Egypt's data protection law becomes fully enforceable this year

Egypt issued the Executive Regulations to Personal Data Protection Law No. 151 of 2020 in November 2025, bringing the country's data protection regime fully into operation. Full enforcement is expected by October 2026, at the end of the one-year transitional period the Regulations provide. The law was passed in 2020, and the Regulations are what make it operable — which is the sequence most data protection regimes follow, and the reason the enforcement date is only arriving now. A data protection law without executive regulations sets principles but not procedures: no forms, no thresholds, no registration mechanics, no allocation of responsibility between authorities. Companies could read Law 151 of 2020 and still not know what compliance looked like in practice. The Executive Regulations supply that machinery, alongside the establishment of a data protection centre. From October 2026 the regime has both a rule and a body to apply it. For companies processing Egyptian personal data — which includes essentially every fintech, e-commerce and health platform operating in the country's market of over 100 million people — the transitional year is the compliance window, and most of it has gone. AI is regulated here, whether or not it is described that way. Egypt has no standalone AI law, so the use of personal data in training, developing or operating AI systems is governed by the PDPL and its Regulations. That is a more consequential position than it sounds. An Egyptian company fine-tuning a model on customer records is not in an unregulated space awaiting future rules; it is squarely inside a data protection regime that becomes enforceable this year. A draft Artificial Intelligence Law is expected to move through the parliamentary process, which would shift Egypt from voluntary ethical guidance to binding legal requirements. Until it passes, the PDPL is the whole of the AI rulebook. All three of the region's largest technology markets are converging on the same architecture: a data protection law doing the heavy lifting, an AI framework layered on top, and no dedicated AI statute in force. Saudi Arabia's SDAIA framework is aligned to its PDPL. The UAE requires AI systems to comply with existing law rather than a new one. Egypt governs AI training data through Law 151. A company operating across all three has three data protection regimes and one broadly shared logic. That is more tractable than it first appears — and considerably more tractable than it would be if each had written a separate AI act.