Law on the Protection of Individuals in the Processing of Personal Data

· About Law on the Protection of Individuals in the Processing of Personal Data

Key Takeaways

  • The Law on the Protection of Individuals in the Processing of Personal Data is Algeria’s general personal data law, originally Law No. 18-07 of 10 June 2018, and it became applicable on 12 August 2023 after a long delay in implementation.[1][5][12]
  • The law applies to public bodies and private entities that process personal data in Algeria, and it also reaches certain processing outside Algeria where the processing is connected to an establishment in Algeria or uses means located in Algeria, subject to statutory exceptions.[5][15]
  • A 2025 amendment, Law No. 25-11 of 24 July 2025, significantly strengthened the regime by adding or clarifying obligations on DPOs, records of processing, logs, DPIAs, prior consultation for high-risk processing, and breach notification.[1][6][11][13]
  • The ANPDP (Algerian data protection authority) enforces the law and can conduct oversight, investigations, and sanctions under the amended framework.[4][12][14]
  • Penalties include criminal and administrative sanctions, with higher exposure for unlawful processing, failure to comply with mandatory formalities, unlawful transfers, and obstruction of the authority; the 2025 amendment expands the compliance surface rather than repealing the core penalty model.[3][11][13]
  • As of 25 October 2026, no later amendment or formal delay superseding the 2025 reform appears in the available official and reputable secondary sources reviewed here.[1][6][13][15]

What It Is

Algeria’s personal data law is Law No. 18-07 of 10 June 2018 relating to the protection of natural persons in the processing of personal data, as amended and supplemented by Law No. 25-11 of 24 July 2025.[1][11] It governs the collection, storage, use, disclosure, transfer, and other processing of personal data by public and private actors, with the stated objective of protecting privacy and related fundamental rights.[9][15]

The competent enforcement body is the National Authority for the Protection of Personal Data (ANPDP), an independent administrative authority established under the President of the Republic and charged with ensuring compliance with the law.[4][14]

Key dates are:

  • 10 June 2018: Law No. 18-07 was adopted.[11][15]
  • 12 August 2023: the law entered into force in practice, after a substantial implementation delay.[5][7][8]
  • 24 July 2025: Law No. 25-11 amended and supplemented the framework.[1][11][13]
  • 2025–2026: reputable summaries describe the reform as in effect, with no confirmed later postponement of the 2025 obligations in the available sources.[1][6][13]

Who Must Comply

The law applies to processing by both public bodies and private entities.[5][15] The core threshold is not company size but whether the organization processes personal data within the scope of the Algerian regime.

The law’s reach is extraterritorial in functional terms where processing is connected to Algeria through an establishment, means used in Algeria, or similar statutory hooks described in the statute and secondary guidance.[15] Cross-border transfers are separately regulated and now face tighter scrutiny under the 2025 amendment.[6][13]

Exemptions are narrow and typically concern processing falling outside the law’s scope, such as activities covered by other specific legal regimes or processing that is legally required by a public authority in circumstances recognized by the law.[15] The available sources do not indicate a broad small-business exemption or general de minimis exception.[5][15]

Core Requirements

  1. Lawful processing and purpose limitation: Personal data must be processed for legitimate, specified purposes and in a manner consistent with privacy, dignity, and fundamental rights.[9][15]
  2. Transparency and notice: Controllers must provide individuals with information on the processing, including the identity of the controller, purposes, recipients, and relevant rights.[15]
  3. Consent or another legal basis: The framework requires an appropriate legal basis for processing, with consent remaining central in many private-sector cases and statutory bases applying in public-interest or legal-obligation scenarios.[15]
  4. Data subject rights: Individuals have rights of access, rectification, objection in some contexts, and related protections under the law.[15]
  5. Security and confidentiality: Controllers must implement technical and organizational safeguards proportionate to the risks, now reinforced by the 2025 amendment’s logging and accountability expectations.[6][13]
  6. DPO designation: The 2025 reform makes a Data Protection Officer (DPO) mandatory for controllers and competent authorities, according to reputable 2026 analysis of the amended text.[13]
  7. Records, logs, and DPIAs: Controllers must maintain a processing register, automated operation logs, and conduct data protection impact assessments for high-risk processing.[13]
  8. Prior consultation and transfer controls: High-risk processing may trigger prior consultation with the ANPDP, and transfers to third countries or international organizations are now subject to a prior assessment of the recipient’s protection level.[6][13]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | Law adopted | 10 June 2018 | Core personal data protection law enacted.[11][15] | | Law became applicable | 12 August 2023 | General obligations became enforceable after implementation.[5][7][8] | | Amendment enacted | 24 July 2025 | New obligations on DPOs, logs, DPIAs, breach response, and transfers.[1][11][13] | | Current compliance status | 25 October 2026 | Amended regime remains in force; no later delay is identified in the sources reviewed.[1][6][13] |

Maximum fines and other sanctions are set by the law’s criminal and administrative provisions, as amended, and can include monetary penalties, orders to comply, suspension of processing, and other enforcement measures.[3][11][13] The sources reviewed confirm that unlawful processing, unlawful transfer, failure to respect formalities, and obstruction of the authority remain sanctionable, but they do not provide a single consolidated maximum figure in the available summaries.[3][15]

How to Comply

  1. Map all processing activities against the law’s scope, including public-facing websites, HR systems, CCTV, customer databases, and cross-border hosting arrangements.
  2. Assign governance ownership by appointing a DPO or equivalent function, even where the law’s threshold is unclear, because the amended regime makes DPO capability central to accountability.[13]
  3. Build a RoPA and log framework that aligns with ISO 27001 control discipline and supports the law’s register and automated logging expectations.[13]
  4. Classify risk and run DPIAs for high-risk uses such as large-scale profiling, biometric processing, or sensitive-sector processing, borrowing the risk-method structure used in NIST CSF 2.0 and ISO 42001 governance concepts where AI systems are involved.
  5. Update notices, consents, and internal policies so that collection notices, retention rules, and employee procedures match actual processing.
  6. Test cross-border transfer controls by documenting the recipient jurisdiction, contractual safeguards, and the 2025 requirement to assess the level of protection before transfer.[6][13]
  7. Implement breach response and escalation procedures, including triage, preservation of evidence, internal notification, and regulator-facing decision points.
  8. Audit vendors and processors with data-processing terms, security obligations, and exit provisions that reflect the Algerian regime’s controller accountability model.

Related Regulations

  • EU GDPR: The GDPR is stricter and more mature on lawful bases, processor governance, and cross-border transfers, so groups operating in both regimes should harmonize to the higher standard where practical.
  • Saudi PDPL: Saudi Arabia’s privacy law overlaps on rights, transfer limits, and breach governance, but its compliance triggers and authority structure differ materially.
  • Morocco’s Law 09-08: Morocco’s framework is regionally close in concept, but Algeria’s 2025 reform now places heavier emphasis on DPOs, logs, and DPIAs.
  • Convention 108+: The Council of Europe modernized convention is a useful benchmark for rights and transfer safeguards, though Algeria is not treated here as subject to that instrument.
  • Algeria cybersecurity and sector rules: Sectoral secrecy, banking, telecom, and cybersecurity rules can add stricter controls or reporting duties on top of the data protection law.

FAQ

Does Algeria’s data protection law apply to companies outside Algeria?

Yes, it can apply where processing is sufficiently connected to Algeria, including through local establishment or the use of means in Algeria, depending on the statutory trigger.[15] Cross-border transfers are also specifically regulated and became more exacting under the 2025 amendment.[6][13]

Is a Data Protection Officer mandatory in Algeria?

Yes, the 2025 amendment is widely summarized as making a DPO mandatory for controllers and competent authorities.[13] Organizations should treat this as a current compliance requirement unless and until official implementing guidance narrows the scope.

When did the law actually start applying?

Although Law No. 18-07 was adopted in 2018, reputable sources state that it entered into force and became applicable on 12 August 2023.[5][7][8] The later 24 July 2025 amendment is now part of the operative regime.[1][11][13]

Does Algeria require breach notification?

The 2025 amendment is reported to introduce breach-notification rules, but the exact operational details should be verified against the official amended text and any implementing guidance.[6][13] In practice, organizations should be prepared to notify internally and externally on a short timeline because the amended law increases accountability.

What are the biggest enforcement risks?

The highest-risk areas are unlawful processing, weak transparency, noncompliant transfers, missing documentation, and failure to respond to ANPDP oversight.[3][13][15] The amended framework also increases risk for organizations that cannot produce a processing register, logs, or DPIA records on request.[13]

Sources

Put it into practice

More compliance guides