If you run a website, an app or an admin system that holds customer names and phone numbers, you are inside the scope of your country's personal data protection law, and in both of the region's largest markets that is no longer theoretical. Egypt's Executive Regulation for Law 151 of 2020 was finally issued after a five-year wait, and the compliance window written into the law closes in early November 2026. In Saudi Arabia the law has been in force since September 2023, and the violation committees have already issued decisions carrying fines and warnings.
This article is not written for a lawyer. It translates customer data protection rules into what you will change in your database and your code: which field to add, which table to create, the difference between a real delete and deleted_at, and which of your staff can see what.
This is a technical explainer for product owners, not legal advice. Deciding how your specific company is classified, and whether you need a license or a permit and in which category, requires a lawyer who reads your contracts and your activities.
Does any of this apply to you?
Both laws share one rule: customer data protection turns on whose data you process, not on how big you are or where your server sits.
In Egypt, the compliance checklist published by the Personal Data Protection Center asks seven scope questions, among them whether you process the data of Egyptians living inside or outside Egypt, and whether you process the data of foreign nationals resident in Egypt. One "yes" is enough. The law addresses electronic processing; paper records that never touch an electronic system fall outside it.
In Saudi Arabia, the law covers the processing of personal data of individuals resident in the Kingdom by any means, including by entities operating from abroad. Article 33 states that the competent authority sets the mechanisms for following up on the compliance of entities outside the Kingdom and the procedures for enforcing the law there.
And if any of your customers are in the European Union, Article 3 of the GDPR applies to you where you offer goods or services to people in the Union or monitor their behaviour, even with no presence there. Article 83(5) sets the ceiling at 20 million euros or 4% of total worldwide annual turnover, whichever is higher.
Egypt: yes, the regulation exists, and the clock is running
This is the question that held everything up in Egypt for five years, and it now has a documented answer.
Egypt's Executive Regulation was issued by Minister of Communications and Information Technology Decree No. 816 of 2025, published in the Egyptian Gazette (Al-Waqa'i al-Misriyya), issue 244 supplement (A), dated 1 November 2025. Its second article states that the decree takes effect the day after publication, that is 2 November 2025. The scan published on the Center's own site carries the Official Printing Authority stamp certifying it as a true copy, and it is the document to rely on rather than the summaries circulating online.
That date matters because Article 6 of the enacting provisions of Law 151 of 2020.pdf) requires those addressed by the law to bring their situation into line with it and its Executive Regulation within one year of the regulation being issued. The clock that had been stopped started last November and runs out in the first days of November 2026. Article 4 of those same enacting provisions had given the minister six months to issue the regulation; it took five years, and that did not lengthen the window you were given.
A supervisory authority now exists as well. The Personal Data Protection Center publishes the law, the regulation, guidelines, checklists and templates. Those guidelines are not binding decisions, as the Center states plainly in their disclaimers, but they are the clearest available statement of what the regulator expects from you.
Saudi Arabia: in force, and the penalties are being applied
The Saudi law was issued by Royal Decree M/19 dated 9 Safar 1443H and amended by Royal Decree M/148 dated 5 Ramadan 1444H. It entered into force on 14 September 2023, according to the Saudi Press Agency statement published that day. The Saudi Data and Artificial Intelligence Authority (SDAIA) supervises it and publishes the full texts in its knowledge centre.
What matters most for a product owner is that the awareness phase is over. On 29 June 2026 SPA reported that the committees reviewing violations had issued decisions imposing fines and warnings under Article 36. The violations named in that statement are worth reading as a priority list, because each one is a specific engineering point:
- Processing personal data for direct marketing without the data subject's explicit consent.
- Failing to adopt the means that ensure a prompt response to data subject requests.
- Failing to notify the authority of a data breach within 72 hours of becoming aware of it.
- Failing to take the organisational, administrative and technical measures that safeguard personal data.
- Failing to appoint a data protection officer although the appointment criteria applied.
Three of those five are settled inside the system itself: an unsubscribe link that works, a screen that produces a customer's data in reasonable time, and a breach notification path prepared before the incident rather than after it.
