Egypt Data Protection Law 151 & AI Chatbots: A Practical Guide

Yes, Egypt's Personal Data Protection Law (Law No. 151 of 2020) applies to AI chatbots and automations that handle customers' personal data. Its Executive Regulations were issued in November 2025, and the one-year grace period ends around 31 October to 1 November 2026. Bots, CRMs and LLM integrations need a lawful basis, clear consent flows and security. Some activities also need a licence or permit from the Personal Data Protection Center.

Key takeaways

• Law 151 of 2020 has had its Executive Regulations since Decree No. 816 of 2025. The compliance clock runs out at the end of October / start of November 2026.
• A WhatsApp bot, a CRM and an n8n workflow are all "processing". The same consent, purpose, security and rights rules apply to each of them.
• Sending personal data to an LLM API hosted abroad is a cross-border transfer. Under Article 14 that needs a licence or permit from the Personal Data Protection Center.
• Data minimisation is your cheapest compliance tool. If you never send names and phone numbers to the model, you have far less to justify.
• This article is general information, not legal advice. Regulations and their interpretation are still developing, so confirm your situation with an Egyptian lawyer.

What is Egypt's Personal Data Protection Law (Law 151 of 2020)?

Law 151 of 2020 is Egypt's first comprehensive personal data law. It was published in the Official Gazette on 15 July 2020 and took effect three months later, in October 2020 (Library of Congress). In practice it sat largely dormant for five years because the Executive Regulations had not been issued.

It covers any "controller" (who decides why and how data is processed) or "processor" (who processes it on the controller's behalf) handling personal data electronically. Article 3 excludes some categories. The most notable is data held by the Central Bank of Egypt and entities it supervises, which follow CBE rules instead. Other exclusions include purely personal use, official statistics, journalism, and judicial and national-security matters (ACC unofficial translation).

The regulator is the Personal Data Protection Center (PDPC). It is affiliated with the Ministry of Communications and Information Technology (MCIT) and handles licensing, permits, complaints and enforcement.

Have the Executive Regulations been issued, and what is the deadline?

Yes. The Executive Regulations were issued as Decree No. 816 of 2025 and published on 1 November 2025 (Kennedys; Baker McKenzie, Jan 2026). Sources differ on minor details. Some describe it as a Prime Ministerial decree and others as a ministerial decree, and some give the in-force date as 2 November 2025.

The regulations gave in-scope organisations one year to comply. Baker McKenzie and Amereller put the deadline at 31 October 2026. Other summaries say 1 November 2026. As of this writing, that is less than two weeks away.

In October 2026, Baker McKenzie reported that the PDPC had launched its electronic portal for licence, permit and accreditation applications. Access goes through Digital Egypt, which is linked to an Egyptian National ID, so foreign companies will likely need a local representative to file.

What does Law 151 actually require?

These are the obligations that matter most for automation projects:

• Consent and lawful basis. Article 2 says personal data may generally only be collected, processed or disclosed with the data subject's explicit consent, or where the law otherwise permits it.
• Purpose and minimisation. Collect data for specific, legitimate purposes. Keep it accurate and no longer than needed.
• Data subject rights. These include the right to know what data you hold and to access it, to withdraw consent, to have data corrected or erased, to restrict processing, and to be told about breaches.
• Breach notification. Under Article 7, the controller and processor must notify the PDPC within 72 hours of a personal data breach, and immediately in national-security cases. Summaries of the regulations say data subjects must also be informed within roughly three (working) days (Chambers).
• Data Protection Officer (DPO). Controllers and processors must appoint a qualified DPO registered with the PDPC. The regulations add qualification and exam requirements, an annual report to the Center, and 15 days' notice before ending a DPO's appointment.
• Licences and permits. Licences or permits are required for activities such as acting as a controller or processor, processing sensitive data (which includes health, biometric, financial and children's data), cross-border transfers, and electronic direct marketing. Fees scale with the number of records. Law-firm summaries report a cap of about EGP 2 million over a three-year licence, and say a cross-border transfer licence costs 50% of the base fee.
• Electronic marketing. Marketing messages need consent and an easy way to opt out. Violations of the marketing articles (17–18) carry fines of EGP 200,000 to 2 million.
• Penalties. Fines reach up to EGP 5 million, and some offences carry imprisonment. Breaching the cross-border rules (Articles 14–16) carries at least three months' imprisonment and/or a fine of EGP 500,000 to 5 million.

What does it mean for WhatsApp bots, CRMs and LLM APIs?

WhatsApp bots

A customer messaging your bot is sharing personal data: their phone number, name, address and often order or health details. The practical consequences:

• Tell people, in the first message, who you are, what the bot collects and why. Link to a short privacy notice.
• Get explicit opt-in before sending marketing broadcasts, and honour "STOP" immediately.
• Be aware that WhatsApp's Cloud API runs on Meta's infrastructure. Meta offers a "local storage" option for some regions, but message content can still be processed internationally for a short window (Meta docs). We are not aware of an Egypt region. Treat WhatsApp itself as a cross-border flow.

For more on bot design, see our WhatsApp bot guide for Egyptian businesses.

CRMs and workflow tools

Most popular CRMs and SaaS automation tools (HubSpot, Zoho, Make, Zapier) host data outside Egypt. Each one is a processor and probably a cross-border transfer. You need to know where each tool stores data, and you need a data processing agreement (DPA) with each vendor.

LLM APIs hosted abroad

When your bot sends a customer's message to OpenAI, Anthropic or Google for an answer, personal data leaves Egypt. Article 14 requires that the destination offer protection at least equal to Egypt's and that you hold a PDPC licence or permit. Article 15 allows certain exceptions with the data subject's explicit consent.

What is unsettled: there is no public PDPC guidance yet on how routine, transient API inference calls will be treated. There is also no list of "adequate" countries. Providers offer some regional options. For example, OpenAI offers data residency in several regions, including Europe and the UAE (OpenAI), and Anthropic documents its own data-residency controls (Anthropic docs). But none of these keeps data inside Egypt. Until guidance arrives, the safest engineering answer is to send as little personal data as possible to the model.

Practical compliance checklist for chatbots and automation

1. Map your data flows. List every tool (WhatsApp, CRM, n8n/Make, LLM API, Google Sheets), what personal data it touches and which country it is stored in.
2. Minimise what reaches the LLM. Strip or mask names, phone numbers, national IDs and addresses before the prompt. Use a ticket ID, not a phone number. Most FAQ and order-status answers don't need identity at all.
3. Write a consent message. For example: "Hi, this is [Company]'s assistant. We use your messages and phone number to answer your request and process orders. Details: [link]. Reply AGREE to continue." Store the timestamp.
4. Separate service from marketing. Keep marketing opt-in as its own explicit choice, with one-tap opt-out.
5. Set retention periods. Auto-delete chat transcripts and workflow execution logs after a defined period (for example 30–90 days, depending on your purpose and legal advice).
6. Keep audit logs without hoarding data. Log what happened (who accessed what, when) without copying full message content into every log.
7. Sign DPAs. Get a data processing agreement from every vendor, and check its terms on training on your data, retention and sub-processors.
8. Handle sensitive data carefully. Clinics, fintech and anything involving children fall into the sensitive-data licence category. Don't route those details through a general-purpose bot without advice.
9. Prepare a breach playbook. Name who calls the DPO and who drafts the PDPC notice, and make sure it can happen within 72 hours.
10. Consider data residency. Self-hosting n8n on a server you control keeps workflow data and logs in a location you choose. Pair it with a hosting provider in Egypt or a region you've cleared with counsel. See our workflow automation guide and n8n vs Make vs Zapier comparison.
11. Register and license. Check through the PDPC portal and with counsel which licences or permits you need: controller/processor, cross-border transfer, marketing, sensitive data.

How do Egypt, Saudi Arabia and the UAE compare?

If you plan to expand into the Gulf, the three regimes look similar on paper but differ in important ways:

Sources: Latham & Watkins, CMS, Clyde & Co, DLA Piper. The UAE federal law does not apply in free zones with their own data protection laws, such as DIFC and ADGM. It also excludes health and banking data that sector-specific laws already govern.

How we'd approach this

When we scope an automation, we design for privacy from day one instead of bolting it on later. During our 14-day pilot, the first step is a data-flow map. Then we build so the LLM sees only what it needs: masking identifiers, keeping customer records in your own database, and self-hosting n8n where residency matters. We set retention and logging rules before go-live and leave you with a written record of what data goes where, which your lawyer and DPO can work from. We're not lawyers, and we'll tell you when a question needs one.

For broader context on what's possible, read custom AI solutions for Egyptian businesses and how to automate customer support.

Disclaimer: This article is for general information only and is not legal advice. Laws and regulator guidance change. Consult a qualified Egyptian lawyer about your specific situation.

Sources

• Library of Congress – Egypt: Country's First Law on Protection of Personal Data Enters into Force
• ACC – Unofficial English translation of Law No. 151 of 2020
• Kennedys – Egypt's Personal Data Protection Law: the compliance countdown has begun
• Baker McKenzie – Egypt: Important Data Protection Update (Jan 2026)
• Baker McKenzie – Egypt: Personal Data Protection Law Update (Oct 2026)
• Chambers – A First Look at Egypt's Personal Data Protection Executive Regulations
• Amereller – The Egyptian Personal Data Protection Regime ahead of 31 October 2026
• Latham & Watkins – Saudi Arabia's data protection law enters into force
• CMS – One year anniversary: Saudi Personal Data Protection Law
• Clyde & Co – SDAIA publishes draft amendments to the PDPL Implementing Regulations (Oct 2026)
• DLA Piper – Data protection laws in the UAE
• Meta – WhatsApp Cloud API Local Storage
• OpenAI – Introducing data residency
• Anthropic – Data residency documentation