AlgeriaLoi n° 09-04 relative à la prévention et à la lutte contre les infractions liées aux technologies de l'information et de la communication
Loi n° 09-04 du 5 août 2009 portant règles particulières relatives à la prévention et à la lutte contre les infractions liées aux… technologies de l'information et de la communication, Journal officiel n° 47
In force since .
A computer misuse rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Place of effect
- Obligation class
- Reporting, Security
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- As an internet access provider, remove or block access to illicit content as soon as you become aware of it, directly or indirectly (not only on judicial order), and assist the competent judicial authorities in an investigation.NIST AI RMFMANAGE 4.1
- Do not use data obtained through a judicially-authorized surveillance measure for any purpose other than the investigation it was gathered for.NIST AI RMFMEASURE 2.10
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
- MANAGE 4.1Post-deployment AI system monitoring plans are implemented, including mechanisms for capturing and evaluating input from users and other relevant AI actors, appeal and override, decommissioning, incident response, recovery, and change management.
- NIST AI 600-1
- GAI-RISK-09Information Security
- MIT mitigations Draft
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ETSI EN 304 223
- 5.2.2-5AI-specific incident management and recovery plans that are created, tested and maintained.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
A service provider whose non-compliance with its obligations under this law obstructs a judicial investigation is liable to six months to five years' imprisonment and a fine of 50,000 to 500,000 DA (art. 11); a legal person is fined under the Penal Code's rules for legal persons.
Penalty structure
Art. 11's fine range for a service provider's non-compliance is 50,000 to 500,000 DA, alongside six months to five years' imprisonment for the natural person responsible.
- Rule
- Fixed only
- As of
- Currency
- DZD
- Fixed cap
- 500,000
Who enforces it
Enforcement body
Autorités judiciaires; organe national de prévention et de lutte contre la criminalité liée aux TIC (art. 13)
Settledness
- As of
- Open questions
- Does an operator that crawls and stores data from public sites fall within 'toute autre entité traitant ou stockant des données informatiques pour ce service de communication ou ses utilisateurs' in the definition of 'Fournisseurs de services' in article 2(d)?
What it makes you log
Who may demand the log
Court
What the log must hold
Actor identity, System identity, Event time, Access record
Log retention
The period runs from the day of recording and article 11 states no other minimum or maximum.
- Unit
- Years
- As of
- Basis
- Fixed
- Maximum value
- 1
- Minimum value
- 1
Logging duty
Article 11 requires a service provider to keep, according to the nature of its services, the data identifying the users, the data on the terminal equipment used, the technical characteristics, date, time and duration of each communication, the data on supplementary services used, and the data identifying the recipients and the addresses of the sites visited, for one year from the day of recording. Article 10 obliges the provider to make that data available to the authorities in charge of judicial investigations. The article 2(d) definition decides who a provider is, and the row already records as open whether a crawler that only reads public pages is one.
- Kind
- Explicit
- As of
- Provision
- Loi n° 09-04 du 5 août 2009, art. 11 (retention of connection and traffic data by service providers) with art. 10 (making the data available to the authorities in charge of judicial investigations)
- Trigger
- all_systems
What this law does
Loi n° 09-04 defines an ICT-related offence by reference to the Penal Code's automated-data-processing-system offences and any other offence committed or facilitated through a computer or electronic communications system, and sets the procedure for judicially-authorized electronic surveillance of communications in terrorism, state security, and serious computer-system-threat investigations.
Internet access providers must remove or block access to illicit content as soon as they become aware of it, directly or indirectly, and assist the competent judicial authorities; a provider's failure to comply carries six months to five years' imprisonment and a fine of 50,000 to 500,000 DA for the natural person responsible. Data gathered through surveillance may be used only for the investigation it was gathered for.
This law's obligations bind service and access providers, not a web crawler generally: art. 2(d) defines a 'fournisseur de services' as an entity offering users the means to communicate over a computer or telecommunications system, or an entity processing or storing data for that communication service or its users, which does not on its own reach an operator that only collects data from public pages it does not own.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .