Introduction
Further to our previously published update on Egyptian Drug Authority (the “EDA”) decree no. 161 of 2025 governing the unified coding of pharmaceutical products and medical supplies in Egypt (the “Decree”), and the publication regarding the complementary decree no. 475 of 2025 (the “Complementary Decree”) regarding the establishment and operation of a national system for tracking human and biological pharmaceutical products (“System”); the EDA issued Decree No. 804 of 2025 on 18 December 2025, which sets out the Complementary Decree’s implementation guidelines governing the operation of the System (“Guide”).
Scope of Application and Exclusions
It should be noted that each of the above exclusions remains subject to the relevant regulatory controls applicable thereto.
Key Provisions
Purpose
The System is designed to electronically record and track each pharmaceutical product pack across its full supply chain, starting from manufacturing and importation up to dispensing to the patient, using international standards, notably the Electronic Product Code Information Services (“EPCIS”). The System aims to ensure transparency and product safety.
Major Obligations
Timeline
1. The System shall apply as follows:
i) on imported fully finished pharmaceutical products: as of 1 February 2026; and,
ii) on primary and/or secondary bulk imported and locally manufactured pharmaceutical products: as of 1 August 2026.
This is subject to the System implementation timeline issued by the EDA’s chairman.
Pharmaceutical products produced or imported by, maximum, the above-mentioned dates shall remain on the market until consumption.
2. Pharmaceutical products produced or imported by, maximum, the above-mentioned dates shall
remain on the market until consumption.
Non-Compliance Consequences
The EDA’s inspection department may take legal measures, including seizure, destruction of pharmaceutical products, written warnings with correction deadlines, temporary suspension of trading and importation, and the imposition of fines, against infringing pharmaceutical products set forth under Article 5 of the Complementary Decree, that are produced or imported after 1 February 2026 and 1 August 2026, as applicable.
The contributors to this article are: Fagr Moheb, Senior Associate and Alaa’ Elmekhashen, Junior Associate.
Egypt’s primary data privacy framework was established with the issuance of the personal data protection law no. 151 of 2020 (the “PDP Law”), marking a significant legislative step towards regulating personal data practices in Egypt. While the PDP Law set out the core principles governing the protection and processing of personal data, including obligations for controllers and processors, the rights of data subjects, and regulating cross-border transfers, its application remained suspended pending the issuance of the Executive Regulations (the “ER”), which were required to bring the law into force.
Following a prolonged period of regulatory inactivity and uncertainty for stakeholders already engaged in the processing of personal data, the ER were finally issued pursuant to Ministerial Decision No. 81 of 2025, thereby activating the PDP Law and rendering its provisions operational. The ER were published in the Official Gazette on 1 November 2025 and were subsequently made publicly available on 25 December 2025.
Personal Data Protection Centre
The PDP Law previously introduced the Personal Data Protection Centre (the “PDPC”) as the competent authority responsible for implementing the PDP Law by regulating and supervising personal data processing activities in Egypt. Under the PDP Law, the PDPC is tasked with overseeing compliance, issuing licences and permits, developing regulatory policies and standards, and exercising enforcement powers. As the primary data protection regulator, the PDPC plays a central role in implementing the PDP Law, a role that has now been operationalised through the ER.
The PDPC continues to hold significant supervisory responsibilities, including ensuring that parties obtain the required licences and permits, with the duration and costs now specified under the ER. Additionally, parties must implement PDPC-approved mechanisms that enable data subjects to exercise their statutory rights.
The PDPC has also issued a series of preliminary guidelines on various topics, including consent, legal bases for processing, records of processing activities, and Data Protection Officers ( “DPO”) and their categories. It has further published guidelines concerning privacy notices. These resources are intended to assist stakeholders in understanding and complying with the PDP Law and the ER.
Licensing
The PDP Law briefly stated that entities collecting personal data should be duly licensed by the PDPC. Building on the PDP Law, the ER proved detailed guidance on the classification and categories of licences and permits, as well as the conditions applicable to controllers and processors of Sensitive Personal Data. This includes setting out licensing procedures and fees for cross-border data transfers, direct electronic marketing, and the use of visual surveillance means in public places, alongside rules for renewal of such licences and permits. Furthermore, the ER introduce a formal accreditation scheme for natural or juristic persons, enabling them to qualify to provide consultations in the field of personal data management and protection. This scheme sets out eligibility criteria, conditions, and procedures for obtaining accreditation.
