Egypt's data protection rules and the shop's measures

Egypt has the following comprehensive law.

Law No. 151 of 2020 promulgating the Personal Data Protection Law, and the Personal Data Protection Law annexed to it (قانون حماية البيانات الشخصية; the “Personal Data Protection Law”)

• Promulgation: signed by the President on 13 July 2020 (22 Dhu al-Qa'dah 1441 AH) and published in the Official Gazette (الجريدة الرسمية) No. 28 (supplement هـ) of 15 July 2020 [Primary, archived: the copy of the gazette on the Personal Data Protection Center's (PDPC) site; issue, date and date of signature checked on the cover and page 3].
• Entry into force: under Article 7 of the promulgating law, it came into force three months after the day following its publication (October 2020). Under Article 6 of the promulgating law, those it addresses must comply “within one year of the issuance (صدور)” of the executive regulations [Primary, archived: page 3 of the same gazette].
• Executive regulations: Decree No. 816 of 2025 of the Minister of Communications and Information Technology (the executive regulations of the Personal Data Protection Law), published in the gazette supplement الوقائع المصرية No. 244 (annex أ) of 1 November 2025, and in force from the day after publication (2 November 2025) under Article 2 of the decree [Primary, archived: pages 2 and 3 of the copy of the gazette on the PDPC's site, stamped by the state printing office as a true copy of the original].
• The one-year period in Article 6 of the promulgating law runs from “the issuance of the executive regulations”. We could not confirm the date the decree was signed; counted from the date of publication (1 November 2025) or the date of entry into force (2 November 2025), the deadline is 31 October or 1 November 2026 (which is likely why sources give different dates). As of this page's reference date (28 October 2026), the deadline had not yet passed.
• Who it covers: holders, controllers and processors of personal data processed electronically, in whole or in part; natural persons' data only (Article 1 of the promulgating law). Exempt (Article 3 of the promulgating law): personal use; processing for official statistics or under a legal provision; journalism; judicial police records, investigations and court proceedings; data held by the national security bodies; and the Central Bank of Egypt and the entities it supervises (other than money transfer companies and exchange bureaux) [Primary, archived: pages 2 and 3 of the same gazette (Article 3(4) to (6) checked directly)].
• What it covers [Primary, archived: page 4 of the same gazette, Article 1 of the annexed law]: “personal data” is data relating to an identified natural person, or to a natural person who can be identified directly or indirectly by linking that data with other data (such as a name, voice, picture, identification number, online identifier, or data showing psychological, health, economic, cultural or social identity). “Sensitive personal data” is data revealing mental or physical health, genetic or biometric data, financial data, religious beliefs, political opinions, or security status (الحالة الأمنية). All children's data is treated as sensitive data.

• [Primary, archived; copy of 14 July 2026] The law (copy of Official Gazette No. 28, supplement هـ, in Arabic, on the PDPC's site)The document on the PDPC's current site (https://pdpc.gov.eg/assets/pdf-data/PDPL%20no.%20151%20of%202020%20(ar).pdf) could not be reached from the environment of this research.
• [Primary, archived; copy of 10 August 2026] The executive regulations (copy of gazette No. 244, annex أ, in Arabic, on the PDPC's site)
• [Primary, unofficial translation] English translation of the law (Matouk Bassiouny & Hennawy)
• [Primary, unofficial translation] English translation of the executive regulations (published by The Sedona Conference)

The Arabic gazette copies are scanned images, and Arabic text recognition was not available for this research. The only provisions read directly in Arabic are Article 3(4) to (6) and Articles 4 to 7 of the promulgating law, and, of the annexed law, Article 1 (the definitions of personal data, sensitive data, processing and so on), the end of Article 7, Articles 8, 13 and 14, and Article 15(1) and (2). Every other provision is read from an unofficial translation.

• EU adequacy decision: none
• APEC CBPR system: not a participant (nor in the Global CBPR Forum, as far as we could confirm on 27 October 2026)

Note: Egyptian law has these features.

