My company works in Egypt. What does the law ask of us when an AI agent reads our data?
The short answer
The Personal Data Protection Law, Law 151 of 2020, applies, and its executive regulations were published on 1 November 2025. The law gives companies one year from the regulations to comply. It works by licence: a company that processes personal data needs a licence from the Personal Data Protection Centre, and sending data to a model provider abroad needs a cross-border licence as well as the person's consent. Egypt has no AI law yet, and its AI charter and governance framework are not laws.
The law that applies
Law 151 of 2020 on the Protection of Personal Data was published on 15 July 2020. Its executive regulations were issued by Ministerial Decree 816 of 2025 and published in the Official Gazette on 1 November 2025. The law gives companies one year from the regulations to bring their work into line, so the grace period runs to about the start of November 2026.
The law is enforced by the Personal Data Protection Centre, which now runs an online portal for licences and for registering data protection officers.
The law covers personal data processed electronically. It reaches acts done abroad that affect Egyptians or foreigners living in Egypt, where the act done by a non-Egyptian abroad is also an offence in the country where it happens. Data held by the Central Bank of Egypt and the entities it supervises is outside this law, except money transfer and exchange companies. The Central Bank’s own rules govern that data.
Can the agent read personal data at all?
Yes, if you have a legal basis and the right licence. The law allows processing with the person’s consent for a specific purpose, to perform a contract with the person, to meet a legal obligation or a court order, or for the company’s legitimate rights where they do not conflict with the person’s basic rights.
Watch the definition of sensitive data. In Egyptian law it includes health, biometric, genetic, religious and political data, and also financial data. Children’s data is always sensitive. An agent that reads salaries, bank details or payment records in your ERP system is handling sensitive data. Sensitive data needs a licence from the Centre and the person’s explicit written consent.
A licence comes first
The Egyptian law differs from many others in one point: it runs on licences. A company that acts as a controller or a processor of personal data needs a licence or a permit from the Centre. A licence covers ongoing processing and lasts 3 years, renewable. A permit covers occasional processing. Every company that processes personal data must also appoint a data protection officer registered with the Centre, and appointing one is among the steps to obtain a licence.
Sending data outside Egypt
Transferring personal data abroad is banned unless the destination offers protection at least equal to Egypt’s, and the Centre has granted a licence or a permit. The executive regulations add that the person’s consent is needed as well, and that data may go only to the countries named in the licence.
The Centre’s own licence guideline says that a cross-border licence includes engaging cloud service providers whose servers are outside Egypt. An AI model provider that processes your requests abroad falls under that description. A provider outside Egypt that processes data covered by the law must also appoint a representative in Egypt.
When something goes wrong
You must notify the Centre of a breach within 72 hours, and the affected person within 3 working days of notifying the Centre.
The penalties are heavy. Transferring data abroad in breach of the law, or breaching the rules on sensitive data, can bring prison of at least 3 months, a fine of 500,000 to 5 million Egyptian pounds, or both. A company’s actual manager faces the same penalties if it is proven they knew of the violation and their failure in their duties contributed to it. Penalties double for a repeat offence.
What Egypt says about AI itself
Egypt has published a National AI Strategy, whose second edition covers 2025 to 2030, and the Egyptian Charter for Responsible AI of 2023. In March 2026 it released version 2.0 of a National AI Governance Framework. The framework sorts AI systems into risk levels, puts chatbots in the limited-risk level with a duty to tell people they are dealing with AI, and names the Personal Data Protection Centre for privacy audits and impact assessments. None of these is a law yet. The framework describes binding requirements for high-risk systems, but no law gives them legal force. The strategy says an Egyptian AI law is being drafted. I found no enacted AI law as of October 2026.
What this means for you
- Check whether your company already holds a licence from the Centre, and whether it covers transfer abroad.
- Appoint and register a data protection officer, if you have not.
- Treat financial records as sensitive data when you decide what the agent may read.
- If your model provider processes data outside Egypt, make sure your licence covers that transfer before the agent reads personal data.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- Personal Data Protection Centre, Law 151 of 2020 and its Executive Regulations, Guidelines page
- Personal Data Protection Centre, Licenses and Permits Guidelines, version 1.1, January 2026, Guidelines page
- Personal Data Protection Centre, online services
- Ministry of Communications and Information Technology, Egypt’s National AI Strategy, second edition, 2025
- National Council for AI, Egyptian Charter for Responsible AI, 2023
- Ministry of Communications and Information Technology, Guide to Egypt’s National AI Governance Framework, March 2026