A clear distinction is drawn between licences and permits. Licenses are granted on an ongoing basis to authorise continuous processing of personal data. Permits, on the other hand, are issued to controllers and processors for specific and temporary purposes, for varying periods not exceeding one (1) year.
Limited exceptions are also introduced regarding fees, including a key exemption from licensing fees for controllers and processors handling one (1) to one-hundred thousand (100,000) records, and an exemption from permit fees for personal data records ranging between one (1) to twenty-five thousand (25,000) records.
Consent
The ER set out detailed requirements governing consent as a lawful basis for processing personal data. In this regard, valid consent must be personal (provided directly by the data subject or by their authorised legal representative), explicit, informed, freely given, and limited to specific, clearly defined processing purposes.
At a minimum, consent obtained from the data subject must at least clearly cover the following information:
Further, the ER mandates that consent must be stored in a secure electronic register, including the date of such consent and the form in which it was provided.
The provision of personal data by a data subject for the purpose of receiving legitimate services or transaction shall be deemed to constitute valid consent to obtain and process the data for that purpose. Such data may not be used for other purposes without prior consent.
It is important to note that the processing of Sensitive Personal Data is subject to stricter requirements, whereby consent in such cases must be in writing, either on paper or electronically.
Electronic Records
There is an additional mandate to maintain electronic logs (records of processing activities) documenting all actions performed on personal data. The PDPC reserves the right to inspect all data-handling entities through its inspectors, acting in their capacity as judicial officers to review these electronic logs and verify compliance with standard benchmarks and technical procedures for data security and protection.
Enhanced Regulatory Oversight for Sensitive Personal Data and Children’s Data
The ER provides detailed regulatory controls for processing Sensitive Personal Data. Further, children’s data is expressly treated as a heightened category of Sensitive Personal Data, subject to age-based consent requirements and specific restrictions on use.
New Breach Notification Requirements
The ER specifies strict timelines for notifying the PDPC in the event of data breaches: seventy-two (72)-hour notification in general cases, while immediate notification where national security is implicated. The controller/processor then notifies the affected Data Subject of the breach three (3) business days after notifying the PDPC. The ER further introduces requirements for corrective and preventive measures, therefore emphasising the importance of incident response documentation.
DPO Extensive Framework
Beyond the PDP Law’s requirement to appoint a DPO, the ER introduces an exhaustive regulatory framework governing DPO appointment, registration, and replacement procedure. The DPO must hold academic qualifications or professional certifications and possess practical experience in relevant fields in accordance with the standards approved by the PDPC. In addition, the DPO must pass tests approved by the PDPC in accordance with the nature and volume of personal data activities.
The PDPC will also maintain an electronic registry in which DPOs must be recorded. Guidelines relating to DPOs have been published by the PDPC to assist stakeholders in meeting these requirements.
Cross-Border Transfer of Personal Data
The ER set out mechanisms for governing cross-border data transfers, requiring prior authorisation from the PDPC and compliance with conditions relating to the destination, purpose, type of data, security measures, and storage.
A licence or permit must be obtained from the PDPC for any cross-border transfers. Transfers are only permitted to countries specified in the licence or permit, which must be updated if additional countries are included. The ER also introduces an adequacy assessment for cross-border transfers. Such adequacy is evaluated on a case-by-case basis and will be included in the licensing decision, not presumed by law.
Personal Data Representative
Controllers based outside Egypt must appoint a representative or agent within the country, via a branch, office, or other authorised means, who will be accredited by the PDPC for the duration of the licence or permit.
Direct Electronic Marketing
While the PDP Law recognised direct electronic marketing as a lawful processing activity, it did not previously provide any guidance or details on how such activities should be conducted. Accordingly, (prior to the issuance of the ER), entities faced uncertainty regarding how to carry out marketing practices in compliance with the PDP Law.
The ER clarify that direct electronic marketing includes social media, emails, SMS, mobile calls, or any other technical means, and may only be carried out with a licence or permit from the PDPC. The ER also set out rules requiring that all marketing communications be conducted only with the prior, explicit, and informed consent of the data subject, with clear identification of the sender and the marketing purpose. It further requires that controllers, processors, and marketing intermediaries must maintain full electronic records of consent, respect withdrawal requests, and ensure personal data is only used for the declared marketing purpose.