• Controllers and processors may not handle personal data without a licence (ترخيص) or permit (تصريح) from the Center (Art. 4(10), Art. 5(11)).
• Transferring, storing or sharing data abroad requires that the level of protection at the destination is not lower than Egyptian law's, and a licence or permit from the Center (Art. 14 〔Ar〕). But with the explicit consent of the individual (or their representative), data may also go to a country without an equivalent level of protection in the cases Article 15 lists (such as protecting the individual's life or medical care, meeting obligations to prove, exercise or defend rights, or concluding or performing a contract for the individual) (Art. 15 〔Ar: (1) and (2) checked〕).
• Article 16 of the executive regulations requires the Center's licence and the individual's consent for transfers abroad (unofficial translation).
• The definition of “cross-border transfer” also covers transfers from abroad into Egypt (Art. 1 of the annexed law, unofficial translation).

Data localisation requirements that may significantly affect individuals' rights and interests

• We found no general data localisation requirement. Transfers abroad need a licence (Arts. 14 to 16 of the annexed law, Arts. 16 and 17 of the executive regulations), and controllers and processors abroad must appoint a representative in Egypt (Art. 4(11) and Art. 5(12) of the annexed law).

Obligations on businesses to cooperate with government information gathering that may significantly affect individuals' rights and interests

• Article 3(5), second part, of the promulgating law: at the request of the national security bodies, the Center must notify controllers and processors to correct or erase personal data, or to stop showing, making available or circulating it (عدم إظهار أو إتاحة أو تداول), within a set time, and they must comply within that time. It is a power to order correction, erasure or suspension, not to make businesses hand information to the government (the unofficial translation likewise reads “amend, erase, withhold, restrict access to, or suspend circulation”) [Primary, archived: page 3 of the gazette]. Article 1 of the annexed law defines the national security bodies as the Presidency, the Ministry of Defence, the Ministry of Interior, the General Intelligence Service and the Administrative Control Authority (unofficial translation).
• Article 2 of Law No. 175 of 2018 (the Anti-Cyber and Information Technology Crimes Law): the obligation falls on communications and information technology “service providers”, which a shop selling goods usually is not. Service providers must keep user identification data, traffic data, device data and the like for 180 days, and must provide the national security bodies, at their request, with the technical means they need to do their work. Kept data is disclosed under a reasoned order of the competent judicial authority. The text for buyers sums this up as “businesses may also process information under an order from investigators or a court” [Primary, unofficial translation: Andersen's translation].
• Article 7 of the Personal Data Protection Law: when the Center is notified of a breach, it notifies the national security bodies at once (unofficial translation).

• Individuals' rights: access (to know, view and obtain), withdrawing consent, correction, erasure, addition and updating, restricting processing to its purpose, being notified of a breach, and objecting to processing that conflicts with fundamental rights (Art. 2 of the annexed law). A fee may be charged for exercising them (except breach notification; at most EGP 20,000). A complaint to the Center (Art. 33; decided within 30 working days).
• Regulator: the Personal Data Protection Center (مركز حماية البيانات الشخصية; a public economic authority under the Minister of Communications and Information Technology; Art. 19 of the annexed law). Its board is chaired by the Minister and includes representatives of the Ministry of Defence, the Ministry of Interior, the General Intelligence Service and the Administrative Control Authority (Art. 20).
• The Center in practice [Secondary]: in October 2026 it opened an online application portal and began taking applications for licences and permits (Baker McKenzie, 8 October 2026). Businesses abroad apply through a local representative.
• The PDPC publishes guidance on its site on the executive regulations, DPOs, consent, breach notification, licences and permits, privacy notices and more (list checked in an August 2026 archived copy) [Primary, archived].
• We could not confirm that a list of countries with an adequate level of protection has been published [Secondary: AMERELLER, 28 April 2026, “in preparation”].
• Penalties: fines of EGP 100,000 to 1,000,000 for unlawful processing (Art. 36); for breaching the rules on transfers abroad, imprisonment of at least three months and/or a fine of EGP 500,000 to 5,000,000 (Art. 42), among others (unofficial translation).

1. The issue, dates, entry into force, definitions and transfer provisions were checked in the Arabic gazette copies (archived copies of documents the PDPC published). Other provisions are from unofficial translations. The PDPC's current site could not be reached from the environment of this research.
2. The transition deadline under Article 6 of the promulgating law is 31 October or 1 November 2026, and had not yet passed as of this page's reference date (28 October 2026). As of that date, enforcement was still to come, and the Center's licensing practice, fees and adequacy list were still changing.
3. Under Egyptian law, the shop in Egypt (the recipient) itself is, as a rule, also required to obtain a licence, appoint a DPO and so on. Convika has not checked whether the recipient has actually obtained a licence.

