Algeria

Algeria regulates personal data through Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, modelled on European principles. A distinctive feature of its history is that the law's entry into force was contingent on the establishment of the supervisory authority: the National Authority for the Protection of Personal Data (ANPDP) was installed on 11 August 2022, and by operation of Article 75 the law became applicable one year later, on 11 August 2023. The framework was then significantly upgraded by Law No. 25-11 of 24 July 2025, which introduced mandatory DPO designation, records of processing, DPIAs, and a breach-notification regime. The law applies to processing by controllers established in Algeria or using means on Algerian territory, public and private alike. Controllers must file a prior declaration with the ANPDP before processing, with prior authorisation required for higher-risk operations including sensitive-data processing, interconnection of public databases, and cross-border transfers. Sensitive data is prohibited in principle subject to narrow exceptions; data subjects have rights of information, access, rectification or erasure within ten days, and objection. Cross-border transfers require ANPDP authorisation and adequacy, with an absolute bar where a transfer could endanger public security or vital State interests. The 2025 amendment added a five-day breach-notification duty. Sanctions include fines up to 6 million DZD and imprisonment of two months to five years, doubled for repeat offences. Enforcement rests with the ANPDP, an independent authority operational since 2022 that receives declarations and authorisations, authorises transfers, handles complaints, imposes sanctions, and cooperates with foreign authorities. With an in-force law (recently strengthened) and an operational named regulator, Algeria has one of the more developed North African regimes, distinguished by the way its commencement was tied to the regulator's creation.