Algeria. Comprehensive data protection. Law

Law 18-07Law No. 18-07 of 10 June 2018 on the Protection of Natural Persons in the Processing of Personal Data (as amended by Law No. 25-11 of 24 July 2025)

In force

Partly verified

Medium confidence. Effective enforcement date tied to authority set-up (Aug 2023) — approximate.

§1Summary

Synopsis

Algeria's data protection law requiring declarations or authorisations, consent and authorisation for transfers abroad. The 2025 amendment added mandatory DPOs and breach notification.

Key themes

declaration
authorisation
consent
DPO
breach notification
transfers

Unique features

Transfers need ANPDP authorisation and an adequate destination; breach notice to authority and high-risk individuals within 5 days; transfers threatening public security are banned.

SaaS relevance

Offshore SaaS processing Algerian data needs ANPDP transfer authorisation; customers must appoint DPOs.

§2Obligations

Extraterritorial: Limited
Breach notification: ANPDP and high-risk individuals within 5 days
DPO: Yes
Cross-border transfers: ANPDP authorisation + adequacy; derogations (consent, contract)
Maximum penalty: Criminal fines and imprisonment (Arts 47–74)

§3Dates

Key dates

Adopted 10 June 2018
In force August 2023
Authority established Aug 2023; amended by Law 25-11 (24 Jul 2025) adding DPO and breach notification

§4Text and authority

Text

Authoritative text joradp.dz

Authority

Autorité Nationale de Protection des Données à caractère Personnel (ANPDP)

§5Where it applies

Domestic law of: Algeria

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Effective enforcement date tied to authority set-up (Aug 2023) — approximate.