In addition, a separate regulatory framework is introduced for granting access to personal data to foreign controllers or processors, also requiring prior licensing by the PDPC and confirmation that equivalent data protection standards apply.
Concerned Entities
The ER apply broadly to any natural or juristic person involved in the collection, processing, storage, or transfer of personal data in Egypt. This includes controllers, processors, marketing intermediaries, consultants, and any stakeholders engaged in activities covered under the PDP Law and ER, such as direct electronic marketing, surveillance in public spaces, or cross-border data transfers. Foreign entities processing or accessing Egyptian personal data are also subject to the regulatory framework and must comply with any licensing requirements imposed by the PDPC.
Sanctions
Non-compliance may expose entities to administrative sanctions, financial penalties, or enforcement actions by the PDPC. Stakeholders are, therefore, encouraged to review the full scope of the ER and implement measures to integrate these obligations into their operations within the grace period.
Grace Period for Compliance
The PDP Law provides for a one (1) year grace period commencing from the issuance of the ER, during which entities are expected to align their operations with the new requirements. On a strict reading, this transitional period would expire on 31 October 2026 based on the Official Gazette publication date. However, it remains unclear whether the competent authorities will calculate the grace period from the formal publication date or from the date which the ER were made publicly accessible, and further clarification on this point is expected.
The contributors to this article are Darah Zakaria, Counsel and Head of TMT; Hana Koptan, Associate; and Junior Associates Habiba Tarek and Marwan Awny.
As part of the implementation of Egypt’s labour law no. 14 of 2025 (the “Labour Law”), the Ministry of Labour continues to issue supplementary decrees to clarify and support its application.
This article outlines the key provisions under the following decrees:
This publication is merely a brief overview of the Labour Law’s supplementary decrees and may not be treated as a legal opinion or relied on in any manner whatsoever. Separate legal advice should be sought where appropriate.
The Foreign Work Permit Decree regulates the licensing and regulation of foreign nationals’ employment in Egypt.
The Foreign Work Permit Decree sets out the rules governing the issuance, renewal, amendment, and cancellation of work permits, the obligations of employers, applicable restrictions and exemptions, related fees, and the Ministry of Labour’s supervisory and enforcement powers, thereby implementing the foreign employment provisions of the Labour Law.
Previously, under the Labour Law, the employment of foreign employees in Egypt was generally governed by Ministerial Decree No. 146 of 2019, which set out the conditions of foreigners work permits; and Ministerial Decree No. 485 of 2010, which regulated the applicable procedures (together, the “Decrees”).
The Foreign Work Permit Decree mainly applies to the employment of foreign nationals in all establishments across the private and public sectors.
It is important to note that, for the purpose of implementing the Foreign Work Permit Decree, the term “work” has been broadly defined, in line with the Labour Law, to include subordinate employment, self-employment, work for one’s own account, professional activities, trades, crafts, and domestic work.
The Foreign Work Permit Decree sets out detailed rules governing the licensing of foreign nationals, beginning with general requirements and extending to exemptions, quotas, fees, monitoring, and enforcement.
Certain key provisions under the Decrees have been retained, while others have been amended or newly introduced. The retained provisions include, among others:
The Foreign Work Permit Decree sets out the procedures, conditions, and applicable fees for applying for and renewing work permits for foreign nationals, including the following:
Employers are required to notify the competent authority of, among others:
In addition, establishments employing foreign nationals are required to:
Even though the Foreign Work Permit Decree maintains the Legal Percentage, it sets out specific, new, and clear exceptions to this cap. These include small establishments, such as shops and restaurants, which are subject to a separate maximum limit for foreign labour, to be determined by the competent authority, taking into account incentive initiatives launched by the Ministry of Labour following submission by the competent administration.
The Foreign Work Permit Decree continues to subject short-term and task-based work to a special fee regime; however, it now expressly defines and limits such engagements to a maximum duration of fourteen (14) days, whether completed in a single day or over several days. This clarification effectively resolves the previous ambiguity surrounding the meaning of “few days” under Article 4 of Decree No. 146 of 2019 and confirms that the exemption regime is limited to assignments of up to fourteen (14) days only.
