Algeria

Law No. 18-07 of 10 June 2018 on the Protection of Individuals in the Processing of Personal Data (as amended by Law No. 25-11 of July 2025) IN FORCE

commenced 2018-06-10 (fully applicable from August 2023, when the ANPDP was installed) · Official full text ↗

Scope

Any public or private entity that receives, stores or processes personal data, in digital or non-digital form; extends to controllers outside Algeria using processing means located in Algerian territory (transit-only excluded), who must appoint a representative in Algeria (art. 4).

Key obligations

Express consent of the data subject (or legal guardian) as the default processing basis, with purpose limitation, proportionality, accuracy and limited retention (Chapter II); Prior declaration to the ANPDP for all processing; prior authorisation for transfers abroad, communication to third parties, and interconnection of public-service data; Records of processing activities for controllers and processors (introduced by Law 25-11, 2025); Data subject rights: information, access, rectification, objection, and a right against automated decision-making

DPO required

Yes: controllers, and public authorities processing for law-enforcement purposes, must appoint a DPO selected for expertise in data protection law and practice (regime introduced with the Law 25-11 modernisation).

Registration

Yes: prior declaration to the ANPDP (renewed before any new processing), with prior authorisation for transfers abroad, third-party communication and interconnection; filings run through the ANPDP's online portal.

Cross-border transfers

Transfers abroad require ANPDP authorisation and a sufficient level of protection in the destination country, as assessed by the authority; derogations include express consent, international agreements, vital interests, public interest, legal claims, contract performance and medical purposes.

Breach notification

For processing over electronic communications networks, the service provider must notify the ANPDP and the data subject within a maximum of 5 days of becoming aware of a breach; failure to notify is a criminal offence.

Penalties

Administrative: warning, formal notice, provisional (up to one year) or definitive withdrawal of the declaration receipt or authorisation, and fines (art. 46). Criminal: fines of DZD 20,000 to 1,000,000 and/or imprisonment of two months to five years (arts. 47-74).

Authority

Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP)

Verified 2026-07-07