Does your Algerian business comply with data protection law 18-07?

What exactly is law 18-07?

It is Algeria’s personal data protection law, published in the Official Gazette No. 34 of 10 June 2018.

It sets the rules for any collection or use of data relating to an identified or identifiable natural person (article 3). Processing must respect human dignity, private life and public freedoms, without harming people’s rights, honour or reputation (article 2).

Amended and supplemented by law No. 25-11 of 24 July 2025, it is enforced by the National Authority for the Protection of Personal Data (ANPDP), an independent administrative authority created under the President of the Republic by the law itself (article 22).

Does it apply to your business?

Yes, as soon as you collect, store or use data about customers, prospects or employees: name, phone number, e-mail, photo, payment data.

The law sets no size threshold: a small business keeping a customer file is covered just like a large group.

Common processing operations covered: contact forms, staff files, CCTV, customer databases, surveys.

Must you declare your processing to the ANPDP?

Yes. Prior declaration is the rule: it describes the controller, the purposes, the data categories, the recipients, the security measures and the retention period (article 14).

It is filed with the national authority, including electronically. The receipt is issued immediately or at the latest within forty-eight (48) hours, and processing may start upon receipt (article 13).

The ANPDP provides an online platform where operators file declarations and authorisation requests.

Which processing operations need prior authorisation?

The risky ones. If, on examining the declaration, the processing appears to pose clear dangers to privacy and fundamental rights and freedoms, the ANPDP moves it to the prior authorisation regime (article 17).

This mainly covers: sensitive data such as health, religious beliefs or political opinions (article 18), the interconnection of files (article 19) and data transfers abroad (articles 44 and 45).

The ANPDP decides within two months, extendable by a reasoned decision of its president (article 20).

What rights can your customers and employees exercise?

Four main rights: information (article 32), access (article 34), rectification (article 35) and objection (article 36).

Refusing these rights without legitimate grounds exposes you to an administrative fine of 500,000 DA (article 47).

In practice: publish a contact address, answer requests on time and train your team on these rights.

Can you host your data abroad?

Transfers abroad are strictly regulated: they are forbidden whenever they could harm public security or the vital interests of the State, and in other cases they require ANPDP authorisation (articles 44 and 45).

Before choosing a cloud service or a foreign host, check where your data is actually stored and whether a transfer is needed at all.

What does a non-compliant business risk?

Administrative measures first: a warning, a formal notice, then provisional withdrawal of the authorisation (article 46).

Then sanctions: an administrative fine of 500,000 DA for refusing data subject rights (article 47); criminal penalties of one (1) to three (3) years' imprisonment and a fine of 100,000 to 300,000 DA for processing without consent (article 55); two (2) to five (5) years and 200,000 to 500,000 DA for breaching article 2 on dignity and privacy (articles 2 and 54).