Nor was that an isolated round. An earlier SPA statement on 15 January 2026 put the count at 48 decisions finding a violation and imposing the prescribed penalty over the preceding year, covering practices such as disclosing personal data without a legal basis and sending promotional and marketing messages without the recipients' consent.
The UAE in brief
Federal Decree-Law No. 45 of 2021 on the protection of personal data has been in force since 2 January 2022, and the UAE Data Office, established by Decree-Law No. 44 of 2021, is the federal body responsible for policies, guidelines and complaint systems. As of our review on 21 September 2026, the data protection laws page on the official UAE government platform, last updated 4 December 2025, presents the decree-law and makes no reference to an executive regulation issued under it.
So the general obligations stand, while the procedural detail developers usually wait for, from precise deadlines to templates and licences, is less settled than in Egypt or Saudi Arabia. If you operate inside the DIFC or ADGM you sit under a separate regime from the federal one, and that is a question for a lawyer rather than an inference from the federal text.
From a legal provision to a column in your database
This is the part that concerns your engineering team. The table below turns the obligations that recur across both texts into a concrete change, with the source on each line.
| The obligation | What changes in your system |
|---|---|
| Consent must be documented in a way that allows it to be verified later, with separate consent for each purpose (Saudi regulation, Art. 11) | A dedicated consents table: user id, purpose, the exact text shown and its version, the channel, timestamp, and IP where available. A single boolean accepted_terms column does not cover it |
| Withdrawing consent must be as easy as giving it, or easier (Saudi regulation, Art. 12) | If consent was a click on the sign-up screen, withdrawal is a click in account settings, not an email to support |
| A record of processing activities (Saudi regulation, Art. 33 and the Egyptian RoPA guideline) | A living table or document per processing activity: purpose, data categories and their classification, lawful basis, hosting environment and whether it sits inside the country or outside, retention period, the roles with access, and the recipients |
| Erasure when the purpose ends or on the data subject's request, covering backups (Saudi regulation, Art. 8) | A real deletion path, not only deleted_at. Plus a written policy for what happens in older backups and for notifying the parties you disclosed the data to, asking them to erase it |
| A retention period defined per data category and tied to the purpose (Egyptian regulation, Art. 2) | A scheduled job that deletes or anonymises expired records, and a column or table carrying the retention period per category instead of "we keep everything forever" |
| Responding to data subject requests within six working days in Egypt (Law 151, Art. 32.pdf)) and thirty days in Saudi Arabia, extendable (Saudi regulation, Art. 3) | An admin screen that exports one customer's data in a readable format within minutes. A request that needs manual queries across seven tables will not be met in six working days |
| Notifying the supervisory authority within 72 hours of becoming aware of a breach, and notifying the data subjects (Saudi regulation, Art. 24; Egypt's framework document) | An access log that can answer "which records were exposed, when, and who reached them". Without it you cannot even fill in the notification form |
| Limiting access to the smallest number of staff and only as needed, stated explicitly for health data (Saudi law, Art. 23) | Field-level permissions rather than screen-level ones. A support agent sees the last four digits of a phone number, not the whole profile |
| Non-essential tracking disabled by default, with granular per-category choices (Egyptian compliance checklist) | Analytics and ad scripts do not load before consent, preferences are stored and applied in later sessions, and the site stays usable when the visitor refuses |
Three notes from doing this work:
The consent log is the part that hurts later. Adding it to a new project is a day's work. Reconstructing it for a three-year-old database with a hundred thousand users who signed up through different screens showing different text is the real problem. The Saudi regulation asks for consent documented so that it can be verified in future, which means knowing which text this particular user agreed to, not merely that they agreed.
Snaabble provides a tailored technical assessment to define the right stack & exact budget.
A soft delete is not a delete. The deleted_at pattern that is so convenient for developers leaves the data in the table, surfaces it in old reports, and ships it in CSV exports. When a customer asks for their account to be deleted you need a genuine deletion path, with a deliberate decision about what is kept under another legal basis, such as an invoice record the tax authority requires you to hold, and then only the minimum needed for that purpose.
