The one-year grace period under Egypt's Personal Data Protection Law ends around 1 November 2026. From then, websites that use cookies to collect data from visitors in Egypt are expected to meet Law No. 151 of 2020 and its executive regulations in full: explicit consent before tracking cookies, a way to withdraw it, records of each choice, and a licence from the Personal Data Protection Centre (PDPC) where the law requires one.
Egypt's Personal Data Protection Law: the basics
Egypt's Personal Data Protection Law (PDPL), officially Law No. 151 of 2020, is the country's first dedicated privacy statute. Published in the Official Gazette on 15 July 2020 and entering into force on 17 October 2020, the law sat largely dormant for five years while the government worked on its executive regulations.
Those regulations were issued on 1 November 2025 under Ministerial Decision No. 816 of 2025, but the text was only made public on 25 December 2025. The one-year grace period runs from issuance, to around 1 November 2026. Watch for PDPC statements on the exact date.
The PDPL reaches beyond Egypt's borders. Article 2 of the issuing law applies it to Egyptians and residents of Egypt, and to non-Egyptians abroad where the act is also an offence where it was committed and the data concerns Egyptians or residents of Egypt. A website based in Europe or North America that collects data from Egyptian visitors should assume it is within scope.
The Personal Data Protection Centre (PDPC)
The PDPL establishes the Personal Data Protection Centre (PDPC) as the supervisory authority. It operates under the Ministry of Communications and Information Technology and holds responsibility for licensing, monitoring, investigating complaints, and enforcing the law.
The PDPC has the power to inspect data controllers, issue warnings, restrict processing activities, and refer offences for prosecution. It also manages a licensing regime: data controllers and processors need a licence, and separate permits cover cross-border data transfers, electronic direct marketing and visual surveillance.
As of October 2026, the PDPC has published operational guidelines on lawful bases, consent, privacy notices, licensing, direct marketing, records of processing and data protection officers, but no guidance or enforcement decision on cookies specifically. Enforcement can be expected to follow the end of the grace period.
How the PDPL applies to cookies and tracking technologies
The PDPL does not contain a standalone "cookie law" in the way the EU's ePrivacy Directive does. Instead, cookies fall under the law's general rules on personal data processing.
Cookies and similar tracking technologies - including SDKs, device identifiers, and pixels - are treated as personal data processing whenever they can identify or be linked to an individual. A cookie like _ga that assigns a unique client ID, or _fbp that tracks browsing behaviour for advertising, clearly falls into this category.
Strictly necessary cookies that are essential for basic website functionality (session cookies like PHPSESSID, or a cookie that remembers the language a visitor chose) may not require consent where they do not process personal data in a way that identifies individuals. The executive regulations do not create a blanket exemption, so the safest approach is to document and categorise every cookie your site sets.
Consent requirements under Egyptian law
Article 2 of the PDPL prohibits collecting, processing or disclosing personal data by any means without the explicit consent of the data subject, unless the law allows it. The executive regulations add specific criteria for valid consent:
Freely given - the data subject must have a genuine choice, with no bundling of consent with access to a service
Specific - consent must relate to a defined purpose, not a blanket agreement
Informed - the individual must know what data is collected, why, and by whom
Explicit - consent must be given through a clear affirmative action
The regulations do not use the term "dark patterns", but they ask for granular consent requests, a clear affirmative action and withdrawal without friction. Pre-ticked checkboxes, confusing toggle states, or banners that make rejection harder than acceptance would all undermine the validity of consent under those criteria.
Data subjects also have the right to withdraw consent at any time. Your cookie banner must provide a mechanism for visitors to change their preferences after their initial choice.
Penalties under Law 151 of 2020
The PDPL's penalties are criminal: courts impose the fines and prison terms below, set out in Articles 36 to 46 of Law No. 151 of 2020, in an unofficial English translation (the Arabic text in the Official Gazette prevails). The amounts depend on the violation:
| Violation | Fine (EGP) | Additional penalties |
|---|---|---|
| Collecting, processing, disclosing or transferring personal data without consent or legal authorisation (Article 36) | 100,000 to 1,000,000 | For gain or with intent to harm: at least 6 months' imprisonment and/or a fine of 200,000 to 2,000,000 |
| Collecting personal data without meeting the conditions of Article 3 (Article 37) | 200,000 to 2,000,000 | None stated |
| Controller or processor obligations under Articles 4, 5 and 7 (Article 38) | 300,000 to 3,000,000 | None stated |
| Sensitive personal data without consent (Article 41) | 500,000 to 5,000,000 | At least 3 months' imprisonment, or one of the two |
| Cross-border transfers in breach of Articles 14 to 16 (Article 42) | 500,000 to 5,000,000 | At least 3 months' imprisonment, or one of the two |
| Electronic marketing rules (Article 43) | 200,000 to 2,000,000 | None stated |
| Licences, permits or accreditations (Article 45) | 500,000 to 5,000,000 | None stated |
Under Article 48, penalties double for repeat offences, and the court orders the conviction to be published at the offender's expense. While modest compared to GDPR fines, the criminal liability provisions set Egypt's law apart from many other data protection frameworks, and Article 47 extends the penalties to the person who actually manages the company where they knew of the violation.
