Cybersecurity law & regulation in Algeria (2026)
Cybersecurity in Algeria: sectoral rules.
Algeria has built a layered cybersecurity regime across multiple instruments rather than a single comprehensive statute: a 2009 cybercrime law governs offences and ISP obligations; a 2020 presidential decree created the national governance bodies CNSSI and ANSSI; and a July 2025 amendment to the data-protection law introduced mandatory breach notification. In December 2025-January 2026, Algeria further tightened the framework by approving a five-year national cybersecurity strategy and mandating dedicated cybersecurity units inside all public institutions.
Legal framework
Presidential Decree No. 20-05 (2020, amended 2025) establishing CNSSI/ANSSI; Law No. 09-04 (2009, amended 2016) on cybercrime; Law No. 18-07 (2018, amended by Law 25-11, 2025) on personal data protection; Presidential Decree No. 26-07 (2026) on cybersecurity units; National Cybersecurity Strategy 2025-2029 (Decree 25-321)
Key points: cybersecurity in Algeria
Cybercrime Law (09-04)
Law No. 09-04 of 5 August 2009, amended by Law No. 16-02 of 19 June 2016, defines ICT-related offences, authorises electronic-communications surveillance, obliges service providers to cooperate with authorities and retain data, and created a national committee for preventing and fighting cybercrime.
National IS Security Governance (Decree 20-05)
Presidential Decree No. 20-05 of 20 January 2020 (amended by Decree 25-298 of 10 November 2025) established the National Council for IS Security (CNSSI) as the strategic body and the National Agency for IS Security (ANSSI) as the technical/operational arm, mandating a CISO in all state information systems.
Breach Notification Duty (Law 25-11)
Law No. 25-11 of 24 July 2025 amended the data-protection Law 18-07 to introduce mandatory breach notification: organisations must notify the national data-protection authority (ANPDP) and affected individuals within five days of discovering a personal data breach.
National Cybersecurity Strategy 2025-2029
Presidential Decree No. 25-321 of 30 December 2025 formally approved the five-pillar National Cybersecurity Strategy 2025-2029, covering protection of state digital infrastructure, mandatory security audits for critical sectors (banking, healthcare, energy), capacity building, and sector-specific cybersecurity regulations.
Cybersecurity Units in Public Institutions (Decree 26-07)
Presidential Decree No. 26-07 of 7 January 2026 requires all public administrations and state-linked organisations to establish internal cybersecurity units, defining their missions, organisational structure, and responsibilities for anticipating and managing cyber risks.
DZ-CERT and Incident Response
Algeria's national CERT (DZ-CERT), hosted by CERIST, coordinates incident response and exchanges threat intelligence with international CERTs. ANSSI oversees vulnerability disclosure and certification of cybersecurity products; critical infrastructure operators face enhanced incident-reporting obligations to ANSSI.
Timeline of decisions
- LawDecree 26-07: Mandatory Cybersecurity Units in All Public Institutions
Presidential Decree No. 26-07 requires every Algerian public institution to establish a dedicated cybersecurity unit reporting directly to the head of the organisation; units must map threats, deploy remediation plans, and coordinate incident response with ASSI. Driven by Algeria recording over 70 million cyberattacks in 2024, ranking 17th globally among most-targeted nations.
Ecofin Agency
- Law · officialPresidential Decree No. 25-321 Formally Adopts National Cybersecurity Strategy 2025-2029
President Tebboune signed Decree No. 25-321 approving Algeria's five-year National Information Systems Security Strategy; a companion Decree No. 26-07 (January 7, 2026) mandated dedicated cybersecurity units across all public institutions, and the strategy's content was publicly unveiled by the Ministry of National Defence on 3 March 2026.
APS (Algérie Presse Service — official state wire)
- Law · officialPresidential Decree 25-321: National Cybersecurity Strategy 2025-2029 Approved
Algeria's five-pillar National Cybersecurity Strategy was approved by presidential decree, mandating security audits for critical infrastructure, sector-specific rules for banking, healthcare, and energy, and capacity-building for 285,000 trainees. Context: Algeria recorded over 70 million cyberattacks in 2024, ranking 17th globally among most-targeted nations, directly motivating AI-system security governance.
Cyber Policy Portal (ITU/UNIDIR)
- DecisionNational Cybersecurity Strategy 2025-2029 Formally Adopted
Presidential Decree No. 25-321 signed by President Tebboune formally approves Algeria's five-year national cybersecurity strategy, targeting critical infrastructure defence, digital sovereignty, and public-sector capacity-building as the overarching policy framework.
AlgeriaTech News
- LawDecree 25-298 Amends the 2020 National Cybersecurity Governance Framework
Presidential Decree No. 25-298 updates the foundational decree creating CNSSI and ASSI, refining inter-institutional mandates and coordination rules in preparation for the 2025-2029 strategy rollout.
CMS Expert Guide
- LawLaw 18-04 on Electronic Communications: First Statutory Definition of Cybersecurity
This foundational telecoms law (Article 10) formally defined 'cybersecurity' in Algerian statute and imposed binding network security, data confidentiality, and anti-interception obligations on all electronic communications operators, with criminal penalties under Article 165 for non-compliance.
Digital Policy Alert
- Law · officialLaw No. 18-04 on Post and Electronic Communications, ARPCE Established
This updated telecoms law renamed the ARPT as the Regulatory Authority for Post and Electronic Communications (ARPCE), codified a statutory definition of cybersecurity, and broadened the regulator's mandate to cover internet service providers and electronic platforms, the institutional backbone for all subsequent online safety regulation.
ARPCE (official regulator)
- Law · officialLaw 09-04: Foundational Cybercrime Statute Enacted
Algeria's principal cybercrime law defined ICT-related offences, authorised lawful electronic surveillance and digital search-and-seizure, established a national body to coordinate cybercrime prevention and forensic assistance, and provided a framework for international judicial cooperation.
WIPO Lex
- Law · officialLaw 04-15: First Penal Code Provisions on Automated Data Crimes
Algeria inserted Section 7 bis into the Penal Code, criminalising unauthorised access to automated data-processing systems, data integrity violations, and digital fraud, establishing the first criminal-law basis for prosecuting computer intrusions and laying the foundation for all subsequent cybersecurity legislation.
Council of Europe – Octopus Cybercrime Community
Sources
- wipo.int/wipolex/en/legislation/details/14778
- cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
- dataguidance.com/news/algeria-law-modifying-data-protection-law-published
- dlapiperdataprotection.com/index.html?t=breach-notification&c=DZ
- techafricanews.com/2026/01/26/algeria-strengthens-cybersecurity-framework-to-protect-nat
- digitalpolicyalert.org/digest/dpa-digital-digest-algeria
- dzair-tube.dz/en/algeria-charts-its-digital-sovereignty-ministry-of-national-defenc
- coe.int/en/web/octopus/-/algeria
- ncsi.ega.ee/country/dz_2022/
- wearetech.africa/fr/fils/actualites/tech/l-algerie-se-dote-d-un-cadre-institutionnel-r
Next for Algeria: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026