EGYPT, January 29 - On December 15, 2024, Egypt’s Consumer Protection Agency has warned citizens to be cautious of deceptive  advertisements and to avoid sharing personal data, particularly identification card numbers and credit card information, on untrustworthy websites, to protect their privacy and prevent identity theft.

The agency urged consumers to shop through secure websites that protect personal data, and to make purchases exclusively from websites with a physical presence within Egypt. It also provided details on how to register complaints of violations to the agency. 

Law on Personal Data

Egypt’s Law on Personal Data, Law No. 151 of 2020, which entered into force October 17, 2020,  imposes penalties on entities and persons that record and collect personal data without the data owners’ authorization, as well as those who misuse personal data to harm to others.

The law applies to crimes related to breaches of personal data committed by Egyptians and foreign nationals living either outside or inside Egypt. (Art. 2.)

Under the law, the processing of personal data without the consent of the owner of the data is illegal. (Art. 6.) “Personal data” is data related to any natural person that could identify him/her directly or indirectly. Such data includes one’s national identification number, address, and data regarding one’s psychological or physical health, economic status, or cultural or social identity. (Art. 1, para. 1.) The law defines “processing of personal data” as any electronic process to collect, record, keep, store, receive personal data. (Art. 1 para. 2.)

Egypt’s economic courts have jurisdiction over violations of the law related to the protection of personal data. (Art. 5.)

The law imposes an array of sanctions against entities and individuals that commit crimes related to personal data. Anyone who processes an individual’s personal data without consent for financial or moral gain, resulting in harm, is punishable by imprisonment of not less than 6 months or a fine ranging from 200,000–2 million Egyptian pounds (EGP) (about US$4,000-40,000), or both. (Art. 26, para. 2.)

Anyone who processes personal data without consent, even if no harm is caused to the individual, faces imprisonment for not less than 3 months or a fine ranging from EGP500,000–5 million (about US$10,000–$100,000), or both. (Art. 41.)

The transfer of data by anyone responsible for processing it to countries with no data protection laws or countries that offer less protection than Egypt is considered a crime, subject to a custodial sentence of at least three months, a fine ranging from EGP500,000 to 5 million, or both. (Art. 42.)

George Sadek, Law Library of Congress
January 29, 2025

Read more Global Legal Monitor articles.