AlgeriaLoi n° 18-07 relative à la protection des personnes physiques, transfert de données vers un pays étranger
Loi n° 18-07 du 10 juin 2018, arts. 44-45
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer
- Audit expectation
- none
What it requires
- Obtain the ANPDP's prior authorisation before transferring personal data to a foreign state, which the ANPDP grants only where that state's own protections are sufficient, and never transfer or communicate personal data abroad where doing so could harm public security or Algeria's vital interests.
- Where the destination state does not meet that sufficiency standard, rely on one of the article 45 derogations, such as the data subject's express consent, performance of a contract with them, or a bilateral or multilateral agreement to which Algeria is party.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Articles 44 and 45 make a transfer of personal data to a foreign state depend on the national authority's authorization, and on the destination offering a sufficient level of protection, unless an article 45 derogation applies. They require no log, register or proof of the transfer to be kept. The provisions cited here contain no scope clause, so no territorial hook is recorded.
- Kind
- None
- As of
What this law does
Article 44 conditions a transfer of personal data to a foreign state on the ANPDP's prior authorisation, granted only where that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms with respect to the processing the data may undergo, a sufficiency the ANPDP assesses against that state's legal provisions, its applicable security measures and the processing's own characteristics, and prohibits any communication or transfer abroad that could harm public security or the State's vital interests.
Article 45 lists narrow derogations that permit a transfer to a state that does not meet those conditions: the data subject's express consent, safeguarding their life, preserving the public interest, establishing or defending a legal right, performing a contract with the data subject or pre-contractual measures at their request, a contract concluded in the data subject's interest between the controller and a third party, executing a measure of international judicial assistance, preventing, diagnosing or treating a medical condition, a bilateral or multilateral agreement to which Algeria is party, or the ANPDP's own authorisation where the processing meets article 2's conditions.
Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on , placing that compliance deadline on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .