Algeria

Article 43 requires a service provider, defined at article 3 as any public or private entity offering its users the ability to communicate by computer or telecommunications system, or any other entity processing or storing computer data for that communication service or its users, to notify the ANPDP without delay when processing personal data on a public electronic communications network results in destruction, loss, alteration, disclosure of, or unauthorised access to that data, and to notify the affected individual without delay too where the breach may harm their private life, unless the ANPDP finds the provider had already implemented appropriate protective measures; every service provider must also keep an up-to-date inventory of personal data breaches and the measures taken to remedy them.

Loi n° 25-11 of 24 July 2025 inserted article 45 bis 8, which is confined, by article 45 bis's own opening line, to processing under the new Title V bis for the prevention or detection of offences, investigations, inquiries, criminal prosecutions, or the execution of sentences, carried out only by the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary, or the prison administration: within that narrow scope, the controller must notify the ANPDP of a personal-data breach within five days of becoming aware of it, stating the reason for the delay if the notification is made later, and a processor must notify the controller of the breach as soon as the processor becomes aware of it.

Article 45 bis 10, in the same Title V bis, requires the controller to notify the affected individual of a breach, in clear and simple language describing its consequences, where the breach is likely to cause a high risk to their rights and freedoms.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.

Article 4 applies the law to automated and manual processing of personal data by public bodies and private persons, reaching a controller established outside Algeria that uses automated or non-automated means located in Algerian territory, in which case that controller must notify the ANPDP of the identity of its Algeria-based representative.

Article 7 requires the express consent of the data subject before processing, or one of a listed set of grounds when consent is not required: a legal obligation, safeguarding the data subject's vital interests, performing a contract to which they are party, a task carried out in the public interest or in the exercise of official authority, or a legitimate interest pursued by the controller or the recipient.

Article 8 conditions the processing of a child's personal data on the consent of their legal representative or the authorisation of the competent judge. Article 9 requires personal data to be processed lawfully and fairly, collected for determined, explicit and legitimate purposes, adequate, relevant and not excessive, accurate and kept up to date, and kept in a form permitting identification of the data subject no longer than the purposes for which it was collected require.

Article 12 subjects every personal-data processing operation to a prior declaration to the ANPDP or its authorisation. Article 38 requires the controller to implement technical and organisational measures appropriate to the risk presented by the processing and the nature of the data, and article 39 requires a processor to be chosen for the sufficiency of its own security guarantees, governed by a contract or legal act.

Loi n° 25-11 of 24 July 2025 inserted articles 41 bis and 41 bis 1, requiring the controller and, separately, the competent authority under Title V bis, each to designate a data protection officer chosen for their professional qualifications, who may serve more than one controller or authority given their organisational structure and size; a court is exempted from this duty when exercising its judicial functions.

Loi n° 25-11 also inserted articles 41 bis 2 and 41 bis 3, requiring the controller and the processor each to keep, respectively, a written or electronic record of processing activities and an automated log of processing operations, both to be made available to the ANPDP on request.

Loi n° 25-11 also inserted article 45 bis 6, a data protection impact assessment duty, but that article sits inside the new Title V bis, which article 45 bis confines to personal-data processing for the prevention or detection of offences, investigations, inquiries, criminal prosecutions, or the execution of sentences, carried out only by the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary, or the prison administration, so it is not a general duty on an ordinary controller.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.

Article 44 conditions a transfer of personal data to a foreign state on the ANPDP's prior authorisation, granted only where that state ensures a sufficient level of protection for privacy and fundamental rights and freedoms with respect to the processing the data may undergo, a sufficiency the ANPDP assesses against that state's legal provisions, its applicable security measures and the processing's own characteristics, and prohibits any communication or transfer abroad that could harm public security or the State's vital interests.

Article 45 lists narrow derogations that permit a transfer to a state that does not meet those conditions: the data subject's express consent, safeguarding their life, preserving the public interest, establishing or defending a legal right, performing a contract with the data subject or pre-contractual measures at their request, a contract concluded in the data subject's interest between the controller and a third party, executing a measure of international judicial assistance, preventing, diagnosing or treating a medical condition, a bilateral or multilateral agreement to which Algeria is party, or the ANPDP's own authorisation where the processing meets article 2's conditions.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.

Article 34 gives a data subject the right to obtain from the controller confirmation of whether their personal data is processed and, if so, its purposes, categories and recipients, and communication in an intelligible form of that data and of any available information on its origin.

Article 35 gives a free right to have inaccurate, incomplete or unlawfully processed data updated, rectified, erased or locked, which the controller must action within ten days of the request, and article 36 gives a right to object on legitimate grounds to processing, and specifically to processing for direct marketing purposes, though that objection right does not apply where the processing meets a legal obligation or the authorisation for the processing expressly excluded it.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.

Article 27 bis, inserted by loi n° 25-11 of 24 July 2025, gives the ANPDP regional units in charge of oversight and audit of the institutions and persons that process personal data.

Article 47 lets the ANPDP itself fine a controller 500,000 DA for refusing, without legitimate reason, the information, access, rectification or objection rights of articles 32, 34, 35 and 36, or for not making the notifications required by articles 4, 14 and 16, doubling on recidivism to the penalties article 64 sets. Article 52 lets the holder of a right under the law who claims to be harmed by its infringement seek protective measures or reparation from the competent court.

Articles 54 to 74 set a tiered set of criminal offences: unlawful processing that breaches the law's dignity and privacy principles under article 2 carries two to five years' imprisonment and a fine of 200,000 to 500,000 DA (art. 54); processing without a lawful basis or against a data subject's objection carries one to three years and 100,000 to 300,000 DA (art. 55); processing without the prior declaration or authorisation article 12 requires carries two to five years and 200,000 to 500,000 DA (art. 56); unauthorised access to the national register of article 28 carries one to three years and 100,000 to 300,000 DA (art. 63); a controller's unjustified refusal of a data subject's information, access, rectification or objection rights carries two months to two years and 20,000 to 200,000 DA (art. 64); breaching the security duties of articles 38 and 39, or retaining data beyond its authorised duration, carries a fine of 200,000 to 500,000 DA (art. 65); a service provider's failure to notify a breach under article 43 carries one to three years and 100,000 to 300,000 DA (art. 66); an unauthorised foreign transfer carries one to five years and 500,000 to 1,000,000 DA (art. 67); and obstructing the ANPDP's own inspections carries six months to two years and 60,000 to 200,000 DA (art. 61).

Penalties double on recidivism (art. 74), and a legal person is punished with a fine under the Penal Code's own rules for legal persons (art. 70). Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.

Article 18 prohibits processing sensitive data, defined at article 3 as data revealing racial or ethnic origin, political opinions, religious or philosophical convictions or trade-union membership, or relating to health including genetic data; that list was left unchanged by loi n° 25-11.

The prohibition lifts only for a public-interest reason indispensable to the controller's legal or statutory functions, the data subject's express consent, a legal provision authorising it, or the ANPDP's own authorisation, and article 18 separately authorises the processing of sensitive data to defend a person's vital interests where they cannot consent, by a non-profit political, philosophical, religious or trade-union body confined to its own members, over data manifestly made public by the data subject, to establish or defend a legal claim, or of genetic data by a doctor or biologist for preventive medicine, diagnosis or care.

Loi n° 25-11 of 24 July 2025 defined biometric data at article 3 as personal data resulting from specific technical processing relating to a natural person's physical, physiological or behavioural characteristics that allow or confirm their unique identification, but did not add biometric data to article 18's sensitive-data list.

The only operative duty loi n° 25-11 attaches to biometric data is article 45 bis 7, which requires the controller or processor to put in place technical and organisational measures giving an appropriate level of protection for processing of sensitive and biometric data.

That article sits inside the new Title V bis Chapter 4, which article 45 bis confines to personal-data processing for the prevention or detection of offences, investigations, inquiries, criminal prosecutions, or the execution of sentences, carried out only by the judicial authority, a body legally empowered to investigate offences, a judicial auxiliary, or the prison administration.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.

Loi n° 24-06 du 28 avril 2024, published in Journal officiel n° 30, rewrote articles 394 bis, 394 ter, 394 quater and 394 quinquiès of the Penal Code. Article 394 bis punishes fraudulently accessing or remaining in all or part of an automated data-processing system with six months to two years of imprisonment and a fine of 60,000 to 200,000 DA, doubled where data is suppressed or modified, and raised to one to three years and 100,000 to 300,000 DA where the system's operation is altered.

Fraudulently introducing, deleting, or modifying data in such a system carries one to three years and 500,000 to 2,000,000 DA (art. 394 ter). Creating, researching, assembling, distributing, or marketing data by which these offenses can be committed, or possessing, revealing, or using data obtained through them, carries one to five years and 1,000,000 to 5,000,000 DA (art. 394 quater).

Where the offense harms national defense or a public-law body, the penalty is two to ten years and 700,000 to 2,000,000 DA, without prejudice to heavier penalties (art. 394 quinquiès). A legal person is fined up to five times the maximum fine for a natural person (art. 394 sixiès). Participating in a group or agreement formed to prepare one or more of these offenses is punished the same as the completed offense (art. 394 septiès). Attempt is punished likewise (art. 394 noniès).

Art. 394 octiès provides for confiscation of the instruments, programs and means used and closure of the site or premises involved.

Loi n° 09-04 defines an ICT-related offence by reference to the Penal Code's automated-data-processing-system offences and any other offence committed or facilitated through a computer or electronic communications system, and sets the procedure for judicially-authorized electronic surveillance of communications in terrorism, state security, and serious computer-system-threat investigations.

Internet access providers must remove or block access to illicit content as soon as they become aware of it, directly or indirectly, and assist the competent judicial authorities; a provider's failure to comply carries six months to five years' imprisonment and a fine of 50,000 to 500,000 DA for the natural person responsible. Data gathered through surveillance may be used only for the investigation it was gathered for.

This law's obligations bind service and access providers, not a web crawler generally: art. 2(d) defines a 'fournisseur de services' as an entity offering users the means to communicate over a computer or telecommunications system, or an entity processing or storing data for that communication service or its users, which does not on its own reach an operator that only collects data from public pages it does not own.

Ordonnance n° 03-05 relative aux droits d'auteur et aux droits voisins protects a database as an original composite work only where the choice or arrangement of its contents constitutes an original creation, the same standard it applies to a collection or anthology of works; Algeria has no separate sui generis database right. Its private-use exception, which otherwise allows a single copy for personal or family use, expressly excludes the digital-form reproduction of a database. Reproducing or communicating a protected work or database without authorization is punishable as contrefaçon.

Article 41 of Décret présidentiel n° 20-05 requires institutions, administrations, public bodies and private operators to designate the person in charge of the security of their information systems within one year of the decree's publication in the Journal officiel. Article 19 empowers the information systems security agency to require from bodies, institutions and operators that hold an information system any document or information useful to its missions.

Article 40 excludes the national defence information systems from the scope of the decree. Article 3 places under the Ministry of National Defence a national council for information systems security and an information systems security agency. The Journal officiel of 26 January 2020 published Décret présidentiel n° 20-05 of 20 January 2020 on the establishment of a national information systems security system.

A citation or borrowing from a published work in another work is licit under ordonnance n° 03-05 where it conforms to loyal use for information or demonstration purposes, provided the author's name and the source are always given. A single-copy private reproduction of a work is otherwise licit for personal or family use, but that exception does not cover a digital-form database reproduction.

Reproducing or communicating a protected work without authorization outside these exceptions is punishable as contrefaçon.