Law on the Protection of Individuals in the Processing of Personal Data
Enacted in 2023, this law regulates data processing by public and private entities in Algeria.
| Jurisdiction | Algeria |
|---|---|
| Category | Privacy & Data Protection |
| Status | Active |
| Latest development |
Analysis
Key Requirements
Law No. 18-07 on the Protection of Individuals in the Processing of Personal Data, enacted in 2023, establishes the following key requirements for data processing in Algeria:
- Prior declaration or authorization: Data controllers must submit a prior declaration to the National Authority for Personal Data Protection (ANPDP) before processing personal data. Some processing activities require prior authorization, such as transferring data abroad or processing sensitive data.
- Consent: Data processing generally requires explicit consent from the data subject, with some exceptions for legal obligations or vital interests.
- Data subject rights: Individuals have the right to access, rectify, and object to the processing of their personal data.
- Security measures: Data controllers must implement appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, or destruction.
- Data breach notification: Service providers must notify the ANPDP and affected individuals of data breaches that may impact privacy.
Compliance Challenges
Organizations face several challenges in complying with Law No. 18-07:
- Limited guidance: The law is relatively new, and there is limited practical guidance available for implementation.
- Cross-border data transfers: Obtaining authorization for international data transfers can be complex and time-consuming.
- Consent management: Ensuring valid consent for all data processing activities, especially for existing databases, can be challenging.
Implementation Best Practices
To implement Law No. 18-07 effectively:
- Conduct a comprehensive data mapping exercise to identify all personal data processing activities.
- Develop and maintain a data protection policy that outlines compliance procedures.
- Implement a consent management system to obtain and record valid consent from data subjects.
- Establish a data breach response plan to ensure timely notification to authorities and affected individuals.
- Provide regular data protection training to employees handling personal data.
Recent Updates
- Law No. 18-07 came into force on August 10, 2023.
- The ANPDP announced its first field inspections of private sector companies on February 28, 2024.
Related Regulations
- Law No. 18-05 on Electronic Commerce: Regulates e-commerce activities and complements data protection requirements in online transactions.
- Law No. 15-04 on Electronic Signatures and Certification: Establishes rules for electronic signatures, which intersect with data protection in digital transactions.
Industry Impact
The implementation of Law No. 18-07 has significant implications for various industries:
- E-commerce: Online retailers must adapt their data collection and processing practices to comply with consent and security requirements.
- Telecommunications: Telecom providers face increased obligations for data protection and breach notification, particularly given the sensitive nature of communication data.
- Financial services: Banks and financial institutions must enhance their data protection measures to comply with the law while maintaining regulatory compliance in other areas.
Sources
- DLA Piper Data Protection Laws of the World - Algeria
- Pakistan Journal of Life and Social Sciences - The Protection of Personal Data in Algeria
- DataGuidance - Algeria: Navigating the legal landscape of data protection
- Gide Insights - Setting up of the National Authority for the Protection of Personal Data (ANPDP)
- IAPP - Data Mapping 101
- GDPR.eu - Data Protection Impact Assessment Template
- OneTrust - Consent Management Platform
- UK National Cyber Security Centre - Incident Management
- Data Protection Commission Ireland - Training and Tools
- Digital Policy Alert - Algeria: Data protection authority governance
- Official Journal of Algeria - Law No. 18-05 on Electronic Commerce (French)
- Official Journal of Algeria - Law No. 15-04 on Electronic Signatures and Certification (French)
- U.S. International Trade Administration - Algeria Digital Economy
- International Monetary Fund - Algeria Financial System Stability Assessment
Recent developments
- — New HIPAA regulations require compliance by February 16, 2026, enhancing SUD patient protections with limits on record use in investigations, prohibitions on discrimination, and new rights like accounting of disclosures and opt-outs[4] (source)
- — New York Senate Bill S8391, effective mid-2026, strengthens privacy rights with protocols for detecting suicidal ideation on platforms, crisis referrals, annual reporting from July 2027, and private right of action[3] (source)
- — California CCPA updates effective January 1, 2026 mandate opt-out confirmations, expanded right-to-know for historical data back to 2022, ADMT disclosures, risk assessments for high-risk activities, and notice at collection[2] (source)
- — India's Digital Personal Data Protection Act became effective with final rules issued on November 13, 2025, introducing notice, consent, retention limits, breach notifications, and enhanced compliance for global programs[5] (source)
- — Sri Lanka enacted an Amendment Act to its Personal Data Protection Act in late October 2025, repealing prior substantive provisions from March 2025 to address implementation issues like individual rights and cross-border transfers, with enforcement likely in 2026[1] (source)
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: GDPR policy generator (generatepolicy.com)
- Buy the policy pack: Privacy Program Bundle (cyberpolicy.shop)
- Build it yourself: Privacy Dual Coverage Bundle (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates