Egypt's Data Law Grace Period Ends: Licensing Your Marketing Database

For five years, Egypt’s Personal Data Protection Law (Law No. 151 of 2020) existed on paper without the rules needed to apply it. That changed when the Minister of Communications and Information Technology issued the Executive Regulations by Ministerial Decree No. 816 of 2025 on 1 November 2025, according to Al Tamimi & Company (updated 4 February 2026). The regulations started a one-year window for businesses to comply. That grace period ended on 31 October / 1 November 2026, depending on the reading, and no extension had been announced when we checked on 31 October 2026.

For a marketing team, the most practical change is simple to state and harder to carry out. Sending marketing messages by SMS, WhatsApp, email or any other electronic channel needs three things together: prior consent from each recipient, records that prove it, and a licence or permit from the Personal Data Protection Centre (PDPC). This guide explains what that means for the lists you already hold, and sets out an order of work that avoids applying for a licence on a database you cannot defend.

What changed, and when enforcement started

The regulations were issued on 1 November 2025. CMS (13 January 2026) notes that the text was only made publicly available on 25 December 2025, and that the Law gives businesses one year from the regulations’ issue to comply. The sources do not agree on the exact last day:

• Clyde & Co (21 January 2026) gives 31 October 2026 as the date of full enforcement, and Baker McKenzie (7 October 2026) says businesses must be fully compliant by that date.
• CMS reads it strictly as enforcement from 1 November 2026, and notes that the late public release creates some uncertainty about whether the PDPC could treat the period as running to the end of 2026. CMS advises following the statutory timeline until the PDPC clarifies.

Soliman Hashish & Partners (14 May 2026) also put the end of the grace period at 1 November 2026. We could not confirm the date on the PDPC’s own website, which did not return readable content when we checked. Either way, the grace period ended on 31 October / 1 November 2026, depending on the reading: when we checked on 31 October 2026, no official or law-firm source we found reported an extension. That means the PDPC licence or permit and documented prior consent are now required for electronic marketing, and enforcement is expected. Baker McKenzie’s update mentions no extension, and says the PDPC launched an online portal in early October 2026 to receive applications for accreditation, licences and permits. Creating a profile requires authentication through Digital Egypt, which is linked to an Egyptian National ID. Foreign controllers and processors need a duly authorised local representative to apply for them.

What the rules require of every marketing message

The Law defines electronic marketing broadly: sending any promotional or marketing message “by any technological means, in any form”, in the words of the Andersen Egypt English translation of the Law and regulations. On that wording, SMS, WhatsApp, email and direct messages on social platforms are all in scope. Article 17 of the Law and Article 18 of the regulations set the conditions; the licence requirement comes from the regulations. Based on that translation:

A PPC Land report (23 September 2026) describes a 23-page compliance checklist bearing the PDPC logo but with no date, version or signature, which circulated on LinkedIn. It adds that marketing should not be a condition of a service unless objectively necessary, and that recipients should be able to manage frequency, channel or content type. We could not find that checklist on an official page, so treat it as unofficial: its points are signals of the PDPC’s possible direction, not settled text.

Lists you built or bought before the rules

This is where most companies are exposed. A typical Egyptian sales database mixes contacts from exhibitions, website forms, WhatsApp inquiries, past customers, distributor lists and, sometimes, purchased lists. The regulations treat these sources differently.

Customer data collected to deliver a service

Article 2 of the regulations, in the Andersen translation, treats data given to obtain a service as consent to process it for that purpose. Using it for a different purpose needs prior consent. On a plain reading, the mobile number a customer gave for delivery or invoicing does not, by itself, permit promotional messages.

Existing customers and “soft opt-in“

Here the sources differ, and you should know that before deciding. CMS says the regulations recognise a “soft opt-in” for existing customers during the grace period, which has now ended. The Andersen translation of Article 18 of the regulations requires explicit consent, and we did not find an existing-customer exception in it. Adding to the uncertainty, Article 18 of the Law, in the same translation, refers to records showing the recipient consented or did not object, and the unofficial checklist reported by PPC Land repeats the “non-objection” wording without saying when it is enough. Until a lawyer or the PDPC confirms how existing customers are treated after the grace period, the cautious course is to re-permission them.

Bought, rented or shared lists

The regulations require intermediaries in the chain to confirm that consent was obtained and to keep records of the data’s source and the consent. If they cannot, they must stop using the data. A list bought from a data vendor without consent records attached is, in practice, a list you should not message. Ask the vendor for the consent evidence; if it does not exist, retire the list.

The order of work: audit, re-permission, DPO, licence

Applying for a licence first and fixing the data later is the wrong way round. The licence application asks you to describe your consent mechanisms (regulations, Article 30), and the application for a company has to identify your Data Protection Officer (Article 35). Both are easier to answer once the data work is done.

