In short: Egypt's Personal Data Protection Law (Law 151 of 2020) gave companies one year to comply after its Executive Regulations were issued on 1 November 2025, so on a strict reading the grace period ends around 1 November 2026. Licences, a data protection officer and privacy notices are your lawyers' job. But most personal data in an Egyptian company does not sit in a legal file. It sits in payroll workbooks, HR exports, customer lists, dashboards and AI chats. That part is a data-and-AI habit problem, and it belongs to finance, HR and operations heads.
This article is practical guidance for business teams, not legal advice. Confirm your obligations with your own counsel.
What changes, and when?
The Executive Regulations (Decree No. 816 of 2025) were formally issued on 1 November 2025 but only made public on 25 December 2025, which is why some advisers expect the regulator to read the deadline more loosely. Law firms CMS (13 January 2026) and Baker McKenzie (12 January 2026) both advise planning to 1 November 2026. Among the obligations they list: licences for controllers and processors, a registered data protection officer, separate permission for transfers outside Egypt (cloud environments included, per CMS), and notifying the Personal Data Protection Centre within 72 hours of becoming aware of a breach. Kennedys puts most fines at roughly EGP 200,000 to EGP 2 million, with some offences up to EGP 5 million.
Why is this a data and AI problem, not only a legal one?
Because the daily handling happens in tools your teams already use. In the Cabinet's Information and Decision Support Centre (IDSC) poll of July 2026, 51.7% of Egyptian AI users said they use it for work, and 55% said they worry about sharing personal data (Middle East AI News, 8 September 2026). Globally, Netskope's Cloud and Threat Report 2026 found that 47% of employees who use generative AI at work still do so through personal accounts, and that known data-policy violations from generative AI doubled in a year (Infosecurity Magazine, 7 January 2026; global data, not Egypt-specific). Your policy can be perfect and still be undone by one payroll file pasted into a personal chatbot.
Five things finance, HR and ops leaders can do before 1 November
1. Map where personal data lives in daily work, not only in systems. Ask each team for its top ten recurring files and reports: the payroll workbook, the HR headcount export, the collections list with customer phone numbers, the sales pipeline pulled from the CRM. Note who owns each one, where it is stored and who it is sent to. The ERP is usually the best-protected copy; the risk sits in the extracts.
2. Shrink the data before you share it. Most analysis does not need names, national ID numbers or phone numbers. Build reports on employee or customer codes, aggregate where you can, and give each audience only the fields it needs. In Power BI that means a clean data model with personal columns removed or masked, and row-level security so a branch manager sees only their branch. Fewer copies of personal data means less to protect, and less to report if something leaks.
3. Move AI use onto approved accounts, with three clear rules. Decide which AI tools are approved for work and on which company accounts. Then write down, in one page, what never goes into a prompt (for example: names with salaries, ID numbers, health or customer records) and how to anonymise data before asking for help. Whether sending data to an AI service hosted abroad counts as a cross-border transfer for your company is a question for your counsel; the habit of not pasting raw personal data is one you can start this week.
4. Know who starts the 72-hour clock. A breach is often ordinary: a spreadsheet emailed to the wrong person, a dashboard shared by public link, a laptop left in a taxi. Agree who an employee tells, who decides whether it is a reportable breach, and who contacts the data protection officer. Run it once as a 20-minute drill with one finance and one HR scenario.
5. Train the people who touch the data, by role. The legal team writes the policy, but the accountant exporting payroll, the HR officer sharing a headcount file and the analyst building a dashboard decide what happens to the data every day. Short, role-based sessions on their own files and tools change behaviour far more than one company-wide awareness email.
How Cairo Syntax helps
We are not a law firm, and we work alongside your counsel. What we do is the practical layer: role-based "AI at work" sessions that set clear, data-safe habits for using AI on real tasks, and Power BI training built on your own (masked) data, covering clean data models, minimum fields and row-level security. If you want to know where your team's data and AI habits stand before the grace period ends, start with a free 45-minute diagnostic: book your diagnostic.