Loi n° 18-07 relative à la protection des personnes physiques dans le traitement des données à caractère personnel, modifiée et complétée par la loi n° 25-11

Article 4 applies the law to automated and manual processing of personal data by public bodies and private persons, reaching a controller established outside Algeria that uses automated or non-automated means located in Algerian territory, in which case that controller must notify the ANPDP of the identity of its Algeria-based representative.

Article 7 requires the express consent of the data subject before processing, or one of a listed set of grounds when consent is not required: a legal obligation, safeguarding the data subject's vital interests, performing a contract to which they are party, a task carried out in the public interest or in the exercise of official authority, or a legitimate interest pursued by the controller or the recipient.

Article 8 conditions the processing of a child's personal data on the consent of their legal representative or the authorisation of the competent judge. Article 9 requires personal data to be processed lawfully and fairly, collected for determined, explicit and legitimate purposes, adequate, relevant and not excessive, accurate and kept up to date, and kept in a form permitting identification of the data subject no longer than the purposes for which it was collected require.

Article 12 subjects every personal-data processing operation to a prior declaration to the ANPDP or its authorisation. Article 38 requires the controller to implement technical and organisational measures appropriate to the risk presented by the processing and the nature of the data, and article 39 requires a processor to be chosen for the sufficiency of its own security guarantees, governed by a contract or legal act.

Loi n° 25-11 of 24 July 2025 inserted articles 41 bis and 41 bis 1, requiring the controller and, separately, the competent authority under Title V bis, each to designate a data protection officer chosen for their professional qualifications, who may serve more than one controller or authority given their organisational structure and size; a court is exempted from this duty when exercising its judicial functions.

Loi n° 25-11 also inserted articles 41 bis 2 and 41 bis 3, requiring the controller and the processor each to keep, respectively, a written or electronic record of processing activities and an automated log of processing operations, both to be made available to the ANPDP on request.

Loi n° 25-11 also inserted article 45 bis 6, a data protection impact assessment duty, but that article sits inside the new Title V bis, which article 45 bis confines to personal-data processing for the prevention or detection of offences, investigations, inquiries, criminal prosecutions, or the execution of sentences, carried out only by the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary, or the prison administration, so it is not a general duty on an ordinary controller.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.