Where an establishment seeks to engage a foreign national for such work, it is required to submit a request to the competent authority and pay a fee calculated at 10% (ten per cent) of the foreign national’s remuneration for the relevant work, subject to a minimum fee of EGP 15,000 (fifteen thousand Egyptian pounds) and a maximum fee of EGP 100,000 (one hundred thousand Egyptian pounds), applicable to foreign nationals of all nationalities. The applicable fee is payable separately for each task performed by the foreign national.
The Foreign Work Permit Decree expressly prohibits the foreign national from commencing such work prior to obtaining written approval from the Ministry of Labour.
The Collective Labour Disputes Decree regulates in detail the conciliation of collective labour disputes under the Labour Law, setting out its rules and procedures.
Collective Labour Dispute is defined as “any dispute that arises between an employer or a group of employers or their organisations, and all the employees of the establishment or a group of them or their relevant trade union organisations, concerning the terms of work, its conditions, or employment.”
Applications for conciliation may be submitted by either the employee or employer. Said decree specifies the information that must be included in the conciliation application, as well as the supporting documents required, including copies of minutes reflecting the negotiation sessions that took place, reflecting discussions, claims, and defences of each party.
The collective dispute resolution unit within the Labour Directorate (the “Unit”) is empowered to actively manage negotiations, propose compromises, and prevent escalation. The parties to the dispute are restricted from adopting any decision or procedure related to the subject-matter of the dispute during the conciliation phase, except in emergencies and provided that the same is temporary.
The Collective Labour Disputes Decree places particular emphasis on maintaining the confidentiality of the conciliation process, protecting the interests of employees, the trade union, and their representatives.
Conciliation requests should be submitted following the lapse of at least one (1) month from the date the collective negotiations have started without any agreement between the parties.
The parties to the dispute must submit any requested documents, whether by the Unit or the other party.
The results of conciliation may be either:
The Workforce Reduction Decree sets out the rules governing employee selection in cases of partial closure or workforce downsizing due to economic, technical, or organisational reasons stated under the Labour Law.
In the absence of a collective agreement determining objective selection criteria, employers are required to engage in consultations with the competent trade union, if any, for a minimum of seven (7) working days after issuing the establishment’s decision and before its implementation.
When selecting employees, employers must apply transparent, objective, and non-discriminatory principles, balancing business needs with employees’ social and family circumstances.
Additionally, key selection criteria include giving priority to employees, taking into account:
Employers must, as part of the workforce reduction process:
The Ministry of Labour issued the Skill Measurement and License Decree, establishing a national framework for issuing both a certificate measuring skill levels and a permit licensing the practice of professions and crafts across Egypt. Said decree sets out the procedures for skill assessment, issuing permits, and workplace compliance, with implications for both individuals and employers.
In general, individuals practicing the listed professions, trades, or crafts included under the decree must submit a request to obtain a skill measurement certificate and, subsequently, a practice license issued by the competent Labour Directorate, subject to defined tests, fees, and timelines (“License”). The Skill Measurement and License Decree provides for few partial or full exceptions that may apply.
Skill levels are classified across five (5) grades, ranging from assistant employee to specialised technician or trainer.
Employers are subject to enhanced workplace compliance obligations, including:
It is worth noting that employers may engage employees without obtaining the License, provided that their status is reconciled with the applicable legal requirements and the License is obtained within a period not exceeding three (3) years from the date of issuance of the Skill Measurement and License Decree.
In all cases, employees who have been employed by the employer for a period exceeding one year prior to the issuance of the Labour Law shall be exempt from the requirement to obtain such License.
The contributors to this article are Alia Monieb, Partner - Head of Employment; Rawan Roshdy, Managing Associate; Hana Abouelmagd and Seifeldin Hamad, Junior Associates.
Introduction
Nowadays, online shopping has become an integral part of daily life for a growing segment of the population.
Inevitably, medicines are among the products increasingly purchased online - a trend that has driven the rapid growth of online pharmacies (the “E-Pharmacies”) in Egypt over the past few years.
Despite this surge, there is currently no specific Egyptian legal framework governing E-Pharmacies, raising questions around compliance, patient safety, and oversight.
This article briefly explores whether the operation of E-Pharmacies gives rise to legal concerns or considerations under existing Egyptian legislations, and highlights the position adopted by the relevant authorities in this regard.
Background
E-Pharmacies refer to the electronic sale and purchase of medicines through online platforms (i.e., mobile applications and websites).
In addition, E-Pharmacies generally operate in two main forms (the “Categorisations”):
Legal Perspective
Pharmaceutical-related legislations in Egypt were enacted long before the rise of e-commerce. As a result, neither of the E-Pharmacies’ Categorisations is explicitly regulated under Egyptian law. This regulatory gap gives rise to several potential legal risks, including, without limitation, the sale of medicines without a license, dispensing prescription medicines without a valid prescription, selling unregistered or counterfeit products, and dispensing narcotics without a prescription (“Risks”).
It is worth noting that, although a Licensed Pharmacy Platform may be viewed as a digital extension of a licensed street pharmacy, both E-Pharmacies Categorisations may still give rise to such Risks.
Against this background, the key concerns associated with E-Pharmacies under the current Egyptian regulatory framework are outlined below (the “Concerns”) :
Commercialising medications in Egypt must be carried out by a pharmaceutical institution, which is exclusively defined under Egyptian law as, for instance, licensed pharmaceutical manufacturers, distributors, and pharmacies.
While a Licensed Pharmacy Platform represents a digital extension of a licensed street pharmacy, an Intermediary Platform does not qualify as a pharmaceutical institution under the law, nor does it act on behalf of one. Accordingly, Intermediary Platforms are not legally authorised to sell medications to the public.
Medicines must be sold by, and under the supervision of, a licensed pharmacist. However, due to the absence of official regulatory supervision over the electronic activities of Licensed Pharmacy Platforms, it is not always guaranteed that medicines are dispensed under the supervision of a licensed pharmacist.
Prescription medicines may only be dispensed upon verification of a valid prescription by a licensed pharmacist. It is worth noting that such medicines must, in the first place, be sold against a valid medical prescription.
While some Licensed Pharmacy Platforms implement prescription authentication mechanisms prior to dispensing, it remains unclear whether such mechanisms are consistently reviewed and approved by licensed pharmacists. Moreover, the electronic activities of Licensed Pharmacy Platforms are not yet subject to the same level of regulatory oversight as street pharmacies, given the absence of a dedicated regulatory framework.
Marketing a medication includes, among other things, displaying its trade or generic name through promotional material accessible to the public.
Licensed Pharmacy Platforms routinely list the trade names of medications for users, an activity that constitutes promotion and typically requires prior approval or alignment with the relevant governmental authorities, including the Egyptian Drug Authority. In practice, such prior alignment may not always be obtained.
Over the past few years, the Pharmacists Syndicate (the “Syndicate”) has taken several legal actions, based on applicable laws, against various E-Pharmacies for alleged violations and potential risks associated with the online sale and promotion of medications.
Following a complaint filed by the Syndicate before the Public Prosecution regarding the online sale of medications, a notable judgment was issued in 2021 against the Sehtak application, resulting in the imposition of a fine and closure of the application.
More recently, however, the Cairo Economic Court issued a landmark decision in favour of Vezeeta, after the platform successfully demonstrated compliance with the applicable laws and due consideration for the associated Risks and Concerns.
Conclusion
E-Pharmacies reflect the inevitable intersection between technology and healthcare. While they are not inherently problematic, the current regulatory gap, highlighted above, necessitates careful consideration to safeguard public health.
Although some street pharmacies, may, in practice, commit any of the identified Risks, the likelihood of such violations is significantly higher in the context of online medication sales, where proper supervision is still lacking.
Ultimately, the goal is not to resist technology that undoubtedly make people’s lives considerably easier. Rather, the aim is to establish clear governance that prevents this convenience from turning into a threat, particularly when peoples’ lives are at stake. Such governance may take the form of enacting new legislation specifically addressing E-Pharmacies or updating existing laws to keep pace with the unavoidable presence of digitalisation. This is a development we are likely to witness in Egypt in the near future, as the competent authorities have been noticeably attentive and responsive to digital transformation within the pharmaceutical sector.
Authored by Fagr Muheb, Senior Associate and Youssef Ahmed, Junior Associate. This piece reflects our continued commitment to providing thoughtful insights on emerging legal and business developments.
Disclaimer: The views and opinions expressed in this article are those of the author and do not necessarily reflect the official policy or position of ADSERO. This article is intended for general information purposes only and should not be considered or relied on as legal advice. Readers are encouraged to consult with a qualified attorney for specific legal guidance. ADSERO does not guarantee or warrant the accuracy, completeness, or adequacy of the information provided and accepts no liability or responsibility for any errors or omissions in the content.
We are pleased to share ADSERO’s latest contribution to Mondaq on the evolving developments in the EENR sector and their impact on the Egyptian legal and regulatory landscape. The article offers insights into emerging trends, sector-specific challenges, and the legal frameworks shaping the future of energy and natural resources in Egypt.
Our insights are provided by Malak Khalil, Partner – Head of EENR, Radwa El Derwy, Senior Associate, and Omar Moanes, Junior Associate.
Read the full article here.
We are pleased to share ADSERO’s latest contribution to Mondaq on the rising use of Warranty & Indemnity (W&I) Insurance in Egyptian M&A. The article highlights its growing commercial value, alignment with international practice, and potential integration into Egypt’s evolving regulatory landscape.
Our insights are provided by Dr. Ahmed Abdelgawad, Partner – Co-Head of M&A and Capital Markets, Ahmed Adib, Partner, Hana Awad, Counsel, and Salma Soliman, Associate.
Read the full article here.
We are pleased to announce that ADSERO has been recognised as a “Recommended Firm” for the third consecutive year by the IFLR1000 EMEA 2025 rankings.
In addition, we are proud to share the individual rankings:
- Ragy Soliman, Managing Partner and Co-Head of M&A and Capital Markets has been recognised as “Notable Practitioner” in the Capital Markets: Equity, Investment Management, Financial Services and M&A practice areas.
- Ahmed Abdelgawad, Partner and Co-Head of M&A and Capital Markets has been recognised as “Notable Practitioner” in the Capital Markets: Equity and M&A practice areas.
- Hossam Gramon, Partner and Head of Banking & Project Finance has been recognised as “Highly Regarded” in the Banking and Project Finance practice areas for the eighth consecutive year.
- Ahmed Adib, Partner, has been recognised as “Notable Practitioner” in the Capital Markets and M&A practice areas.
- Malak Khalil, Partner and Head of EENR has been recognised as “Rising Star Partner” in the Energy and Infrastructure practice areas.
- Ibrahim El Messery, Counsel, has been recognised as “Notable Practitioner” in the Capital Markets and M&A practice areas.
- Karima Serry Seyam, Senior Associate, has been recognised as a “Rising Star Lawyer” in the Banking practice area for the sixth consecutive year.
We extend our gratitude to our clients for their continued trust and congratulate our dedicated team.
We also extend our warmest congratulations to all those ranked and recommended in this year’s rankings.
To view our full rankings, click here.
We advised Nawy Shares on obtaining its regulatory licenses from the Financial Regulatory Authority (FRA) to undertake the Management of Real Estate Investment Funds, as well as the Promotion and Underwriting of Securities.
This mandate marks a significant milestone in advancing regulated fractional real estate investment in Egypt and highlights the continued evolution of market standards for REIF platforms.
Our team was led by Hossam Gramon, Partner and Head of Banking and Project Finance, and Ibrahim El Messery, Counsel, assisted by Kamal Shehata, Senior Associate, Abdelrahman Amgad, Junior Associate, and Nour Osama, Junior Associate.
Congratulations to the Nawy team — Ayman Magdy, Managing Director, Mohamed Tarek Zakaria, Legal Director, Laila Aziz, Senior Associate, and Samar Babers, Head of Business Development on this achievement.
For more information, check out Investgate’s coverage here.
We are pleased to share ADSERO’s latest contribution to Mondaq on Real Estate Development in Egypt. The article highlights the key regulatory instruments governing the sector and provides an overview of Co-Development Agreements, including their structure and essential contractual components.
Our insights are provided by Dr.Mohamed Fathy, Partner – Head of Real Estate, Hospitality and Tourism, Shaimaa AbdelHakeem, Senior Associate, Ameerah Abdelnaeem, Junior Associate and, Hannah Mahran, Junior Associate.
This article is also featured on Mondaq. You can read it here.
