AlgeriaCode pénal, atteintes aux systèmes de traitement automatisé de données
Ordonnance n° 66-156 du 8 juin 1966 portant code pénal articles 394 bis à 394 noniès, insérés par la loi n° 04-15 du 10 novembre 2004 (JO n° 71), articles 394 bis à 394 quinquiès réécrits par la loi n° 24-06 du 28 avril 2024 (JO n° 30)
In force since .
A computer misuse rule binding public and private bodies.
- Obligation class
- Access restriction
- Audit expectation
- none
What it requires
- Do not access or remain in an automated data-processing system without authorization, whether or not the system is protected by a technical measure.NIST AI RMFMAP 4.1
- Do not introduce, delete, or modify data held in a system without authorization.no control in the NIST AI RMF
- Do not create, distribute, or possess data by which these offenses can be committed, or use data obtained through them.NIST AI RMFMAP 4.1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MAP 4.1Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.
- NIST AI 600-1
- GAI-RISK-09Information Security
- GAI-RISK-12Value Chain and Component Integration
- OWASP LLM Top 10
- LLM03:2026Excessive Agency
- OWASP Agentic Top 10
- ASI03Identity and Privilege Abuse
- MIT mitigations Draft
- FINOS AIGF
- AIR-PREV-018Agent Authority Least Privilege Framework
- AIR-PREV-023Agentic System Credential Protection Framework
- ETSI EN 304 223
- 5.1.2-6Access the AI system gets to other systems and data sources is minimal and risk assessed.
Our reading of where this law's duties sit in each framework, and in the NIST AI RMF, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Identifiers refer to ETSI EN 304 223 V2.1.1 (2025-12), © ETSI 2025, all rights reserved. ETSI owns the standard; no ETSI text (titles or sentences) is reproduced here. The standard is free to download from ETSI.
If you get it wrong
Criminal exposureYes
Criminal exposure note
Base offenses range from six months to five years' imprisonment depending on the provision, with fines from 60,000 DA up to 5,000,000 DA; where the offense harms national defense or a public-law body the penalty is two to ten years and 700,000 to 2,000,000 DA (art. 394 quinquiès), a legal person's fine is up to five times the natural-person maximum, and participating in a group or agreement formed to prepare one of these offenses (art. 394 septiès) or attempting one (art. 394 noniès) carries the same penalty as the completed offense.
Penalty structure
The highest base fine on the tiered scale is 1,000,000 to 5,000,000 DA, with one to five years' imprisonment, for creating, distributing, or possessing data by which these offenses can be committed or that was obtained through them (art. 394 quater); unauthorized access alone carries 60,000 to 200,000 DA (art. 394 bis), and unauthorized data modification carries 500,000 to 2,000,000 DA (art. 394 ter). Where the offense harms national defense or a public-law body, art. 394 quinquiès sets 700,000 to 2,000,000 DA, and a legal person's fine is up to five times the natural-person maximum (art. 394 sixiès).
- Rule
- Fixed only
- As of
- Currency
- DZD
- Fixed cap
- 5,000,000
Who enforces it
Enforcement body
Ministère public (ordinary criminal courts)
Settledness
- As of
- Open questions
- Does reading pages that a site serves to the public amount to accessing 'frauduleusement' 'dans tout ou partie d'un système de traitement automatisé de données' under article 394 bis, or does the offence require circumventing a restriction?
What it makes you log
Logging duty
Articles 394 bis to 394 quinquies, as rewritten in 2024, define offences: fraudulently accessing or remaining in an automated data-processing system, fraudulently introducing, deleting or modifying data in it, and the heavier penalty where the offence harms national defence or public bodies. They impose no duty to create, keep, produce or review a log or record. The Penal Code's general territorial articles are not invoked by these articles, so no territorial hook is stated.
- Kind
- None
- As of
What this law does
Loi n° 24-06 du 28 avril 2024, published in Journal officiel n° 30, rewrote articles 394 bis, 394 ter, 394 quater and 394 quinquiès of the Penal Code. Article 394 bis punishes fraudulently accessing or remaining in all or part of an automated data-processing system with six months to two years of imprisonment and a fine of 60,000 to 200,000 DA, doubled where data is suppressed or modified, and raised to one to three years and 100,000 to 300,000 DA where the system's operation is altered.
Fraudulently introducing, deleting, or modifying data in such a system carries one to three years and 500,000 to 2,000,000 DA (art. 394 ter). Creating, researching, assembling, distributing, or marketing data by which these offenses can be committed, or possessing, revealing, or using data obtained through them, carries one to five years and 1,000,000 to 5,000,000 DA (art. 394 quater).
Where the offense harms national defense or a public-law body, the penalty is two to ten years and 700,000 to 2,000,000 DA, without prejudice to heavier penalties (art. 394 quinquiès). A legal person is fined up to five times the maximum fine for a natural person (art. 394 sixiès). Participating in a group or agreement formed to prepare one or more of these offenses is punished the same as the completed offense (art. 394 septiès). Attempt is punished likewise (art. 394 noniès).
Art. 394 octiès provides for confiscation of the instruments, programs and means used and closure of the site or premises involved.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .