--- title: "Algeria Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/algeria/ source_html: /jurisdictions/algeria/index.html description: "Algeria data protection and privacy regulation: 10 categories, 79 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: af0145ee31a2a1212e13637a427f0585e5e12295478da714cd7c9df8068c7d95 generator: "fe-fleet/md-twin@1.0" --- # Algeria Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Algeria Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/algeria/), [World Payments](https://payments.gi/jurisdictions/algeria/) Last updated 2026-11-04 · 10 categories · 79 claims · 38 sources in the cumulative register Download report (PDF) Expand all Algeria's data-protection framework moved materially this cycle with Law No. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: AdTech & Commercial Privacy, Algorithmic, Biometric & Surveillance Governance, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework, Enforcement & Redress (6 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=ALGERIA)[Build Report](/reports/?j=ALGERIA)[Compare](/compare/?j=ALGERIA) Framework posture Regulated (omnibus) 9 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 9 / 10 modules assessed 0 Confirmed · 7 Probable · 2 Uncertain · 1 Not yet assessed 10 Categories 4 Red categories 57 Sub-modules 79 Claims 1 Tier-1 sources Traffic-light mix 5 amber 4 red 1 n/a (sums to 10 rendered categories; click to filter) 4 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 978 Full executive summary 446 ###### Latest update · 4 November 2026 #### Lead Signal Algeria's data protection regime is showing a pattern of operational tightening through a series of sector-specific decisions issued by the national data-protection authority, the ANPDP, across the first part of 2026, even as the core statutory framework remains the one established by Law No. 18-07 as amended by Law No. 25-11 of 24 July 2025. The ANPDP holds powers including warnings, formal notices, withdrawal of processing authorisations, administrative fines and data-modification or destruction orders, and recent deliberations show the authority applying that toolkit to a widening set of everyday processing contexts rather than amending the statute itself. Taken together, these decisions point to an authority moving from a largely dormant statutory presence toward active sector-level rule-making, even though a visible enforcement record against named controllers is still reported as thin. #### Other Developments On lawful processing, the ANPDP adopted rules on 15 July 2026 requiring explicit consent before identifiable photos or videos containing personal information are collected, stored, retained or published online, extending consent requirements into image-sharing contexts that were not previously the subject of specific ANPDP rulemaking. Separately, ANPDP Decision No. 01 of 25 February 2026 treats negative drug and psychotropic-substance test results obtained during recruitment as health data, subject to a declaration requirement and a retention period capped at three months, a sector-specific application of the special-category processing regime to employment screening. On controller and processor duties, Law No. 25-11 is reported to introduce a mandatory Data Protection Officer requirement for organisations processing sensitive data or processing at large scale, alongside a breach-notification duty requiring notice to the ANPDP within five days of discovery and a Data Protection Impact Assessment requirement for high-risk processing; the practical enforcement maturity of these 2025 duties has not been independently verified. ANPDP Decision No. 02 of 4 March 2026 separately regulates workplace video surveillance, requiring prior declaration to the authority, restricting the purpose of such surveillance to the security of persons and property, and imposing transparency and security obligations on the controller operating the system. On algorithmic, biometric and surveillance governance, ANPDP Decision No. 03 of 6 May 2026 regulates the use of biometric systems for monitoring workplace attendance, placing a further sector-specific constraint on biometric processing in the employment context alongside the video-surveillance and image-consent decisions noted above. #### Cross-Monitor Connections The recurring theme of ANPDP decisions constraining processing in the employment and workplace-monitoring context, spanning biometric attendance systems, workplace video surveillance and health-data retention in recruitment screening, may be of interest to monitors tracking algorithmic and biometric governance developments more broadly, including artificial-intelligence, where comparable workplace-monitoring and biometric-processing constraints are tracked across other jurisdictions. #### Outlook The pattern across these decisions, image-sharing consent, health-data retention in recruitment, workplace video surveillance and biometric attendance monitoring, suggests the ANPDP is building out sector-specific guidance incrementally rather than through a single comprehensive instrument, and further sectoral decisions in this vein should be anticipated. Separately, confirmation of whether Law 25-11's regional audit poles are operationally active or still awaiting implementing regulation would clarify how actively the expanded 2025 statutory duties, including the Data Protection Officer requirement and the five-day breach-notification duty, are being supervised and enforced in practice as at the date of this brief. 5 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Algeria's data-protection framework moved materially this cycle with Law No. 25-11 of 24 July 2025, which amends Law No. 18-07 and is described in secondary legal-guide sourcing as modernising Algeria's regime toward GDPR-style accountability, risk-based governance and organisational-duty requirements. Enforcement of Algeria's data-protection law has rested since August 2023 with the ANPDP, an independent administrative authority headquartered in Algiers, but no publicly reported ANPDP enforcement action has surfaced as of early 2026 despite the law's meaningful penalty regime — a gap between law-on-the-books and enforcement-in-practice that commentary suggests is unlikely to persist now that Law No. 25-11 is in force. #### Other Developments Accountability duties expand. Law No. 25-11 introduces requirements for organisations to conduct Data-Protection Impact Assessments, to appoint a Data Protection Officer, and to maintain detailed records of processing activities — a package of governance obligations that did not previously exist under Law No. 18-07 in this form. Cross-border transfer authorisation regime confirmed. Cross-border transfer of personal data from Algeria requires ANPDP authorisation where the underlying processing meets the law's conditions, a standing requirement under Law No. 18-07 that Law No. 25-11 is reported to further clarify, though mechanism-level detail was not fully resolved this cycle. New cybersecurity-governance instrument. Presidential Decree No. 26-07 of 7 January 2026 creates dedicated cybersecurity units within public institutions, with preventive and repressive functions explicitly covering money laundering, terrorism financing and fraudulent data use, alongside a companion instrument establishing a national data-governance framework. Extraterritorial scope confirmed. Law No. 18-07 is reported to apply extraterritorially: international companies collecting data from Algerian users are subject to the law even without physical presence in Algeria. #### Cross-Monitor Connections Presidential Decree No. 26-07's cybersecurity-unit mandate explicitly names money laundering and terrorism financing among the harms its preventive and repressive functions cover, placing this development directly within the remit of financial-integrity's AML/CFT tracking for Algeria; this brief surfaces the connection without re-analysing the AML/CFT substance itself, which belongs to that monitor. #### Outlook The central open question for Algeria's data-protection regime is whether the ANPDP's enforcement vacuum persists now that Law No. 25-11's expanded accountability obligations (DPIA, DPO, records-of-processing) are in force; commentary cited this cycle assesses that the vacuum is unlikely to continue, but no enforcement action has yet been publicly reported to confirm that assessment. Watch for the first reported ANPDP enforcement action, and for primary-source (ANPDP or Official Journal) confirmation of Law No. 25-11's DPIA, DPO and records-of-processing thresholds, which remain unresolved with only secondary-source detail available this cycle. Read full brief · 978 words ###### Latest update · 4 November 2026 #### Regulatory Status Algeria's data protection framework is anchored in Law No. 18-07 of 2018, as amended by Law No. 25-11 of 24 July 2025, administered by the ANPDP. Across the period covered by this brief, the ANPDP issued a series of sector-specific decisions: an image-sharing consent requirement (15 July 2026), a health-data classification and retention rule for recruitment drug-screening results (Decision No. 01, 25 February 2026), a workplace video-surveillance regime (Decision No. 02, 4 March 2026), and a workplace biometric-attendance-monitoring regime (Decision No. 03, 6 May 2026). Law 25-11 is also reported to have introduced a mandatory Data Protection Officer requirement, a five-day breach-notification duty to the ANPDP, and a Data Protection Impact Assessment requirement for high-risk processing. Cross-border transfers of personal data out of Algeria continue to require prior ANPDP authorisation except to a country declared adequate, and no adequacy list has been published, so transfers continue to be assessed case by case. The statute's tiered criminal-penalty architecture, ranging from short custodial terms and modest fines for rights-refusal up to multi-year terms and larger fines for unauthorised disclosure of sensitive data, remains in force, though a visible enforcement record against named controllers is reported as thin. #### Outlook The pattern across the year's ANPDP decisions, consent for image-sharing, health-data retention limits, workplace surveillance and biometric attendance monitoring, points to an authority building out sector-specific obligations incrementally. Confirming whether Law 25-11's regional audit poles are operationally active, and whether enforcement activity against named controllers has begun to materialise, would be the clearest signals of whether this expanding rulebook is matched by active supervision. 3 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 #### Regulatory Status Algeria's data-protection regime is tightening on paper this cycle: Law No. 25-11 of 24 July 2025 amends Law No. 18-07 to introduce GDPR-style accountability obligations (Data-Protection Impact Assessments, a Data Protection Officer requirement, and records-of-processing duties), and Law No. 18-07's cross-border transfer regime continues to require ANPDP authorisation, with Law No. 25-11 reported to further clarify international-transfer rules. Presidential Decree No. 26-07 (7 January 2026) adds a dedicated cybersecurity-unit structure within public institutions covering money laundering, terrorism financing and fraudulent data use. The ANPDP has enforced the law since August 2023, but no publicly reported enforcement action has surfaced as of early 2026 despite a meaningful statutory penalty regime. #### Outlook The defining open question for Algeria is whether the ANPDP's enforcement vacuum closes now that Law No. 25-11's expanded obligations are in force; commentary assesses this is likely but no confirming enforcement action has yet been reported. Read full brief · 446 words Key regulatory facts for Algeria Regulatory Dimension Algeria Standing Position Jurisdiction Algeria (DZ) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 79 sourced findings) Regulator & Framework Comprehensive omnibus statute exists and regulator is nominally operational, but recency/detail of implementing texts (2025 amendment) and ANPDP's practical enforcement posture could not be fully corroborated from... Lawful Processing & Special Data No sentence-level primary or secondary source content was retrieved describing the specific lawful-basis enumeration, consent threshold, or special-category list; findings rely on regional-pattern inference only. Data Subject Rights No sentence-level source content was retrieved on DZ's specific subject-rights catalogue, deadlines, or portability provision; module populated with inference-based, low-confidence claims and explicit gaps only. Controller/Processor Duties Regulator activity (guidance-issuing) is corroborated; underlying granular statutory obligations (DPIA/DPO/ROPA/breach-notification specifics) are not verified. Primary Instruments Cited DataGuidance (OneTrust), DataGuidance (OneTrust), DataGuidance (OneTrust), Internal (no external corroboration retrieved for this specific claim), algeriatech.news Last Confirmed / Updated 2026-11-04 (38 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Algeria: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Comprehensive omnibus statute exists and regulator is nominally operational, but recency/detail of implementing texts (2025 amendment) and ANPDP's practical enforcement posture could not be fully corroborated from primary sources in this run. Primary framework Law No. 18-07 of 10 June 2018 on the Protection of Individuals in the Processing of Personal Data (as amended, 2025) Supervisory authority Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP) Traffic-light rationale — Amber Comprehensive omnibus statute exists and regulator is nominally operational, but recency/detail of implementing texts (2025 amendment) and ANPDP's practical enforcement posture could not be fully corroborated from primary sources in this run. #### Sub-modules (5) #### Regulator And AuthorityAmber ANPDP is named in secondary reporting as the body issuing compliance reminders and recommendations to controllers, indicating an operational (not merely nominal) regulator. Claims (7): - ANPDP (Autorité Nationale de Protection des Données à Caractère Personnel) is the designated national data-protection supervisory authority for Algeria and has issued compliance reminders and recommendations to controllers. - Law No. 18-07 (2018), as amended by Law No. 25-11, establishes the ANPDP with enforcement powers including fines and authorisation withdrawal. - ANPDP — Enforcing Algeria's data-protection law since August 2023, as an independent administrative authority headquartered in Algiers - Any processing of personal data requires a prior declaration to, or authorisation from, ANPDP (established by Law 18-07, operational since August 2023). - Law 18-07 as amended by Law 25-11 establishes ANPDP with powers of warnings, formal notices, authorisation withdrawal, fines, data-modification/destruction orders - Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP) — Established under Law No. 18-07, operational since August 2022, with publicly published decisions. - ANPDP, established under Law 18-07, fully operational since August 2023 #### Act And InstrumentsAmber Law 18-07 (2018) is the founding instrument; a modifying law was published in the Official Gazette in 2025. Claims (6): - Law No. 18-07 of 10 June 2018 on the Protection of Individuals in the Processing of Personal Data was published in Algeria's Official Gazette and constitutes the founding comprehensive data-protection statute. - A law modifying the 2018 Data Protection Law was published in Algeria's Official Gazette in 2025, indicating an active legislative refinement of the regime. - Law No. 25-11 (2025) — Law 18-07, introducing mandatory DPOs, 5-day breach notification and DPIA obligations. - Law No. 18-07 — Law No. 25-11 of 24 July 2025, described as modernising Algeria's data-protection framework toward GDPR-style accountability, risk-based and governance requirements - Law No. 25-11 — Enacted 24 July 2025, amends Law No. 18-07, introducing mandatory DPO appointment, processing records, DPIAs for high-risk processing, 5-day breach-notification deadline, expanded ANPDP powers and Article 27 bis regional audit/advisory poles. - Law No. 25-11 of July 2025 — Introduces biometric data, profiling, pseudonymisation and personal-data-breach concepts; strengthens controller obligations (processing register, automated audit log) #### Material ScopeAmber The law is understood to cover automated and structured manual processing of personal data by public and private controllers established in Algeria, following the general Francophone-civil-law model; granular scope wording could not be independently retrieved. Claims (1): - Law 18-07 is understood to apply to automated and organised manual processing of personal data carried out by public and private-sector controllers within Algeria, consistent with the general Francophone civil-law data-protection model. #### Territorial ScopeRed No confirmed evidence of an explicit extraterritorial/non-established-controller trigger comparable to GDPR Art 3(2) was retrieved for Law 18-07. Claims (1): - Law No. 18-07 — Extraterritorial reach — international companies collecting data from Algerian users are subject to the law even without physical presence in Algeria #### Regulator Registration And FilingAmber Francophone-model DP statutes of this era typically require prior declaration/authorisation filings with the national authority for certain processing categories; ANPDP's specific filing/registration procedures under 18-07 could not be verified from primary sources in this run. Claims (3): - Algeria's regime is understood to require prior declaration or authorisation from ANPDP for certain categories of processing, following the regional CNIL-style prior-formality model, though the precise thresholds under 18-07 were not independently confirmed in this run. - ANPDP national register — Article 28 of Law 18-07 establishes a national data-protection register recording declared processing files and issued authorisations. - ANPDP authorisation track — Controllers must obtain the ANPDP's written approval for high-risk/cross-border processing before the processing activity begins. Algeria's comprehensive data-protection regime rests on Law No. 18-07 of 10 June 2018 on the Protection of Individuals in the Processing of Personal Data, which created the Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP) as supervisory authority. The law was published in 2018 but its practical entry into force (and ANPDP's operationalisation) was delayed for several years, with sources confirming the law was still pending full effect as of early 2023 and reported as having entered into force in August 2023. A modifying law was published in the Official Gazette in 2025, indicating the regime is still being actively refined. Because primary JORADP full-text and the ANPDP's own confirmed institutional URL could not be independently retrieved in this run (secondary commentary sources were access-restricted at point of research), several structural details rely on established general knowledge of the statute rather than a freshly retrieved primary-source quotation. Periodic update · new data 2026-11-04 #### Regulator & Framework Algeria's data protection regime rests on Law No. 18-07 of 2018, as amended by Law No. 25-11 of 24 July 2025, which establishes the ANPDP as the national data-protection authority. The ANPDP's powers extend to issuing warnings and formal notices, withdrawing processing authorisations, imposing administrative fines, and ordering the modification or destruction of data held in violation of the law. The authority also maintains a national register, provided for under Article 28 of Law 18-07, recording declared processing files and the authorisations it issues. The precise year the ANPDP became operational is reported inconsistently across available sources, and whether the regional audit poles introduced by Law 25-11 are yet operationally active, as opposed to awaiting implementing regulation, has not been confirmed against a primary ANPDP source as at this brief. #### Outlook The framework itself is statutorily settled following the 2025 amendment; the open question for this dimension is institutional rather than legislative, namely whether the expanded regional-pole structure for ANPDP oversight has moved from statute into practical operation. 4 earlier distinct update(s) Periodic update · new data 2026-11-03 #### Regulator & Framework Algeria's data protection authority, the ANPDP, has had its institutional toolkit materially strengthened under Law No. 25-11, which amends the foundational Law No. 18-07. The authority is understood to now hold powers extending to warnings, formal notices, withdrawal of processing authorisation, fines, and orders to modify or destroy data. Law No. 25-11 is also reported to create regional ANPDP poles intended to audit and guide businesses across the country's wilayas, a structural change in how oversight capacity is distributed outside the capital. Whether these regional poles are already operating or remain at an implementation stage has not been confirmed against a primary ANPDP source as at this writing, and that distinction matters for how quickly the expanded institutional reach translates into actual audit activity on the ground. #### Outlook The near-term signal to watch is whether the regional poles move from statutory creation to operational audit activity through the remainder of 2026. Their rollout, if it proceeds as described, would represent a genuine expansion of oversight capacity reaching businesses outside Algiers, rather than a mere paper reorganisation. Periodic update · new data 2026-10-25 #### Regulator & Framework Algeria's data-protection regulator, the ANPDP, was established under Law No. 18-07 and is understood to have become fully operational in August 2023, a gap of several years between the original law's adoption in 2018 and the authority's practical commencement of activity. That institutional baseline was substantially overlaid in July 2025 when Law No. 25-11 modernised the statutory framework, introducing concepts that had not been clearly present in the original 2018 text: biometric data as a defined category, profiling, pseudonymisation and a personal-data-breach concept, alongside strengthened controller obligations including a processing register and an automated audit log. This modernisation brought Algeria's statutory vocabulary substantially closer to the internationally familiar data-protection terminology seen in comparable regimes, while remaining a distinct domestic framework with its own institutional architecture and enforcement mechanics. Since that 2025 modernisation, the ANPDP's visible activity in 2026 has taken the form of specific sector-focused decisions rather than further primary legislative amendment. At least three named decisions were issued across the first half of 2026 addressing recruitment-related health data, video surveillance and biometric workplace-attendance monitoring respectively, each applying the general concepts introduced by Law No. 25-11 to a concrete, recurring processing scenario. This pattern, developing the regime through authority-level deliberation and decision rather than through further statutory amendment, is a meaningful signal about how the ANPDP intends to operate going forward: as an active interpretive and decision-issuing body applying a relatively young statutory framework to the practical processing situations Algerian organisations actually encounter, rather than one awaiting further legislative instruction before acting on specific contexts. A further institutional development concerns the ANPDP's own internal structure: Law No. 25-11 is understood to have created, under an article numbered 27 bis, a mechanism for regional audit poles intended to extend the authority's supervisory reach beyond its central administration toward regulated businesses located outside the capital. Implementing regulations giving practical effect to this regional-poles mechanism had not been located as, meaning the mechanism exists as a statutory creation without a confirmed operational implementation framework. This is a meaningful gap in the framework's practical reach precisely because regional presence would determine how effectively the ANPDP can actually audit and supervise businesses outside its existing central capacity, a capacity constraint that is common among newly established data-protection authorities more broadly but is nonetheless one specific gap in Algeria's regime as it currently stands. The overall picture for Algeria's regulatory framework at this point is one of a statutorily modern but institutionally still-developing regime: the vocabulary and the formal powers available to the ANPDP, including the decision-issuing function demonstrated through the three 2026 decisions discussed elsewhere in this brief, are comparable in structure to more established data-protection regimes, but the authority's practical reach, particularly outside the capital pending the regional audit poles' implementation, and its track record of sustained enforcement activity, remain areas where the framework's maturity is still being established rather than already demonstrated. No primary-source text from the ANPDP's own website or from Algeria's official gazette was directly retrieved in support of these findings; the regulator-and-framework picture presented here rests on secondary compliance commentary describing the ANPDP's operational status, Law No. 25-11's content, and the named 2026 decisions, and that reliance on secondary sourcing should be read as a limit on the precision of specific statutory citations rather than as doubt about the underlying direction of the findings, which are corroborated across multiple independent secondary accounts. #### Outlook The principal institutional development to track is whether implementing regulations for the ANPDP's regional audit poles under article 27 bis are published, plausibly around the final quarter of 2026 on current indications, which would materially extend the authority's practical supervisory reach beyond its central administration. Separately, whether the ANPDP continues to issue sector-specific decisions of the kind seen in the first half of 2026, addressing further processing contexts such as direct marketing, automated decision-making, or additional employment-related scenarios, would confirm that decision-based consolidation, rather than further primary legislative amendment, remains the regime's primary near-term mode of development. Periodic update · new data 2026-10-18 #### Regulator & Framework The Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP) is Algeria's data-protection supervisory authority, established under Law No. 18-07 and operational since August 