Egypt: cookie and consent rules under Law No. 151 of 2020

What is Egypt's data protection law?

Law No. 151 of 2020 promulgating the Personal Data Protection Law was published in the Official Gazette in July 2020 and came into force three months after the day following publication, in October 2020. In practice it stayed dormant: issuing Article 4 asked the Minister of Communications and Information Technology to adopt the Executive Regulation within six months, and that took five years. Ministerial Decree No. 816 of 2025 issued the Executive Regulation on 1 November 2025, effective the day after publication in the Official Gazette. Issuing Article 6 gives entities one year from the issue of the Regulation to bring their processing into line, so full compliance is due around 1 November 2026. Law firms note that the text was not widely available until late December 2025 and that the exact end of the grace period may be read differently, so treat the autumn of 2026 as the deadline.

The supervisor is the Personal Data Protection Center (PDPC), a public economic authority attached to the Minister (Article 19). It issues licences and permits, receives breach notifications, handles complaints and runs an online portal for registration and licensing.

Who does the law apply to?

The law covers personal data of natural persons processed wholly or partly by electronic means, by any holder, controller or processor (issuing Article 1). Its offenses apply to Egyptians inside or outside Egypt, to foreigners residing in Egypt, and to foreigners outside Egypt when the act is also an offense where it was committed and the data concerns Egyptians or foreigners residing in Egypt (issuing Article 2). Exclusions include data kept for personal use, official statistics, journalism, judicial records, national security, and entities supervised by the Central Bank of Egypt, except money transfer and exchange companies.

Personal data is any data relating to an identified natural person, or one identifiable directly or indirectly by linking it with other data such as a name, voice, image, identification number or online identifier (Article 1). A cookie or advertising ID tied to a visitor is therefore personal data.

Do cookies need consent in Egypt?

There is no Egyptian rule written for cookies, so the general rules decide. Article 2 forbids collecting, processing, disclosing or revealing personal data by any means without the explicit consent of the data subject, unless the law authorizes it. Article 6 treats processing as lawful when the person has given explicit consent for one or more specific purposes, when it is necessary for a contract or legal claims, to meet a legal obligation or a judicial order, or to let the controller exercise legitimate rights that do not conflict with the person's fundamental rights and freedoms. Article 3 adds that data must be collected for legitimate, specific and declared purposes known to the person and kept no longer than necessary.

The Executive Regulation sharpens this:

• personal data may be collected only after consent and after telling the person the purpose clearly; giving data to receive a service counts as consent for that purpose only;
• the PDPC must approve the mechanisms used to collect personal data and to obtain consent;
• controllers must keep a secured electronic register recording each consent, its date, the form in which it was given, the categories of data and the scope of use;
• data collected from children taking part in games or competitions may not be used for profiling, tracking or behavioral monitoring.

Strictly necessary cookies fit the service-related reading. Analytics and advertising cookies have no clear basis other than explicit consent, which means a banner that asks before those cookies run, offers a real refusal and logs each answer. Electronic direct marketing has its own rules: prior consent, an identified sender, a clear opt-out and records of consent kept for three years after the last message (Articles 17 and 18), plus a dedicated licence.

Do I need a licence?

Probably, if you process personal data of people in Egypt as a business. The PDPC issues licences and permits to controllers and processors, and separately for direct electronic marketing, sensitive data, visual surveillance and cross-border transfers (Article 26). Licence fees are capped at EGP 2,000,000 and permit or accreditation fees at EGP 500,000, with the actual amounts set by the Executive Regulation according to the activity and data volume. The Center decides within 90 days of a complete application; silence counts as refusal (Article 27).

Can personal data leave Egypt?

Article 14 forbids transferring, storing or sharing personal data abroad unless the destination offers protection at least equal to Egyptian law and the PDPC has issued a licence or permit. Article 15 allows transfers to countries without adequate protection with the person's explicit consent in listed cases, such as medical care, legal claims, a contract in the person's favor or international agreements. Analytics and advertising providers that process data outside Egypt fall under these rules.

What are the penalties?

The law uses criminal penalties, tried by the Economic Courts:

Penalties double for repeat offenses, convictions are published in two newspapers at the offender's expense (Article 48), and the person who actually manages a company can be punished personally if they knew of the violation (Article 47). We found no published enforcement decision under the law as of October 2026.

How Cookiequiet fits

Egypt is not in Cookiequiet's preset list of regulated countries, so add it to a custom country list or show the banner everywhere; geo-targeting is included on every plan. The banner holds analytics and marketing scripts until a choice, shows Reject all next to Accept all, and the consent log records the date, choice, categories and banner version of each decision, which maps onto the Regulation's consent register. Arabic is not one of the 24 built-in languages: visitors whose browser asks for it see the site's default language, whose strings you can edit. Cookiequiet does not handle PDPC licensing or transfer permits. Start with the cookie scanner to list your providers, and compare the Saudi rules and the GDPR. Not legal advice.