1. Audit the data. List every place contact data lives: CRM, spreadsheets, WhatsApp Business accounts, email platforms, ad-platform lead forms, exhibition scanners, sales reps’ phones. For each source record what is held, where it came from, what consent exists and who can access it. Count the records; the count also determines your fees. If you also market into Saudi Arabia, map those contacts against the Saudi PDPL consent rules in the same pass.
2. Segment by evidence. Split contacts into three groups: documented marketing consent; a relationship but no marketing consent; and unknown origin. Archive or delete the third group unless you can establish its source.
3. Re-permission the middle group. Send one clear, honest message asking whether they want to keep hearing from you, on which channel and about what. Record the reply, date and wording. Do not keep messaging people who do not answer.
4. Fix collection at the source. Every form, landing page, lead ad and WhatsApp entry point needs an unticked consent option, a short purpose statement, a link to the privacy notice, and a way to store the record. This is where website and campaign settings matter as much as legal text.
5. Appoint and register a DPO. The Law requires legal entities to appoint a qualified Data Protection Officer. The regulations add qualification and experience criteria, Centre-approved examinations, a criminal-record certificate and registration in the PDPC’s register, with each officer given a “DPO code”. The translation also indicates that a DPO can be engaged by contract and, with conditions and Centre approval, serve more than one entity. Start early: registration needs exam results.
6. Apply for the licence and marketing permit. Apply through the PDPC portal for the controller or processor licence and the direct electronic marketing licence or permit, then keep renewal dates in the compliance calendar.

Fees, exemptions and penalties

Fees depend on the number of records you process. Based on the Andersen translation of the regulations:

• Combined controller and processor licences are exempt from fees for databases of up to 100,000 records (Article 19); permits are exempt up to 25,000 records (Article 20). Controller-only or processor-only licences and permits pay half the scheduled amount.
• The direct electronic marketing licence or permit costs 10% of the controller or processor fee when you market your own goods and services, and 25% when you market on behalf of others (Article 29). CMS also reports that the fee depends on whether marketing is for your own benefit or for others.
• The Law caps licence fees at EGP 2 million and permit or accreditation fees at EGP 500,000 (Law, Article 26).

Being exempt from fees is not the same as being exempt from the licence. Small databases still need the licence or permit, the consent and the records.

The penalties in the Law, as translated, are substantial for a mid-sized company:

Clyde & Co summarises the overall range as EGP 200,000 to 5 million, with possible criminal liability in some cases and mandatory public disclosure of violations. For a brand that sells on trust, that last point may matter more than the fine.

Who does what inside the company

Data protection is often handed to IT or legal and forgotten by marketing, yet most of the risky data is created by marketing and sales. A workable split:

• Management: decides which channels the company will use, signs off the DPO appointment and budgets for the licence.
• Legal or external counsel: confirms the interpretation of the open points (enforcement date, existing customers, cross-border transfers to cloud tools hosted abroad, which CMS notes need their own authorisation) and reviews the privacy notice.
• DPO: owns the register, data subject requests, breach reporting (according to Clyde & Co, breaches must be reported to the PDPC within 72 hours; CMS gives the same period) and annual reporting.
• Marketing: rebuilds forms and lead ads with proper consent capture, writes the re-permission messages, adds sender identity and opt-out to every template, and stops using unsupported lists.
• Sales: moves contacts out of personal phones and spreadsheets into the CRM, where consent status is recorded and checked before any broadcast (the fields to ask for are in our CRM requirements list).

The sales and marketing pieces are where outside help is most useful. Our business solutions and sales enablement work covers WhatsApp and email flows, message templates and CRM direction, and our website team builds forms and landing pages that record what the visitor agreed to. If your website also drops advertising cookies, our guide to cookie consent and GA4 consent mode covers that side. We do not give legal opinions; the interpretation stays with your lawyer and DPO.

A 30-day starting checklist

• Freeze campaigns to any list without documented marketing consent.
• Complete the data inventory and record counts for every source.
• Ask your lawyer for a written view on the enforcement date and on existing customers.
• Draft and send the re-permission message; log every answer.
• Add consent capture, purpose wording and opt-out to every form, lead ad and template.
• Identify a DPO candidate or provider and check the exam and registration steps on the PDPC portal.
• Set up the company profile on the portal, or appoint a local representative if the company is foreign.
• Prepare the licence and marketing permit applications once the steps above are done.

If you can do only one thing this week, take the list you message most often and check whether you can show, for each contact, when and how they agreed to marketing. If you cannot, pause that list and send the re-permission message before anything else.