Children's data counts as sensitive in Egypt. Article 1 of Law 151.pdf) says so in all cases, and the Center's framework document explains that processing the data of anyone under 15 requires the explicit written consent of the parent or guardian, specifying purpose and duration. Any education platform or paediatric clinic app is directly concerned.
Two differences that get confused
| Egypt | Saudi Arabia | |
|---|---|---|
| Data protection officer | The Center's guideline requires every juridical person addressed by the law to appoint a DPO regardless of the scale of processing, and the DPO is registered with the Center | Article 32 of the regulation limits the obligation to three cases: a public entity processing at scale, core activities requiring regular and systematic monitoring, or core activities involving sensitive data |
| Prior licensing | The licences guideline makes a licence or permit a condition for processing; a licence runs three years and a permit up to one year, the Center decides within 90 days or the application is deemed rejected, and appointing a DPO is a prerequisite for applying | No general prior licence for processing; supervision rests on a national register of controllers, inspection and complaints |
That difference alone reshapes the next few months. An Egyptian company faces an administrative track with deadlines; a Saudi company faces a continuing obligation tested when a complaint or an inspection arrives.
Transfers abroad: the question that touches your hosting
Most systems in the region run on servers outside the customer's country. That is not a violation in itself, but it is not an administrative footnote either.
In Egypt, the licences guideline classifies cross-border transfer as a supplementary licence that cannot exist without a valid general one, and says explicitly that this covers engaging cloud providers where data is processed or stored on servers outside Egypt. The Center's framework adds that an entity with no establishment in Egypt that processes the data of Egyptians or residents must appoint a legal representative in the country.
In Saudi Arabia, Article 29 of the law limits the purposes of transfer and requires that it not harm national security or the Kingdom's vital interests, that an adequate level of protection exists abroad, and that the transfer be limited to the minimum data needed. The regulation on transferring personal data outside the Kingdom fills in the detail: a list of countries published by the authority and reviewed every four years, exemptions conditioned on appropriate safeguards, which are standard contractual clauses, binding common rules or an accreditation certificate, and a written risk assessment before transferring, including where sensitive data moves at scale.
Practically, keep a column in your record of processing activities saying where each kind of data lives, and reread your hosting, payment and messaging contracts. If you are revisiting your infrastructure, our hosting selection guide is worth reading with this in mind, before you sign rather than after.
What happens if you do nothing
Egyptian fines are set out as specific amounts. The figures below come from the text of Law 151 of 2020.pdf) as published in the Official Gazette.
| Violation | Article | Penalty |
|---|---|---|
| Collecting, processing or making personal data available without consent or outside the legally permitted cases | 36 | EGP 100,000 to 1,000,000; rising to imprisonment of at least six months and a fine up to EGP 2,000,000 where it was done for gain or to cause harm |
| Refusing to let a data subject exercise their rights | 37 | EGP 100,000 to 1,000,000 |
| A controller or processor failing to meet its obligations | 38 | EGP 300,000 to 3,000,000 |
| A data protection officer failing to meet the duties of the role | 40 | EGP 200,000 to 2,000,000, and EGP 50,000 to 500,000 where the offence resulted from their negligence |
| Handling sensitive personal data without consent or outside the permitted cases | 41 | At least three months' imprisonment and EGP 500,000 to 5,000,000, or one of the two |
| Breaching the cross-border transfer provisions | 42 | At least three months' imprisonment and EGP 500,000 to 5,000,000, or one of the two |
| Breaching the electronic marketing provisions | 43 | EGP 200,000 to 2,000,000 |
| Breaching the licensing, permit or accreditation provisions | 45 | EGP 500,000 to 5,000,000 |
Alongside these, Article 30 provides administrative sanctions including suspending or withdrawing the licence, publishing a statement of proven violations in widely circulated media at the violator's expense, and placing the controller under the Center's technical supervision at its own cost. Article 47 extends liability to the person responsible for actual management of the legal entity, with the same penalties, where they knew of the violation and their own failure contributed to it. The fine can reach a named individual, not only the company.
