🇩🇿

Algeria

Law No. 18-07 on the Protection of Natural Persons in the Processing of Personal Data (as amended)

Africa🔵 Substantial

Compliance Score

36%

5 Addressed

7 Partial

2 None

Authority

National Authority for the Protection of Personal Data (ANPDP)

Overview

Algeria's personal data protection regime is built on Law No. 18-07 of June 10, 2018, substantially modernized by Law No. 25-11 of July 24, 2025. The amendment introduced key GDPR-era concepts—biometric data, profiling, pseudonymization, and personal data breach—while strengthening controller obligations and expanding the powers of the National Authority for the Protection of Personal Data (ANPDP). The ANPDP, an independent administrative authority, has been fully operational since August 2023 and now actively enforces compliance through notifications, authorizations, and inspections. Prior express consent remains the default legal basis for processing, with limited exceptions. Cross-border transfers require prior ANPDP authorization, and controllers must maintain processing registers and appoint a Data Protection Officer. Penalties can reach up to five years' imprisonment and fines of 500,000 Algerian dinars, doubled for repeat offenses. A dedicated AI and automated decision-making law has not yet been enacted, though the 2025 amendments' introduction of profiling rules signals incremental movement toward algorithmic accountability. Algeria's framework now demands serious compliance attention from any organization processing data of individuals in the country.

14-Topic Coverage Analysis

Data Protection Authority

Addressed

Consent Requirements

Addressed

Data Subject Rights

Addressed

Cross-Border Transfer

Addressed

Breach Notification

Partial

DPO Requirements

Partial

Children's Data

Partial

Penalties & Enforcement

Addressed

Sector-Specific Rules

Partial

Cookie/Tracking

Partial

AI & Automated Decisions

None

Data Localisation

Partial

Significant Data Fiduciary

None

Government Data

Partial

? Frequently Asked Questions

Does Algeria require a Data Protection Officer (DPO)?+

Algeria's Law 18-07 does not mandate a DPO for every company. However, the ANPDP (regulator) requires organizations processing sensitive data (like health or financial records) to designate a 'Data Protection Correspondent'. Indian companies entering Algeria should appoint one for high-risk processing.

What are the breach notification requirements in Algeria?+

Algeria's law has limited breach notification requirements. Unlike GDPR's strict 72-hour deadline, there is no explicit mandate to notify the ANPDP or affected individuals immediately. However, organizations should still maintain robust internal incident response plans.

How does Algeria handle cross-border data transfers?+

Cross-border transfers are permitted only if the receiving country provides an 'adequate level of protection' as determined by the ANPDP. Transfers without adequate protection require explicit authorization from the ANPDP.