Makes credit decisions, in Algeria

Loi n° 18-07 du 10 juin 2018, Journal officiel n° 34, arts. 4, 7-9 et 12, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 38-39 et 41 bis à 41 bis 3 · Read the law's page

• Obtain a lawful basis before processing the personal data of a person in Algeria, whether the processing is automated or manual: express consent, or a legal obligation, a vital interest, a contract with the data subject, a public-interest task, or a legitimate interest.
• Where you are established outside Algeria but use automated or non-automated means located there, notify the ANPDP of the identity of your Algeria-based representative.
• Process a child's personal data only with the consent of their legal representative or the authorisation of the competent judge.
• Process personal data lawfully and fairly, for determined and legitimate purposes, keeping it adequate, accurate and no longer than those purposes require.
• Submit every personal-data processing operation to a prior declaration to the ANPDP or its authorisation, before you begin.
• Implement technical and organisational measures appropriate to the risk, and choose a processor only for the sufficiency of its own security guarantees, governed by a written contract.
• Designate a data protection officer chosen for their professional qualifications, who may serve more than one controller given your organisational structure and size.
• Keep a written or electronic record of your processing activities and an automated log of processing operations, and make each available to the ANPDP on request.
• If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, study the impact of a type of processing likely to create a high risk to a person's rights and freedoms before carrying it out.

Décret présidentiel n° 20-05 du 20 janvier 2020 portant mise en place d’un dispositif national de la sécurité des systèmes d’information, art. 41 · Read the law's page

• Designate the person in charge of the security of your information systems within one year of the decree's publication in the Journal officiel (article 41).
• When the information systems security agency asks for them, give it any document or information useful to its missions (article 19).
• This binds institutions, administrations, public bodies and private operators, other than for national defence information systems, which the decree excludes (articles 40 and 41).