2022, with its decisions publicly published. Law No. 25-11, enacted on 24 July 2025, substantially amends Law No. 18-07 and introduces mandatory DPO appointment, mandatory processing records, Data Protection Impact Assessments for high-risk processing, a five-day breach-notification deadline, expanded ANPDP powers, and Article 27 bis, which establishes regional audit and advisory poles. The law amends and modernises the original 2018 framework rather than replacing it, retaining Law 18-07 as the base statute while layering a materially more GDPR-aligned accountability structure onto it. The amendment is described as marking a material tightening of Algeria's regime toward GDPR-style accountability, bringing in DPO, processing-records, DPIA and breach-notification obligations that did not previously exist in Algerian law in this form. The underlying primary legal text of Law No. 25-11 has not itself been retrieved from an official Algerian government or ANPDP source; the claims set out here rest on secondary commentary describing the amendment's content and effect. #### Outlook The framework is already in force on its core accountability provisions. The remaining open question is procedural rather than substantive: how Article 27 bis's regional audit and advisory poles will be implemented, which depends on implementing regulations expected through the remainder of 2026. Periodic update · new data 2026-09-28 #### Regulator & Framework Algeria's data protection framework is anchored in Law No. 18-07, with the National Data Protection Authority, ANPDP, operational and understood to be responsible for enforcing the law, advising individuals and entities, receiving declarations and authorising processing, handling complaints and imposing administrative sanctions. This cycle's material development is Law No. 25-11 of 2025, which is understood to reinforce Law 18-07 by introducing mandatory data protection officers, a five-day breach notification requirement and data protection impact assessment obligations, a meaningful strengthening of the accountability architecture controllers must maintain. This reinforcement suggests ANPDP is moving from an institution primarily focused on registration and authorisation toward one exercising a broader accountability-oversight mandate, consistent with the sectoral deliberations and active enforcement inspections observed elsewhere this cycle. The precise operative detail of Law 25-11's provisions rests on academic secondary reporting rather than a directly retrieved statutory text, a gap noted in the underlying research. #### Outlook The framework's trajectory is toward increased institutional activity and codified accountability obligations. The open question for future cycles is whether ANPDP's expanded mandate under Law 25-11 will be matched by published guidance or enforcement decisions that make the DPO, breach-notification and DPIA obligations operationally concrete for controllers. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (18) - [DataGuidance (OneTrust)](https://www.dataguidance.com/news/algeria-anpdp-reminds-companies-obligations-under-law) — ANPDP (Autorité Nationale de Protection des Données à Caractère Personnel) is the designated national data-protection supervisory authority for Algeria and has issued compliance reminders and recommendations to controllers. - [DataGuidance (OneTrust)](https://www.dataguidance.com/news/algeria-data-protection-law-published-official-gazette) — Law No. 18-07 of 10 June 2018 on the Protection of Individuals in the Processing of Personal Data was published in Algeria's Official Gazette and constitutes the founding comprehensive data-protection statute. - [DataGuidance (OneTrust)](https://www.dataguidance.com/news/algeria-law-modifying-data-protection-law-published) — A law modifying the 2018 Data Protection Law was published in Algeria's Official Gazette in 2025, indicating an active legislative refinement of the regime. - Internal (no external corroboration retrieved for this specific claim) — Law 18-07 is understood to apply to automated and organised manual processing of personal data carried out by public and private-sector controllers within Algeria, consistent with the general Francophone civil-law data-protection model. - Internal (no external corroboration retrieved for this specific claim) — Algeria's regime is understood to require prior declaration or authorisation from ANPDP for certain categories of processing, following the regional CNIL-style prior-formality model, though the precise thresholds under 18-07 were not independently confirmed in this run. - [algeriatech.news](https://algeriatech.news/algeria-anpdp-regional-audit-poles-law-25-11-data-oversight-2026/) — Law No. 18-07 (2018), as amended by Law No. 25-11, establishes the ANPDP with enforcement powers including fines and authorisation withdrawal. - [LawLab Africa](https://research.lawlab.africa/algeria/) — ANPDP national register — Article 28 of Law 18-07 establishes a national data-protection register recording declared processing files and issued authorisations. - [algeriatech.news](https://algeriatech.news/algeria-anpdp-cross-border-data-transfer-law-25-11-compliance-2026/) — Law No. 25-11 (2025) — Law 18-07, introducing mandatory DPOs, 5-day breach notification and DPIA obligations. - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=authority&c=DZ) — ANPDP — Enforcing Algeria's data-protection law since August 2023, as an independent administrative authority headquartered in Algiers - [DLA Piper Data Protection Laws of the World](https://www.dlapiperdataprotection.com/index.html?t=law&c=DZ) — Law No. 18-07 — Law No. 25-11 of 24 July 2025, described as modernising Algeria's data-protection framework toward GDPR-style accountability, risk-based and governance requirements - [Algeria Tech News](https://algeriatech.news/data-protection-law-18-07-business-guide/) — Law No. 18-07 — Extraterritorial reach — international companies collecting data from Algerian users are subject to the law even without physical presence in Algeria - [Gide Loyrette Nouel](https://www.gide.com/en/news-insights/protection-of-personal-data-focus-on-algerian-regulations/) — Any processing of personal data requires a prior declaration to, or authorisation from, ANPDP (established by Law 18-07, operational since August 2023). - [algeriatech.news](https://algeriatech.news/algeria-anpdp-regional-audit-poles-law-25-11-data-oversight-2026/) — ANPDP authorisation track — Controllers must obtain the ANPDP's written approval for high-risk/cross-border processing before the processing activity begins. - [algeriatech.news](https://algeriatech.news/algeria-anpdp-regional-audit-poles-law-25-11-data-oversight-2026/) — Law 18-07 as amended by Law 25-11 establishes ANPDP with powers of warnings, formal notices, authorisation withdrawal, fines, data-modification/destruction orders - [CookieYes](https://www.cookieyes.com/blog/algeria-data-protection-law/) — Law No. 25-11 — Enacted 24 July 2025, amends Law No. 18-07, introducing mandatory DPO appointment, processing records, DPIAs for high-risk processing, 5-day breach-notification deadline, expanded ANPDP powers and Article 27 bis regional audit/advisory poles. - [https://research.lawlab.africa/algeria/](https://research.lawlab.africa/algeria/) — Autorité Nationale de Protection des Données à Caractère Personnel (ANPDP) — Established under Law No. 18-07, operational since August 2022, with publicly published decisions. - [Gide Loyrette Nouel](https://www.gide.com/en/news-insights/protection-of-personal-data-focus-on-algerian-regulations/) — ANPDP, established under Law 18-07, fully operational since August 2023 - [Gide Loyrette Nouel](https://www.gide.com/en/news-insights/protection-of-personal-data-focus-on-algerian-regulations/) — Law No. 25-11 of July 2025 — Introduces biometric data, profiling, pseudonymisation and personal-data-breach concepts; strengthens controller obligations (processing register, automated audit log) ### Algeria: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sentence-level primary or secondary source content was retrieved describing the specific lawful-basis enumeration, consent threshold, or special-category list; findings rely on regional-pattern inference only. Primary framework Law No. 18-07 of 10 June 2018 Supervisory authority ANPDP Traffic-light rationale — Red No sentence-level primary or secondary source content was retrieved describing the specific lawful-basis enumeration, consent threshold, or special-category list; findings rely on regional-pattern inference only. Periodic update · new data 2026-11-04 #### Lawful Processing & Special Data Two recent ANPDP actions have tightened the practical lawful-processing surface in Algeria without amending the governing statute. Rules reported as adopted on 15 July 2026 require explicit consent before identifiable photographs or videos containing personal information are collected, stored, retained or published online, extending consent obligations squarely into image-sharing activity. Separately, ANPDP Decision No. 01 of 25 February 2026 classifies negative drug and psychotropic-substance test results obtained during recruitment screening as health data, a special category under the regime, subjecting such results to a declaration obligation and capping their retention at three months. Neither development has been independently re-verified against primary ANPDP text as at this brief, and both should be read as recently adopted sectoral applications of the existing special-category and consent architecture rather than as changes to the underlying statute. #### Outlook The direction of travel is toward more granular, context-specific consent and special-category rules issued by sectoral ANPDP decision rather than by statutory amendment, and further decisions of this kind addressing other common processing contexts should be anticipated. Periodic update · new data 2026-11-03 #### Lawful Processing & Special Data Two discrete developments are understood to have reached the special-category and lawful-basis space this year. A rule dated 15 July 2026 is reported to impose a consent requirement before an identifiable person's image or video may be published online, a measure with evident relevance to social and commercial content practices. Separately, a decision dated 25 February 2026 is reported to classify a negative drug-test result as health data, which if accurate would pull a category of workplace screening information squarely inside the special-data regime rather than treating it as routine personnel data. Neither development has been corroborated against a primary ANPDP text in the material reviewed, and both should be treated as provisional pending that confirmation. #### Outlook The drug-test classification, in particular, is the kind of interpretive extension that could have broader knock-on effects for employment screening practices generally if it is confirmed and applied consistently; it is worth tracking whether ANPDP issues further guidance generalising the principle beyond the single reported decision. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data The ANPDP issued Decision No. 01 on 25 February 2026 addressing a specific and commercially significant processing scenario: the status of negative drug and psychotropic-substance test results obtained by employers for recruitment purposes. The decision classifies these results as health data, bringing them within Algeria's special-category data framework as introduced or clarified under Law No. 25-11, and accordingly subjects their processing to a declaration requirement with the ANPDP. Beyond the special-category classification itself, the decision imposes a specific and operationally concrete constraint: retention of these results is limited to a period of three months. This three-month retention ceiling is a notably precise rule compared to the more general data-minimisation and purpose-limitation principles that typically govern retention under data-protection frameworks of this kind. By specifying an exact retention period for this particular category of recruitment-related health data, the ANPDP has removed a degree of interpretive latitude that employers might otherwise have exercised under a general minimisation principle, replacing it with a bright-line rule that is straightforward to apply and, in principle, straightforward to enforce. The choice of recruitment-stage drug testing as the subject of this specific decision suggests the ANPDP identified this as a recurring processing activity in the Algerian labour market significant enough to warrant dedicated regulatory attention, rather than treating it as adequately covered by the special-category framework's general provisions alone. The decision sits within Algeria's broader lawful-processing architecture, which Law No. 25-11 is understood to have modernised to include concepts such as profiling and pseudonymisation alongside the special-category framework into which the drug-testing decision falls. The decision does not, on the reporting available, address what lawful basis beyond the special-category declaration requirement an employer must additionally establish for the underlying processing, for example whether consent, a legal obligation, or an employment-contract necessity basis is also required alongside the declaration; this is a gap in the available findings rather than a conclusion that no such additional basis is required. No other special-category or lawful-processing decision specific to Algeria was identified beyond the drug-testing decision discussed above. The biometric and video-surveillance decisions issued by the ANPDP in the same period are treated separately under the algorithmic, biometric and surveillance governance heading, reflecting their distinct subject matter even though they share the same underlying statutory framework and the same issuing authority. The drug-testing decision was identified through secondary legal commentary summarising ANPDP decisions rather than through direct retrieval of the ANPDP's own decision text or its publication in the official gazette; this sourcing limitation means the precise wording of the declaration requirement and any exceptions or qualifications the decision text may contain cannot be confirmed at this point. #### Outlook The marker to watch is whether the ANPDP issues further special-category decisions addressing other recurring employment-screening or health-adjacent processing scenarios beyond recruitment-stage drug testing, which would indicate the agency is working systematically through common Algerian employment-sector processing practices rather than having addressed this single scenario in isolation. Retrieval of the primary decision text, whether from the ANPDP's own publications or Algeria's official gazette, would also materially improve confidence in the precise scope of the declaration requirement and the three-month retention rule, including whether any exceptions apply. Periodic update · new data 2026-10-18 #### Lawful Processing & Special Data ANPDP Decision No. 01/2026 classifies the negative results of drug-screening tests requested of candidates during recruitment as health data under Law No. 18-07 as amended by Law No. 25-11, and limits retention of such results to three months. This is a regulator-level interpretive act applying the special-category concept to a specific, previously unaddressed employment scenario, and it signals that the ANPDP is actively extending the special-categories framework to new fact patterns rather than leaving the concept abstract. A related rule allows processing that poses an obvious risk to privacy to proceed for HR-management purposes subject to prior ANPDP authorisation, without requiring the employee's own consent as the legal basis. Retention under this companion rule is tied to the duration of the employment relationship, except where the narrower three-month limit for health data specifically applies, as it does to the drug-screening results addressed in Decision No. 01/2026. Taken together, these two findings describe an emerging regulatory position on employment-context special-category data: consent is not the operative basis for high-risk HR processing in Algeria, and regulator authorisation functions as the substitute safeguard, paired with retention limits that vary depending on the sensitivity of the specific data category involved. #### Outlook Employers conducting recruitment or employment screening that touches special-category data, including health-adjacent results such as drug-screening, should expect the three-month retention ceiling applied in Decision No. 01/2026 to serve as a reference point for how the ANPDP treats comparable categories of employment data going forward. D2 · Lawful Processing — Full Module Record 4 sub-modules · 68 words · 9 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Algeria: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No sentence-level source content was retrieved on DZ's specific subject-rights catalogue, deadlines, or portability provision; module populated with inference-based, low-confidence claims and explicit gaps only. Primary framework Law No. 18-07 of 10 June 2018 Supervisory authority ANPDP Traffic-light rationale — Red No sentence-level source content was retrieved on DZ's specific subject-rights catalogue, deadlines, or portability provision; module populated with inference-based, low-confidence claims and explicit gaps only. #### Sub-modules (5) #### Access RightAmber Believed to exist in some form (droit d'accès) consistent with the regional model; not independently verified. Claims (1): - Individuals are expected to hold a right of access to personal data held about them under Law 18-07, consistent with the regional Francophone data-protection model, though the specific statutory mechanics were not independently verified in this run. #### Rectification And ErasureAmber Rectification likely present; a full GDPR-style erasure/'right to be forgotten' is uncertain for this statutory generation. Claims (2): - A right to rectify inaccurate personal data is expected under Law 18-07 consistent with the regional statutory model; the presence and scope of an erasure/right-to-be-forgotten equivalent could not be independently confirmed in this run. - Algeria data subject rights catalogue — Unlike GDPR, Law 18-07 (as amended by Law 25-11) contains no explicit right to erasure and no right to data portability; codified rights are information, access, rectification, objection, and a right against automated decision-making. #### Restriction And ObjectionRed A right of objection (droit d'opposition) is plausible by regional pattern; not independently verified for DZ. #### Data PortabilityRed No evidence retrieved that Law 18-07 contains a GDPR Art 20-style data-portability right; this is treated as a likely gap pending primary-text confirmation. #### Deadlines And Response WindowsRed No statutory response-deadline figures for DZ subject-access or rectification requests were retrieved in this run. Francophone-model statutes of this generation (which appear to have shaped 18-07) typically grant rights of access, rectification, and objection; an explicit GDPR-style erasure/portability right is less consistently present in this legislative family. No primary-source confirmation of DZ's specific rights catalogue or response-deadline windows was retrieved in this run. Sources and claims (3) - Internal (no external corroboration retrieved for this specific claim) — Individuals are expected to hold a right of access to personal data held about them under Law 18-07, consistent with the regional Francophone data-protection model, though the specific statutory mechanics were not independently verified in this run. - Internal (no external corroboration retrieved for this specific claim) — A right to rectify inaccurate personal data is expected under Law 18-07 consistent with the regional statutory model; the presence and scope of an erasure/right-to-be-forgotten equivalent could not be independently confirmed in this run. - [Cookie-Script](https://cookie-script.com/privacy-laws/algeria-data-protection-law-18-07-and-amendments) — Algeria