LexLint.ioBeta

Know the law your code answers to.

Law / Algeria

Loi n° 18-07 relative à la protection des personnes physiques, droits de la personne concernée

Loi n° 18-07 du 10 juin 2018, arts. 34-36

In force since .

A data subject rights rule binding public and private bodies.

Obligation class
Data subject rights, Disclosure
Audit expectation
none

What it requires

  • Answer a data subject's request for confirmation that you process their personal data and for an intelligible communication of that data, its purposes, categories, recipients and origin.NIST Privacy FrameworkCT.DM-P1
  • Rectify, erase or lock inaccurate, incomplete or unlawfully processed personal data at no charge, within ten days of the data subject's request.NIST Privacy FrameworkCT.PO-P3
  • Stop processing a person's personal data for direct marketing as soon as they object, and honour any other objection made on legitimate grounds unless a legal obligation or the terms of your ANPDP authorisation say otherwise.NIST Privacy FrameworkCT.PO-P3

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
  • CT.DM-P1Data elements can be accessed for review.
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

Articles 34 to 36 give the data subject the rights of access, rectification and objection, with a ten-day period for rectification. They require no log, register or proof to be kept. The only evidential rule is in article 34, which puts on the controller the burden of showing that a repeated access request is manifestly abusive. The provisions cited here contain no scope clause, so no territorial hook is recorded.

Kind
None
As of

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article 34 gives a data subject the right to obtain from the controller confirmation of whether their personal data is processed and, if so, its purposes, categories and recipients, and communication in an intelligible form of that data and of any available information on its origin.

Article 35 gives a free right to have inaccurate, incomplete or unlawfully processed data updated, rectified, erased or locked, which the controller must action within ten days of the request, and article 36 gives a right to object on legitimate grounds to processing, and specifically to processing for direct marketing purposes, though that objection right does not apply where the processing meets a legal obligation or the authorisation for the processing expressly excluded it.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on , placing that compliance deadline on .

When LexLint raises it

When your app profile says your app sends automated outreach or processes personal data.

Back to the example  ·  Lint your app

Page updated .