AlgeriaLoi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11
Loi n° 18-07 du 10 juin 2018 Journal officiel n° 34, arts. 4, 7-9 et 12, telle que modifiée et complétée par la loi n° 25-11 du 24 juillet 2025, arts. 38-39 et 41 bis à 41 bis 3
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Governance, Security, Licensing, DPIA
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Obtain a lawful basis before processing the personal data of a person in Algeria, whether the processing is automated or manual: express consent, or a legal obligation, a vital interest, a contract with the data subject, a public-interest task, or a legitimate interest.NIST Privacy FrameworkCT.PO-P1
- Where you are established outside Algeria but use automated or non-automated means located there, notify the ANPDP of the identity of your Algeria-based representative.NIST Privacy FrameworkGV.PO-P5
- Process a child's personal data only with the consent of their legal representative or the authorisation of the competent judge.NIST Privacy FrameworkCT.PO-P1
- Process personal data lawfully and fairly, for determined and legitimate purposes, keeping it adequate, accurate and no longer than those purposes require.NIST Privacy FrameworkGV.PO-P1
- Submit every personal-data processing operation to a prior declaration to the ANPDP or its authorisation, before you begin.NIST Privacy FrameworkGV.PO-P5
- Implement technical and organisational measures appropriate to the risk, and choose a processor only for the sufficiency of its own security guarantees, governed by a written contract.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P3
- Designate a data protection officer chosen for their professional qualifications, who may serve more than one controller given your organisational structure and size.NIST Privacy FrameworkGV.PO-P3
- Keep a written or electronic record of your processing activities and an automated log of processing operations, and make each available to the ANPDP on request.NIST Privacy FrameworkID.IM-P4NIST Privacy FrameworkCT.DM-P8
- If you are the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary or the prison administration processing personal data under Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions or the execution of sentences, study the impact of a type of processing likely to create a high risk to a person's rights and freedoms before carrying it out.NIST Privacy FrameworkID.RA-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.IM-P4Data actions of the systems/products/services are inventoried.
- ID.RA-P3Potential problematic data actions and associated problems are identified.
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
3 more
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a controller that is not established in Algeria but serves users there 'recourt, à des fins de traitement des données à caractère personnel, à des moyens automatisés ou non, situés sur le territoire algérien' under article 4(2), when it operates no equipment on Algerian territory, so that it must notify its representative to the autorité nationale?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 41 bis 2 has the controller, and separately the processor, keep a register of its processing activities, on paper or in electronic form, and put it at the national authority's disposal on request. Article 41 bis 3 has each of them keep an automated log of processing operations (collection, recording, consultation, use, disclosure, erasure and the rest) that shows the reasons for, and the date and time of, each operation and, as far as possible, who used, consulted or disclosed the data and who received it, also available to the authority on request. Article 41 bis 3 limits the use of the log to checking that the processing is lawful, internal control, keeping the data intact and secure, and criminal proceedings. The article 12 prior declaration to the authority, which this row also cites, is a filing and not a record kept. The law sets no period for keeping the register or the log. Article 4 reaches processing by a controller established in Algeria, and also by a controller established elsewhere that uses means located in Algeria; the second test turns on where equipment sits and has no territorial hook to match, so only establishment is recorded.
- Kind
- Explicit
- As of
- Provision
- Articles 41 bis 2 and 41 bis 3, inserted by Law n° 25-11
- Trigger
- personal_data_processing
Why the legislator wanted it
The purpose is stated in the last paragraph of article 41 bis 3 itself; the law has no separate recital.
- As of
- Quote
- Le carnet des opérations est utilisé, exclusivement, aux fins de vérification de la légalité du traitement, du contrôle interne, de la garantie de l’intégrité et de la sécurité des données ainsi que pour les besoins des procédures pénales.
- Source link
- https://www.joradp.dz/FTP/JO-FRANCAIS/2025/F2025048.pdf
- Source kind
- Recital
- Purpose
- accountability_demonstration
- oversight_and_correction
What this law does
Article 4 applies the law to automated and manual processing of personal data by public bodies and private persons, reaching a controller established outside Algeria that uses automated or non-automated means located in Algerian territory, in which case that controller must notify the ANPDP of the identity of its Algeria-based representative.
Article 7 requires the express consent of the data subject before processing, or one of a listed set of grounds when consent is not required: a legal obligation, safeguarding the data subject's vital interests, performing a contract to which they are party, a task carried out in the public interest or in the exercise of official authority, or a legitimate interest pursued by the controller or the recipient.
Article 8 conditions the processing of a child's personal data on the consent of their legal representative or the authorisation of the competent judge. Article 9 requires personal data to be processed lawfully and fairly, collected for determined, explicit and legitimate purposes, adequate, relevant and not excessive, accurate and kept up to date, and kept in a form permitting identification of the data subject no longer than the purposes for which it was collected require.
Article 12 subjects every personal-data processing operation to a prior declaration to the ANPDP or its authorisation. Article 38 requires the controller to implement technical and organisational measures appropriate to the risk presented by the processing and the nature of the data, and article 39 requires a processor to be chosen for the sufficiency of its own security guarantees, governed by a contract or legal act.
Loi n° 25-11 of inserted articles 41 bis and 41 bis 1, requiring the controller and, separately, the competent authority under Title V bis, each to designate a data protection officer chosen for their professional qualifications, who may serve more than one controller or authority given their organisational structure and size; a court is exempted from this duty when exercising its judicial functions.
Loi n° 25-11 also inserted articles 41 bis 2 and 41 bis 3, requiring the controller and the processor each to keep, respectively, a written or electronic record of processing activities and an automated log of processing operations, both to be made available to the ANPDP on request.
Loi n° 25-11 also inserted article 45 bis 6, a data protection impact assessment duty, but that article sits inside the new Title V bis, which article 45 bis confines to personal-data processing for the prevention or detection of offences, investigations, inquiries, criminal prosecutions, or the execution of sentences, carried out only by the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary, or the prison administration, so it is not a general duty on an ordinary controller.
Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on , placing that compliance deadline on .
When LexLint raises it
When your app profile says your app serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .