Processes personal data, in Algeria

Loi n° 18-07 du 10 juin 2018, Journal officiel n° 34, arts. 4, 7-9 et 12, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 38-39 et 41 bis à 41 bis 3 · Read the law's page

• Obtain a lawful basis before processing the personal data of a person in Algeria, whether the processing is automated or manual: express consent, or a legal obligation, a vital interest, a contract with the data subject, a public-interest task, or a legitimate interest.
• Where you are established outside Algeria but use automated or non-automated means located there, notify the ANPDP of the identity of your Algeria-based representative.
• Process a child's personal data only with the consent of their legal representative or the authorisation of the competent judge.
• Process personal data lawfully and fairly, for determined and legitimate purposes, keeping it adequate, accurate and no longer than those purposes require.
• Submit every personal-data processing operation to a prior declaration to the ANPDP or its authorisation, before you begin.
• Implement technical and organisational measures appropriate to the risk, and choose a processor only for the sufficiency of its own security guarantees, governed by a written contract.
• Designate a data protection officer chosen for their professional qualifications, who may serve more than one controller given your organisational structure and size.
• Keep a written or electronic record of your processing activities and an automated log of processing operations, and make each available to the ANPDP on request.
• If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, study the impact of a type of processing likely to create a high risk to a person's rights and freedoms before carrying it out.

Loi n° 18-07 du 10 juin 2018, art. 18, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 3 et 45 bis 7 · Read the law's page

• Do not process data revealing racial or ethnic origin, political opinions, religious or philosophical convictions or trade-union membership, nor health data including genetic data, unless the data subject gave express consent, a public interest or legal provision authorises it, or the ANPDP authorised it.
• Where you process genetic data as a doctor or biologist for preventive medicine, diagnosis or care, or process data a person has manifestly made public, or process sensitive data to establish or defend a legal claim, rely on the specific article 18 ground rather than express consent.
• If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, put in place technical and organisational measures giving an appropriate level of protection for sensitive and biometric data.

Loi n° 18-07 du 10 juin 2018, art. 43, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 45 bis 8 et 45 bis 10 · Read the law's page

• As a service provider, that is any public or private entity offering users the ability to communicate over a computer or telecommunications system, or any entity processing or storing data for that communication service, notify the ANPDP without delay of a personal-data breach occurring on a public electronic communications network.
• Notify the affected individual without delay of that same breach where it may harm their private life, unless the ANPDP finds you had already implemented appropriate protective measures.
• Keep an up-to-date inventory of personal-data breaches and the measures you took to remedy them.
• If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, notify the ANPDP of a personal-data breach within five days of becoming aware of it, stating the reason for the delay if the notification is made later.
• As a processor engaged in that same Title V bis processing, notify the controller of a personal-data breach as soon as you become aware of it.
• Within that same Title V bis processing, notify the affected individual of a breach, in clear and simple language describing its consequences, where the breach is likely to cause a high risk to their rights and freedoms.

Loi n° 18-07 du 10 juin 2018, arts. 34-36 · Read the law's page

• Answer a data subject's request for confirmation that you process their personal data and for an intelligible communication of that data, its purposes, categories, recipients and origin.
• Rectify, erase or lock inaccurate, incomplete or unlawfully processed personal data at no charge, within ten days of the data subject's request.
• Stop processing a person's personal data for direct marketing as soon as they object, and honour any other objection made on legitimate grounds unless a legal obligation or the terms of your ANPDP authorisation say otherwise.

Loi n° 18-07 du 10 juin 2018, arts. 44-45 · Read the law's page

• Obtain the ANPDP's prior authorisation before transferring personal data to a foreign state, which the ANPDP grants only where that state's own protections are sufficient, and never transfer or communicate personal data abroad where doing so could harm public security or Algeria's vital interests.
• Where the destination state does not meet that sufficiency standard, rely on one of the article 45 derogations, such as the data subject's express consent, performance of a contract with them, or a bilateral or multilateral agreement to which Algeria is party.

Loi n° 18-07 du 10 juin 2018, arts. 47, 52 et 54-74, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, art. 27 bis · Read the law's page

• Expect a person in Algeria harmed by an infringement of this law to be able to seek protective measures or reparation from the competent court.
• Expect the ANPDP to fine you 500,000 DA for refusing a data subject's information, access, rectification or objection rights without legitimate reason, or for not making a required notification, doubling on a repeat violation.
• Answer the ANPDP's own inspections and audits, and expect the tiered criminal penalties this law sets, from a fine alone up to five years' imprisonment, for the specific duty you breach.

Constitution de la République algérienne démocratique et populaire (révision de 2020), art. 47, promulguée par le décret présidentiel n° 20-442 du 30 décembre 2020 · Read the law's page

• If you are an authority that wants to infringe a person's privacy or the secrecy of their correspondence and private communications, obtain a reasoned decision of the judicial authority first.

Décret présidentiel n° 20-05 du 20 janvier 2020 portant mise en place d’un dispositif national de la sécurité des systèmes d’information, art. 41 · Read the law's page

• Designate the person in charge of the security of your information systems within one year of the decree's publication in the Journal officiel (article 41).
• When the information systems security agency asks for them, give it any document or information useful to its missions (article 19).
• This binds institutions, administrations, public bodies and private operators, other than for national defence information systems, which the decree excludes (articles 40 and 41).

Loi n° 18-11 du 2 juillet 2018 relative à la santé, Journal officiel n° 46 du 29 juillet 2018, arts. 24, 169, 292 et 417 · Read the law's page

• Keep secret the medical information about a person that comes to your knowledge as a health professional, except where the law expressly provides otherwise or the competent court lifts the secrecy.
• If you run a public or private health structure or establishment, keep a computerised single medical file for each patient and protect the confidentiality of the information you hold.
• Expect the penalties of article 301 of the penal code if you breach the obligation of medical and professional secrecy.