AlgeriaLoi n° 18-07 relative à la protection des personnes physiques, notification des violations de données
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
What it requires
- As a service provider, that is any public or private entity offering users the ability to communicate over a computer or telecommunications system, or any entity processing or storing data for that communication service, notify the ANPDP without delay of a personal-data breach occurring on a public electronic communications network.NIST Privacy FrameworkCM.AW-P7
- Notify the affected individual without delay of that same breach where it may harm their private life, unless the ANPDP finds you had already implemented appropriate protective measures.NIST Privacy FrameworkCM.AW-P7
- Keep an up-to-date inventory of personal-data breaches and the measures you took to remedy them.NIST Privacy FrameworkPR.PO-P7
- If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, notify the ANPDP of a personal-data breach within five days of becoming aware of it, stating the reason for the delay if the notification is made later.NIST Privacy FrameworkCM.AW-P7
- As a processor engaged in that same Title V bis processing, notify the controller of a personal-data breach as soon as you become aware of it.NIST Privacy FrameworkCM.AW-P7
- Within that same Title V bis processing, notify the affected individual of a breach, in clear and simple language describing its consequences, where the breach is likely to cause a high risk to their rights and freedoms.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
The third paragraph of article 43 has each service provider keep up to date an inventory of the personal-data breaches on public electronic communications networks and of the measures taken to remedy them. Articles 45 bis 8 and 45 bis 10, also cited, are duties to notify the national authority and the person concerned and name no record. Article 45 bis 9, which has the controller document every breach, its effects and the remedial measures so that the authority can check compliance, sits between them but is not cited by this row and is not read into it. The inventory has no stated content that matches a standard log field, no stated access by the authority and no stated period. Article 43 has no territorial scope clause, so no territorial hook is recorded.
- Kind
- Explicit
- As of
- Provision
- Article 43, paragraph 3
- Trigger
- security_incident
What this law does
Article 43 requires a service provider, defined at article 3 as any public or private entity offering its users the ability to communicate by computer or telecommunications system, or any other entity processing or storing computer data for that communication service or its users, to notify the ANPDP without delay when processing personal data on a public electronic communications network results in destruction, loss, alteration, disclosure of, or unauthorised access to that data, and to notify the affected individual without delay too where the breach may harm their private life, unless the ANPDP finds the provider had already implemented appropriate protective measures; every service provider must also keep an up-to-date inventory of personal data breaches and the measures taken to remedy them.
Loi n° 25-11 of inserted article 45 bis 8, which is confined, by article 45 bis's own opening line, to processing under the new Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions, or the execution of sentences, carried out only by the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary, or the prison administration: within that narrow scope, the controller must notify the ANPDP of a personal-data breach within five days of becoming aware of it, stating the reason for the delay if the notification is made later, and a processor must notify the controller of the breach as soon as the processor becomes aware of it.
Article 45 bis 10, in the same Title V bis, requires the controller to notify the affected individual of a breach, in clear and simple language describing its consequences, where the breach is likely to cause a high risk to their rights and freedoms.
Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on , placing that compliance deadline on .
When LexLint raises it
When your app profile says your app provides telecom services or processes personal data.
Back to the example · Lint your app
Page updated .