EgyptLaw No. 175 of 2018 on Anti-Cyber and Information Technology Crimes
Law No. 175 of 2018 on Anti-Cyber and Information Technology Crimes
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Access restriction
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not access, or remain present in, a restricted website, private account, or information system without authorization; if that access results in copying, altering, or republishing data, a higher penalty applies.NIST AI RMFMAP 4.1
- Do not exceed the scope of access rights that were legally granted to you on a website, private account, or information system.NIST AI RMFMAP 4.1
- Do not disrupt, slow, damage, or alter the design of a website, email account, or information system without authorization.no control in the NIST AI RMF
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Imprisonment of not less than one year (rising to not less than two years where data is destroyed, altered, copied, or republished) plus a fine of EGP 50,000 to 200,000 for unauthorized access under Art. 14; imprisonment and a fine of up to EGP 1,000,000 to 5,000,000 where the target is a State or public-entity network and data is destroyed, altered, or exfiltrated.
Penalty structure
Art. 14's base band for unauthorized access to a restricted website, private account, or information system; the fine and imprisonment both rise where the access is aggravated by data destruction, alteration, copying, or republication, or where the target belongs to the State or a public legal entity (up to EGP 1,000,000-5,000,000 in the most aggravated case).
- Rule
- Fixed only
- As of
- Minimum
- 50,000
- Currency
- EGP
- Fixed cap
- 200,000
Who enforces it
Enforcement body
Egyptian public prosecution and the National Telecom Regulatory Authority-adjacent cybercrime units, under the criminal courts
Settledness
- As of
- Open questions
- Does "محظور الدخول عليه" ("access to which is prohibited") in Article 14 reach a page that any visitor can request without a login or other technical barrier, or only a site, private account or information system whose operator has barred entry?
- Under Article 15, does a user who holds a right to enter a site exceed "حدود هذا الحق من حيث الزمان أو مستوى الدخول" ("the limits of this right as to time or level of access") by collecting content at a rate or volume the operator did not permit, or only by entering an area the right did not cover?
What it makes you log
Who may demand the log
Court
What the log must hold
Actor identity, System identity, Event time, Access record
Log retention
The log is kept for 180 continuous days, and the Authority's board may add further data to the list of what is kept.
- Unit
- Days
- As of
- Basis
- Fixed
- Maximum value
- 180
- Minimum value
- 180
Logging duty
Article 2 first requires a service provider to keep and store the log of the information system, or of any information technology means, for 180 continuous days, covering the data identifying the service user, the content data of the system where it is under the provider's control, the traffic data and the data on the terminal devices of the communication, and any other data the Authority's board determines. The provider must keep the data confidential and may disclose it only on a reasoned order of a competent judicial body. Article 6 lets the investigating authority order a provider to hand over the data it holds or stores. The row's offences, articles 14 and 15, impose no record duty of their own. The content data the article names has no value in the log-contents list and is left out of it.
- Kind
- Explicit
- As of
- Provision
- Law No. 175 of 2018, art. 2 first (retention of the information system's log for 180 days) with art. 2 first (confidentiality of the kept data) and art. 6 (order of the investigating authority to hand over data)
- Trigger
- all_systems
What this law does
Egypt's general computer-misuse statute. Article 14 punishes intentional access to, or unintentional access and unlawful continued presence in, a restricted website, private account, or information system with imprisonment of not less than one year and a fine of EGP 50,000 to 100,000, rising to not less than two years and a fine of EGP 100,000 to 200,000 where the access results in destroying, altering, copying, or republishing data.
Article 15 separately punishes exceeding the scope of access rights legally granted on a website, account, or system. Penalties are further aggravated where the target belongs to, or is operated on behalf of, the State or a public legal entity. The Law does not define "authorization" specifically for a public, unauthenticated web page, and no Egyptian court decision construing Articles 14-15 in that context was located.
When LexLint raises it
When your app profile says your app crawls the web or trains models.
Back to the example · Lint your app
Page updated .