Who: a shop in Egypt that takes orders through Convika's order feature and receives the details of those who order.

Basis: the Orders and Payments Terms (Fluxenic Inc., version of 28 October 2026), which the shop agrees to when it starts using the order feature.

This shop takes orders after agreeing to Convika's Orders and Payments Terms. Under those terms, the shop has agreed to the following.

1. It uses the details it receives (name, phone number, email address, address, the order and so on) only to fill the order, contact the buyer, and meet legal obligations, and not for anything else, such as marketing emails, without the buyer's consent.
2. It takes measures against leaks, loss and misuse of the details, and protects any files it exports in the same way.
3. If a leak happens or may have happened, it tells Convika at once, and reports it to Japan's Personal Information Protection Commission and notifies the people affected as the law requires.
4. It responds to buyers' requests for disclosure, correction, deletion and so on as the law requires.
5. As a shop outside Japan, it takes measures for the details it receives equivalent to those Japan's Act on the Protection of Personal Information requires of a shop.
6. It follows the laws of the country it is in and of the buyer's country, as well as Japan's.
7. It tells buyers the shop's name, how to contact it, what it uses their details for, and how to ask for disclosure and the like. A shop outside Japan publishes a privacy policy that says these things.
8. It keeps the details it receives accurate and up to date as far as their use requires.

Convika shows on the order screen what the order screen collects and that those details go to the shop.

Convika can stop a shop that does not keep these commitments from taking orders. However, Convika does not check, shop by shop, whether a shop actually takes these measures or whether it is registered with or licensed by its country's regulator.

Convika deletes buyers' details once the period set in Convika's Privacy Policy ends, and before that, reminds the shop that it can export them as CSV. Details the shop has exported and kept are the shop's to manage.

Personal Information Protection Commission of Japan

• [Primary] Personal Information Protection Commission, survey of foreign systems for protecting personal information (Japanese)
• [Primary] The same, Qatar (the format followed; Japanese)

Egypt

• [Primary, archived] Official Gazette No. 28 (supplement هـ), 15 July 2020 (on the PDPC's site; copy of 14 July 2026)
• [Primary, archived] الوقائع المصرية No. 244 (annex أ), 1 November 2025, Ministerial Decree No. 816 of 2025 (on the PDPC's site; copy of 10 August 2026)
• [Primary, unofficial translation] Law No. 151 of 2020 (translated by Matouk Bassiouny & Hennawy)
• [Primary, unofficial translation] Ministerial Decree No. 816 of 2025
• [Primary, unofficial translation] Law No. 175 of 2018 (translated by Andersen)
• [Secondary] Baker McKenzie Connect On Tech (8 October 2026, the portal's opening)
• [Secondary] AMERELLER (28 April 2026)
• [Secondary] Soliman, Hashish & Partners (11 January 2026)
• [Secondary] Al Tamimi & Company (Legal 500, 27 January 2026)
• [Secondary] Baker McKenzie (9 January 2026)

1. Provisions not read in the Arabic original: Article 2 (individuals' rights), Articles 3 to 6, Article 9, Article 15(3) onwards, Article 16, Articles 19 and 20, and Articles 32, 33, 36 and 42 of the annexed law, and Articles 16 and 17 of the executive regulations. All are from unofficial translations (the gazette copies are images, and Arabic text recognition was not available in this research's environment).
2. The date the executive regulations (Ministerial Decree No. 816 of 2025) were signed, which decides whether the deadline under Article 6 of the promulgating law is 31 October or 1 November 2026.
3. The Arabic original of the definition of “cross-border transfer” (including transfers from abroad into Egypt), and whether a shop in Egypt receiving a Japanese buyer's data needs an Egyptian licence for it.
4. Whether an adequacy list or licence fees have been published (the PDPC's current site could not be reached).
5. The Arabic original of which bodies are national security bodies (the definition in Article 1 of the annexed law).
6. Whether Egypt takes part in the Global CBPR Forum (“not a participant, as far as we could confirm”).