Protecting customer data in online stores in Egypt

Which law applies?

Law No. 151 of 2020 on the Protection of Personal Data was issued in July 2020. It is Egypt's first comprehensive data protection legislation and was inspired by the European GDPR. It defines the rights of data subjects, the obligations of those who collect and process data, and special provisions for sensitive data, transfers outside Egypt, and breach reporting. Legal sources indicate that a 2025 ministerial decree activated the executive regulation's requirements starting November 2025. Verify the updated details, and any licenses or permits your business requires, with a legal advisor.

Principles that matter to you as a merchant

• Consent and purpose

  Collect data for a specific, clear purpose, with the customer's consent or for a legitimate reason, and do not use it for any other purpose without a legal basis.

• Data minimization

  Don't ask for what you don't need. Do you need a date of birth to deliver an order?

• Retention period

  Decide how long you keep data and when you delete or anonymize it.

• Customer rights

  Accessing their data, correcting it, requesting its deletion, or objecting to its use in marketing.

• Security and reporting

  Appropriate technical protection, and a clear procedure when a leak occurs.

• Third-party processors

  If your store uses a hosting company, email tool, or tracking tool, it processes your customers' data on your behalf, so make sure this is covered by a contract.

Technical checklist

• Transport

  HTTPS on all pages, with HTTP redirected to it

• Passwords

  Stored hashed with strong algorithms, never as plain text or reversible encryption

• Payment data

  Don't store card numbers; rely on a licensed payment gateway that handles PCI DSS compliance

• Permissions

  Each employee sees only what they need, with two-factor authentication for admins

• Access logs

  Record who viewed or modified customer data

• Backups

  Encrypted, restore-tested copies stored in a separate location

• Updates

  Update the platform and plugins regularly and remove unused ones

• Third-party code

  Review tracking and chat tools and the data they collect

• Logs

  Never write phone numbers, cards or passwords into log files

Organizational checklist

• A privacy policy in Arabic

  Clear, stating what you collect, why, who you share it with, and how long you keep it.

• Clear consent

  An unchecked-by-default box for opting in to marketing messages via WhatsApp or email.

• A channel for customer requests

  To delete or correct their data, with a published response time.

• A register of systems holding customer data

  And who owns each one.

• A data breach response plan

  Who is notified? Within how much time? What is the message to customers?

• Team training

  Many breaches start with a phishing message opened by mistake.

Common mistakes

• Excel files with customer names and numbers sent by email or WhatsApp without protection

• An admin account shared between several employees

• Test data copied from production onto a personal device

• A marketing partner getting the full customer list without a contract

Privacy builds trust

A customer who sees your store explain how it uses their data is more willing to buy and leave their phone number. In the long run, good security is cheaper than dealing with a single breach.

Frequently asked questions

• Do these requirements apply to a small store?

  Generally yes, whenever you collect personal data, but the level of measures is proportional to the volume and sensitivity of the data. Ask an advisor about your specific obligations.

• Should I store card data to make repeat purchases easier?

  Don't store it yourself. Use the secure saving feature (tokenization) offered by your payment gateway.

• Is hosting inside Egypt required?

  Data transfers outside the country may be subject to special conditions under the law, so review this point legally before choosing hosting.

Sources

• Text of Law No. 151 of 2020 (Official Gazette)

• Access Now / AFTE

  Analysis of the Personal Data Protection Law.

• Recording Law

  Egypt data privacy laws (2025 executive framework).