,000–5m summary range) |
| Official Gazette issue 244 dated 10 November 2025; signed by Minister Amr Talaat; regulations effective on publication | https://ppc.land/egypt-finally-implements-data-protection-law-after-five-year-delay/ | PPC Land | 27 Dec 2025 | 25 Oct 2026 | Secondary | Yes (gazette issue/date) |
| Arts. 1, 19 and 26: licensable activities; licence to a legal person (“للشخص الاعتباري”) for three years renewable (“لمدة ثلاث سنوات قابلة للتجديد”); permit for up to one year; accreditation for consultancy; art. 19 establishes the Centre and its power to issue licences and permits; fee caps EGP 2,000,000 (licence) and EGP 500,000 (permit/accreditation) | https://masaar.net/ar/egypt_laws/%D9%82%D8%A7%D9%86%D9%88%D9%86-%D8%AD%D9%85%D8%A7%D9%8A%D8%A9-%D8%A7%D9%84%D8%A8%D9%8A%D8%A7%D9%86%D8%A7%D8%AA-%D8%A7%D9%84%D8%B4%D8%AE%D8%B5%D9%8A%D8%A9/ | Masaar (reproduction of Official Gazette text) | law of 15 Jul 2020 | 25 Oct 2026 | Primary (reproduction) | Yes (single reproduction consulted) |
| Art. 7: notify the Centre within 72 hours (“خلال اثنتين وسبعين ساعة”), individuals within three working days (“خلال ثلاثة أيام عمل”) | same as above | Masaar | 15 Jul 2020 | 25 Oct 2026 | Primary (reproduction) | No (corroborated by CMS) |
| Art. 12: sensitive data needs a Centre licence plus written explicit consent; sensitive categories include health, genetic, biometric, financial, religious, political | same as above | Masaar | 15 Jul 2020 | 25 Oct 2026 | Primary (reproduction) | Yes |
| Arts. 14–16: cross-border transfer needs equivalent protection plus Centre licence or permit | same as above | Masaar | 15 Jul 2020 | 25 Oct 2026 | Primary (reproduction) | No (corroborated by CMS) |
| Arts. 4(11) and 5(12): controller/processor outside Egypt must appoint a representative in Egypt | same as above | Masaar | 15 Jul 2020 | 25 Oct 2026 | Primary (reproduction) | No (corroborated by CMS and Baker McKenzie) |
| Arts. 41, 42, 45: EGP 500,000–5,000,000; arts. 41 and 42 also carry imprisonment of at least three months; art. 40 negligence band from EGP 50,000 | same as above | Masaar | 15 Jul 2020 | 25 Oct 2026 | Primary (reproduction) | Yes |
| Law No. 151 of 2020 contains no automated-decision-making provision | same as above | Masaar | 15 Jul 2020 | 25 Oct 2026 | Primary (reproduction) | Yes (negative finding on the text consulted) |
| PDPC acting CEO Susan El-Oqbawy: one-year period ends in November 2026; Centre to start with large entities; judicial-police inspection powers; portal expected June 2026 | https://www.elwatannews.com/news/details/8284268 | Al-Watan | 14 May 2026 | 25 Oct 2026 | Secondary | No |
| Same seminar, same statements (“مهلة توفيق الأوضاع في نوفمبر 2026”) | https://www.vetogate.com/5655093 | Vetogate | 14 May 2026 | 25 Oct 2026 | Secondary | No |
| 16 October 2026: King Mohammed VI appointed a government; Ahmed Rahhou holds the AI, digital transformation and administration reform portfolio | https://maroc.ma/en/news/hm-king-chairs-new-government-appointment-ceremony | Maroc.ma (official) | 16 Oct 2026 | 25 Oct 2026 | Primary | Yes |
| 31 October 2026 is a Saturday and 1 November a Sunday | calendar arithmetic | — | — | 25 Oct 2026 | — | No |
Discussion
No comments yet. Start the conversation.
