Egypt’s Personal Data Protection Law (Law 151 of 2020) applies to every organiser who collects attendee names, phone numbers and email addresses. Its Executive Regulations, issued by Prime Ministerial Decree 816 of 2025 on 1 November 2025, gave organisations one year to comply. That year ends on 31 October 2026. From then on, a registration form is a compliance document as much as a marketing one.
This guide sets out what the law asks of an event organiser, what a form should do about it, and which parts evenclo handles for you. It is a practical summary, not legal advice.
What the law asks of an organiser
- Consent must be explicit, informed, specific and freely given, asked for with a deliberate action. A pre-ticked box is not consent.
- Sensitive data needs explicit written consent. At an event that usually means health: dietary needs, allergies, accessibility requirements.
- Children under 15 need written consent from a legal guardian.
- Retention: set a period tied to the purpose of collection, and erase the data when that purpose is met.
- Breaches: notify the Personal Data Protection Centre within 72 hours, and the people affected within three working days of that.
- Licensing: controllers need a licence from the Centre. Holding 1 to 100,000 records exempts you from the licence fee (Article 19 of the Regulations), not from the licence.
Marketing after the event
Electronic direct marketing has its own rules under Article 17 of the law: prior consent, the sender clearly identified with a working contact address, the message marked as marketing, and a simple way to opt out. The sender keeps a record of each consent for three years after the last message. The Regulations add a specific licence for electronic marketing. A WhatsApp campaign to last year’s attendees is electronic marketing.
What the registration form should do
- Link a privacy notice that names you as controller and says how long you keep the data
- Ask only for fields you will use; every extra field is data you must protect
- Keep marketing consent separate from registering for the event
- Make health questions optional, and ask for explicit consent next to them
Where evenclo helps, and where it does not
evenclo records WhatsApp consent on the attendee record with the time and the address it came from, asks for it only when WhatsApp is switched on for the event, and sends campaigns only to people who opted in. The form builder has a consent field type. Any attendee can be exported as one file or anonymised from their record, and every change your team makes is written to an audit trail that nobody can edit.
What evenclo does not do: apply for your licence, appoint your data protection officer, or delete data on a schedule; anonymising is a decision your team takes. Data is hosted on Google Cloud in Doha, Qatar, so storing attendee data with us is a transfer outside Egypt. The subprocessors page lists every provider.
Common questions
When does Egypt’s data protection law apply to events?
It applies now. The Executive Regulations gave a one-year transition from 1 November 2025, so enforcement is expected from 1 November 2026.
Does a small event need a licence?
The Regulations exempt holders of up to 100,000 records from the licence fee, but the licensing duty itself still applies. Confirm your position with the Centre or your lawyer.
Is asking about dietary needs sensitive data?
Usually, yes. Allergies and medical needs are health data, which needs explicit written consent. Make those questions optional.
Where does evenclo store attendee data?
On Google Cloud in the Doha region. That is outside Egypt, so it counts as a cross-border transfer under the law.
Book a demo Thirty minutes, screen shared, in Arabic or English.