How Egypt's PDPL compares to GDPR
The PDPL borrows heavily from GDPR principles, but several differences are worth noting for website operators who already follow European rules.
| Aspect | Egypt PDPL | EU GDPR |
|---|---|---|
| Consent standard | Explicit consent, unless the law authorises the processing | Explicit consent for special categories. Legitimate interest available for some processing |
| Supervisory authority | PDPC (under Ministry of ICT) | Independent DPAs in each member state |
| Licensing requirement | Mandatory licences for controllers and processors | No licensing. Registration with DPA in some states |
| Criminal penalties | Fines and imprisonment imposed by the courts | Administrative fines only (criminal penalties vary by member state) |
| Maximum fine | EGP 5,000,000, doubled for repeat offences | EUR 20,000,000 or 4% of global turnover |
| Cross-border transfers | Requires PDPC licence | Adequacy decisions, SCCs, BCRs |
| Cookie-specific rules | No standalone cookie regulation | ePrivacy Directive supplements GDPR |
The licensing requirement is the most significant practical difference. If your organisation processes data of Egyptian residents, you may need to register with and obtain a licence from the PDPC - a step that has no direct equivalent under GDPR.
Cookie checklist before the grace period ends
With the grace period ending around 1 November 2026, here is what to do if your website serves visitors in Egypt:
Audit your cookies
Run a full cookie scan to identify every cookie and tracker on your site. Classify each one by purpose: strictly necessary, functional, analytics, or marketing. You cannot obtain meaningful consent if you do not know what your site actually sets.
Add a consent mechanism
Use a consent management platform that blocks non-essential cookies until the visitor makes an active choice. The banner should clearly list cookie categories, explain what each category does, and offer equally prominent accept and reject options.
Make withdrawal easy
Egyptian law requires that consent be revocable. Add a persistent link or icon (often a small shield or cookie icon) that lets visitors reopen the consent dialogue at any time.
Draft a cookie policy
Your cookie policy should list every cookie by name, state its purpose, identify the provider, and specify its expiry. The policy must be available in a language the data subject understands - for an Egyptian audience, Arabic is strongly advisable.
Consider licensing obligations
Check whether your organisation's activities trigger the PDPC licensing requirement. Cross-border data transfers and direct marketing activities both require separate permits.
Document consent records
Keep records of when, how, and what each visitor consented to. The regulations ask for records showing how and when consent was obtained, and they are your evidence if the PDPC investigates.
Regional context: cookie consent across Africa and the Middle East
Egypt is part of a growing wave of African and Middle Eastern countries adopting formal data protection legislation. Nigeria's Data Protection Act 2023 replaced the NDPR of 2019, Kenya's Data Protection Act dates from 2019, and Saudi Arabia's PDPL took effect in 2023.
If your website attracts traffic from multiple countries in the region, a geo-targeted approach to consent is the most practical solution. Showing the banner Egyptian rules call for while applying different rules for visitors from Morocco or Turkey avoids both over-blocking and under-blocking.
Kukie.io supports region-based rules that detect a visitor's location and apply the consent configuration you set for that region. The global compliance hub covers the rules country by country.
Quick answers on Egyptian cookie consent
Does Egypt require cookie consent?
Yes. Under Law No. 151 of 2020 and its executive regulations, any processing of personal data - including through cookies and tracking technologies - requires the data subject's explicit consent unless the law authorises it. Strictly necessary cookies may be exempt if they do not identify individuals.
When does Egypt's data protection law take full effect?
The executive regulations were issued on 1 November 2025 with a one-year grace period, so full enforcement is expected from around 1 November 2026. The text was only published on 25 December 2025, so watch for PDPC statements on the exact date.
What is the maximum fine under Egypt's PDPL?
Fines range from EGP 100,000 to EGP 5,000,000 depending on the violation, and they double for repeat offences. Some offences also carry imprisonment, of at least six months where data is misused for gain or to cause harm.
Does Egypt's privacy law apply to websites outside Egypt?
It can. The law covers non-Egyptians abroad where the act is also an offence where it was committed and the data concerns Egyptians or residents of Egypt. A website that collects data from Egyptian visitors should assume it is within scope.
Do I need a licence from the PDPC to run a website?
Controllers and processors need a PDPC licence, and separate permits apply to cross-border transfers and electronic direct marketing. Check which apply to your organisation before the grace period ends.
Do I need a cookie banner for Egyptian visitors?
Yes. A cookie banner that blocks non-essential cookies until the visitor gives consent is the most practical way to meet the PDPL's requirements. The banner should offer clear accept and reject options with no dark patterns.
Get your banner ready for Egyptian visitors
Detection, categorisation, blocking and consent records are the parts of cookie work that go stale when done by hand. Kukie.io handles them, and a free scan shows what your site sets today.
