Loi n° 18-07 relative à la protection des personnes physiques, contrôle, sanctions et voies de recours

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Loi n° 18-07 arts. 54 to 74 set a tiered set of criminal offences rather than one penalty: unlawful processing of sensitive data or processing that breaches the law's dignity and privacy principles carries two to five years' imprisonment and a fine of 200,000 to 500,000 DA (art. 54, art. 57); processing without a lawful basis or against a data subject's objection carries one to three years and 100,000 to 300,000 DA (art. 55); processing without complying with the prior-declaration or authorization conditions of art. 12 carries two to five years and 200,000 to 500,000 DA (art. 56); processing for a purpose other than the one declared or authorized carries six months to one year and 60,000 to 100,000 DA (art. 58); fraudulent collection carries one to three years and 100,000 to 300,000 DA (art. 59); letting an unauthorized person access personal data carries two to five years and 200,000 to 500,000 DA (art. 60); obstructing the ANPDP carries six months to two years and 60,000 to 200,000 DA (art. 61); revealing information protected under the law, by a person bound by professional secrecy under arts. 23 and 27, carries the penalty set by Penal Code art. 301 (art. 62); unauthorized access to the national register of art. 28 carries one to three years and 100,000 to 300,000 DA (art. 63); a controller's unjustified refusal of a data subject's information, access, rectification, or opposition rights carries two months to two years and 20,000 to 200,000 DA (art. 64); a breach of the security duties of arts. 38-39, or retaining data beyond its authorized duration, carries a fine of 200,000 to 500,000 DA (art. 65); a service provider's failure to notify a breach carries one to three years and 100,000 to 300,000 DA (art. 66); an unauthorized foreign transfer carries one to five years and 500,000 to 1,000,000 DA (art. 67); unauthorized retention of offence or conviction data carries six months to three years and 60,000 to 300,000 DA (art. 68); and negligently facilitating misuse or unauthorized disclosure of processed data carries one to five years and 100,000 to 500,000 DA (art. 69). Penalties double on recidivism (art. 74). A legal person is punished with a fine under the Penal Code's rules for legal persons (art. 70).

Penalty structure

The highest criminal fine on the tiered scale set by arts. 54 to 74 is the 500,000 to 1,000,000 DA range for an unauthorized foreign transfer (art. 67); most other offences carry a lower fine within a 20,000 to 500,000 DA range depending on the provision breached (art. 64's refusal-of-rights offence sets the floor) (see the criminal exposure note for the full table). Separately, art. 47 lets the ANPDP itself impose a direct administrative fine of 500,000 DA on a controller that refuses a data subject's rights or fails to make a required notification. All figures double on recidivism under art. 74.

Rule

Fixed only

As of

4 September 2026

Currency

DZD

Fixed cap

1,000,000

Logging duty

Articles 47, 52 and 54 to 74 set the administrative fine, the court remedy and the criminal offences. None of them tells a controller to create or keep a record. Article 61 punishes refusing to hand the authority's members and agents the information and documents they need, and giving information that does not match the records at the time of the request; that is a power to demand documents, with no record named. Article 27 bis, inserted by Law n° 25-11, gives the authority regional bodies for control and audit. The register and the operations log of articles 41 bis 2 and 41 bis 3 are in another row. The provisions cited here contain no scope clause, so no territorial hook is recorded.

Kind

None

As of

28 October 2026