Data protection & privacy law in Algeria (2026)

Legal framework

Law No. 18-07 of 10 June 2018 on the Protection of Individuals in Personal Data Processing (as amended by Law No. 25-11 of 24 July 2025), enforced by the National Authority for the Protection of Personal Data (ANPDP, Autorité Nationale de Protection des Données à Caractère Personnel)

Key points: data & privacy in Algeria

1. 01Primary Legislation

   Law No. 18-07 of 10 June 2018 is the comprehensive personal data protection statute. It entered into effective force on 10 August 2023 when the ANPDP became operational. It was materially amended and strengthened by Law No. 25-11 of 24 July 2025.

   dlapiperdataprotection.com digitalpolicyalert.org

2. 02Supervisory Authority (ANPDP)

   The ANPDP is an independent administrative authority with legal personality and financial autonomy, operating under the authority of the President of Algeria. It receives declarations, grants authorisations for high-risk processing, handles complaints, conducts inspections (field inspections of private-sector companies began February 2024), and imposes administrative sanctions.

   anpdp.dz gide.com dlapiperdataprotection.com

3. 03Notification & Authorisation Regime

   Controllers must file a declaration with the ANPDP before commencing any personal data processing. High-risk activities, including international data transfers, large-scale database interconnections, and processing of sensitive data, require prior authorisation rather than mere notification.

   cms.law dlapiperdataprotection.com

4. 042025 Amendment, GDPR-Aligned Obligations

   Law 25-11 (July 2025) introduced mandatory appointment of Data Protection Officers (DPOs), records of processing activities, Data Protection Impact Assessments (DPIAs) for high-risk processing, mandatory breach notification to the ANPDP within five days, new definitions for biometric data, profiling, pseudonymisation and data breaches, and prior consultation with the ANPDP where a DPIA reveals unmitigated high risks.

   dataguidance.com cms.law

5. 05Individual Rights

   Data subjects are granted rights of information, access, rectification, and erasure. Controllers must obtain consent for processing in most cases, and specific rules govern sensitive categories of data (health, biometric, etc.).

   dlapiperdataprotection.com dataguidance.com

6. 06Sanctions

   Non-compliance carries administrative fines ranging from 20,000 DZD to 1,000,000 DZD, and criminal penalties of imprisonment from two months to five years, applicable to both controllers and processors.

   dlapiperdataprotection.com cms.law

Timeline of decisions

1. 30 Dec 2025Law
   Presidential Decree 25-320: National Data Governance Framework Established

   A companion presidential decree enacted a national data governance framework, codifying rules for sovereign data management, data localisation obligations, and cross-border data flows. The decree directly constrains how AI systems may store and process Algerian citizens' data and reinforces the ANPDP's jurisdiction.

   CMS Expert Guide – Algeria

2. 24 Jul 2025Law · official
   Law No. 25-11: Personal Data Protection Law Comprehensively Amended

   Parliament adopted Law No. 25-11 amending Law 18-07 to require mandatory Data Protection Officers (DPOs), Data Protection Impact Assessments (DPIAs), data-sovereignty hosting obligations, and expanded ANPDP enforcement powers. These requirements directly apply to AI systems that process personal data and represent the closest Algeria has come to an AI-specific regulatory obligation.

   Algérie Presse Service (APS) – Official State Agency

3. 24 Jul 2025Law
   Law No. 25-11 modernises data-protection framework, DPO, DPIA & breach notification

   Parliament enacted Law 25-11 amending Law 18-07 to introduce mandatory Data Protection Officers, records of processing activities, Data Protection Impact Assessments for high-risk processing, and a 5-day breach notification obligation to the ANPDP. The amendment brings Algeria's framework significantly closer to GDPR-era standards.

   DataGuidance

4. 1 Jul 2025Law
   Law 11-25 Modernises Data Protection: DPO, DPIA, and Processing Records Required

   Parliament adopted Law No. 11-25 amending the 2018 data protection law to mandate appointment of Data Protection Officers (DPOs), maintenance of detailed processing records, and Data Protection Impact Assessments (DPIAs), substantially increasing cybersecurity-linked compliance obligations.

   Digital Policy Alert

5. 12 Aug 2023Law
   Law 18-07 enters full legal force, compliance obligations activated

   After a five-year phased implementation, Law 18-07 became fully enforceable on 12 August 2023, obligating all public and private data controllers to file declarations, obtain authorisations for high-risk processing, and comply with data-subject rights. The ANPDP received 228 filings within its first three months of operations.

   LexAfrica

6. 10 Aug 2023Law
   Law 18-07 on Personal Data Protection Enters into Force

   Algeria's 2018 data-protection law, dormant pending the ANPDP's installation, became fully binding; all public and private entities processing data of persons in Algeria must now make prior declarations or obtain authorisation from the ANPDP, with direct cybersecurity-safeguarding obligations attached.

   Digital Policy Alert

7. 30 Jan 2023Guidance
   ANPDP launches public website and opens registration portal

   The ANPDP went public with its website and online declaration/authorisation forms, beginning a structured awareness phase running from January to August 2023. This operationalised the authority's role as primary interface for data controllers navigating Law 18-07 obligations.

   Africa Data Protection Blog

8. 11 Aug 2022Decision
   ANPDP formally installed, independent data-protection regulator operational

   The National Authority for the Protection of Personal Data (ANPDP) was officially installed on 11 August 2022, four years after Law 18-07 was enacted. As an independent administrative authority with legal personality and financial autonomy, it became responsible for registrations, authorisations, complaints, and sanctions.

   Gide Loyrette Nouel

9. 1 Nov 2020Law
   2020 Constitution elevates personal data protection to fundamental right (Art. 47)

   The revised Algerian Constitution, adopted by referendum on 1 November 2020, enshrined personal data protection in Article 47 alongside the right to privacy of correspondence and communications. This cemented data protection as a constitutional obligation rather than a merely statutory one.

   DataGuidance

10. 10 Jun 2018Law
    Law No. 18-07 on Protection of Personal Data Enacted

    Algeria's first comprehensive data-protection statute established data-subject rights, controller obligations, and created the ANPDP as an independent supervisory authority; enforcement was deferred pending the Authority's installation, which did not occur until 2022.

    Digital Policy Alert

11. 10 Jun 2018Law
    Law No. 18-07: Algeria's First Comprehensive Personal Data Protection Law

    Algeria enacted Law 18-07, its foundational data protection statute modelled on the GDPR, establishing principles of lawful processing, purpose limitation, and data minimisation, and creating the ANPDP. All subsequent AI governance obligations in Algeria are built on this legislative foundation.

    DLA Piper Data Protection Laws of the World – Algeria

12. 10 Jun 2018Law · official
    Law No. 18-07, comprehensive personal data protection law enacted

    Algeria's landmark data-protection statute established GDPR-inspired principles: lawfulness, purpose limitation, data minimisation, accuracy, and storage limitation. It created consent requirements, data-subject rights (access, correction, objection), cross-border transfer controls, and mandated the creation of the independent ANPDP.

    ARPCE (Algerian Post & Electronic Communications Regulatory Authority)

13. 10 May 2018Law
    E-Commerce Law No. 18-05 introduces data-protection rules for online consumers

    Enacted weeks before Law 18-07, the E-Commerce Law included data-protection provisions specifically governing direct marketing and online consumer consent, giving customers the right to refuse processing before Law 18-07 created the broader framework.

    Digital Policy Alert

14. 5 Aug 2009Law · official
    Law No. 09-04, foundational cybercrime and digital surveillance law

    Algeria's first major digital privacy legislation established rules on interception of electronic communications, obligations on ISPs to cooperate with judicial authorities, and the legal framework for combating ICT crimes. It introduced the concept of lawful surveillance with safeguards for communications secrecy and was later amended by Law 16-02 (2016).

    WIPO Lex

Sources

1. 1.anpdp.dz/ar/
2. 2.portail.anpdp.dz/
3. 3.dlapiperdataprotection.com/?t=law&c=DZ
4. 4.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
5. 5.dataguidance.com/news/algeria-law-modifying-data-protection-law-published
6. 6.dataguidance.com/notes/algeria-data-protection-overview
7. 7.digitalpolicyalert.org/event/25318-implemented-law-relating-to-the-protection-of-individuals
8. 8.gide.com/en/news-insights/setting-up-of-the-national-authority-for-the-protect
9. 9.dlapiperdataprotection.com/index.html?t=authority&c=DZ