Saudi Arabia takes a different drafting approach. Article 35 punishes disclosing or publishing sensitive data with intent to harm or for personal benefit with up to two years' imprisonment and a fine of up to SAR 3 million, or one of them. Article 36 sets the general rule for everything else: a warning or a fine of up to SAR 5 million, doubled on repetition without exceeding twice the ceiling. It is the same article the June 2026 committee decisions rested on.
Where to start this month
If you have one working week, spend it like this:
- Write the record of processing activities first. Start with a single table listing what data you collect, why, where it is stored, how long it stays, and who can reach it. You will not know what is missing until you see it written down, and most of the other obligations are derived from it.
- Inspect your sign-up screen and its consent box. Is marketing consent separate? Is it pre-ticked? Is it recorded somewhere you can go back to in two years?
- Delete your own account. Request deletion through the user interface and follow what actually happens in the database, in backups, and in your analytics and messaging tools.
- Write the breach path before the breach. Who is told, when the 72 hours start, and which log gets read. The Egyptian Center's notification template asks for details you will not assemble on the night.
- Review staff permissions in your admin panel. Most systems we see give every employee sight of everything, because role separation was postponed at launch.
Technical security is necessary here but not sufficient on its own; for that side of the work see common website vulnerabilities and how to prevent hacks, and if you are integrating with e-invoicing, the same data travels through the Egyptian Tax Authority integration path.
These changes cost far less when they are built with the system. If you are building a new system or reviewing an existing one before November, send the Snaabble team a description of what you have and you will get an initial reading of what it needs, with a time and cost estimate, within 24 hours and with no obligation. Service details are on the custom systems page.
Frequently Asked Questions
Has Egypt's executive regulation for the data protection law actually been issued?
Yes. It was issued by Minister of Communications and Information Technology Decree No. 816 of 2025 and published in issue 244 supplement (A) of the Egyptian Gazette dated 1 November 2025, taking effect the day after publication. A stamped scan is published on the Personal Data Protection Center's site.
When does the Egyptian compliance window close?
Article 6 of the enacting provisions of Law 151 of 2020 gives those addressed by the law one year from the date the executive regulation was issued. Since the regulation was issued on 1 November 2025, the window closes in the first days of November 2026.
Do I have to appoint a data protection officer?
In Egypt the Personal Data Protection Center's guideline requires every juridical person addressed by the law to appoint one regardless of the scale of processing, registered with the Center. In Saudi Arabia, Article 32 of the implementing regulation limits the obligation to three cases: a public entity processing at scale, core activities requiring regular and systematic monitoring, or core activities involving sensitive data.
Is hosting customer data abroad a violation?
Not in itself, but it is restricted. In Egypt the licences guideline classifies cross-border transfer as a supplementary licence covering cloud providers that store data outside Egypt. In Saudi Arabia, Article 29 of the law and the transfer regulation require an adequate level of protection, appropriate safeguards, and a written risk assessment before transferring.
How long do I have to report a data breach?
Seventy-two hours from becoming aware of it in both countries: Article 24 of the Saudi regulation requires notifying the competent authority within that period, and the Egyptian Center's framework document states the same window for notifying the Center, with data subjects notified within three working days of that notification.
Sources
- Personal Data Protection Law No. 151 of 2020.pdf): Official Gazette, issue 28 bis (E), 15 July 2020, via the Personal Data Protection Center.
- Executive Regulation issued by Minister of Communications Decree No. 816 of 2025: Egyptian Gazette, issue 244 supplement (A), 1 November 2025.
- Personal Data Protection Center guidelines: licences and permits, data protection officer, record of processing activities, framework document, compliance plan checklist.
- Saudi Personal Data Protection Law, its implementing regulation and the regulation on transfers outside the Kingdom: SDAIA data governance platform, knowledge centre.
- Statement on the law entering into force and the violation committees' statements of January 2026 and June 2026: Saudi Press Agency.
- Data protection laws: official UAE government platform, last updated 4 December 2025.
- General Data Protection Regulation (GDPR): text on EUR-Lex.
All links accessed on 21 September 2026.