data subject rights catalogue — Unlike GDPR, Law 18-07 (as amended by Law 25-11) contains no explicit right to erasure and no right to data portability; codified rights are information, access, rectification, objection, and a right against automated decision-making. ### Algeria: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Regulator activity (guidance-issuing) is corroborated; underlying granular statutory obligations (DPIA/DPO/ROPA/breach-notification specifics) are not verified. Primary framework Law No. 18-07 of 10 June 2018 Supervisory authority ANPDP Traffic-light rationale — Amber Regulator activity (guidance-issuing) is corroborated; underlying granular statutory obligations (DPIA/DPO/ROPA/breach-notification specifics) are not verified. Periodic update · new data 2026-11-04 #### Controller/Processor Duties Law No. 25-11 is reported to have introduced three duties of note for controllers and processors: a mandatory Data Protection Officer requirement for organisations processing sensitive data or processing at large scale; a breach-notification duty requiring notice to the ANPDP within five days of discovery; and a Data Protection Impact Assessment requirement for high-risk processing. These duties date to the 2025 amendment and their practical enforcement maturity has not been independently verified as at this brief. Alongside the statutory duties, ANPDP Decision No. 02 of 4 March 2026 regulates workplace video surveillance specifically, requiring a prior declaration to the authority, restricting the purpose of such systems to the security of persons and property, and imposing transparency and security obligations on the controller operating the system. #### Outlook The combination of newly codified statutory duties (DPO, breach notification, DPIA) and a sector-specific decision on workplace surveillance points to an expanding compliance surface for controllers; confirmation of how the ANPDP is supervising the statutory duties in practice would clarify how far this expansion has moved from paper obligation into active oversight. Periodic update · new data 2026-11-03 #### Controller/Processor Duties Law No. 25-11 is reported to introduce a mandatory Data Protection Officer requirement for organisations that process sensitive data or process personal data at large scale, with the officer serving as the designated point of contact for the ANPDP. The same amending law is understood to carry a five-day breach notification obligation owed to the ANPDP and a data protection impact assessment requirement for high-risk processing, though the breach-notification figure is currently sourced to a single compliance-vendor characterisation rather than a primary legal text. A separate decision dated 4 March 2026 is reported to address workplace video surveillance, adding a further sector-specific duty on employers operating camera systems. Taken together, these developments move Algeria's controller obligations meaningfully closer to a structured compliance-programme model, though the DPO mandate itself is currently carried at a lower confidence than the other duties given the limited sourcing behind it. #### Outlook Confirmation of the exact breach-notification window and the precise scope of the DPO trigger (what counts as "large scale" processing) against a primary legal text would materially firm up the compliance picture; until then, organisations operating in Algeria are working from secondary characterisations of these duties rather than settled primary text. Periodic update · new data 2026-10-18 #### Controller/Processor Duties Law No. 25-11 introduces a cluster of new accountability duties that did not previously exist under Algeria's data-protection framework. DPO appointment is now mandatory for organisations conducting significant or high-risk processing; the DPO appointed must be independent, must have direct access to organisational leadership, must serve as the primary point of contact for the ANPDP, and the DPO's contact details must be communicated to the ANPDP directly. A Data Protection Impact Assessment is required for any new processing activity, or any existing processing activity undergoing significant change, that presents a high risk to individuals' rights. This DPIA duty sits alongside the DPO requirement as part of the same accountability package introduced by Law No. 25-11, and both obligations are already in force. The breach-notification duty is the most heavily weighted of the new obligations in terms of consequence: organisations must notify the ANPDP of a personal-data breach within five days of becoming aware of it, and must also notify the individuals affected by that breach. Failure to meet the five-day deadline is punishable by imprisonment and a fine, meaning this is not simply an administrative filing requirement but one that carries criminal exposure for non-compliance. #### Outlook All three obligations described here - DPO appointment, DPIA, and five-day breach notification - are already in force following Law No. 25-11's 24 July 2025 enactment. Organisations operating in Algeria that carry out significant or high-risk processing are already subject to this accountability architecture; there is no transition period or phase-in described in the available record. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Algeria's controller-duty regime tightened materially through the ANPDP's 2025-2026 implementing wave. On 24 December 2025 the authority published its first deliberation fixing the conditions, missions and operating modalities for designating a Data Protection Officer. Under Law n°25-11, DPO appointment moved from a recommendation to a mandatory obligation, and organisations are required to communicate their DPO's contact details to the ANPDP. A second deliberation, dated 4 March 2026, addresses workplace video-surveillance specifically. It requires employers to make a prior declaration to the ANPDP before installing a video-surveillance system, prohibits connecting such systems to the internet, and prohibits the installation of cameras in high-privacy areas, naming toilets and changing rooms as examples. Law n°25-11 of 24 July 2025 is also understood to impose a short breach-notification deadline: controllers must notify the ANPDP within five days of becoming aware of a personal data breach, and must separately notify the individuals affected. #### Outlook These three measures, taken together, move Algeria's controller-duty regime from a largely statutory baseline toward an actively supervised one, with concrete appointment, declaration and notification deadlines now attached to the general obligations in Law n°18-07 as amended. Organisations operating workplace surveillance or holding personal data at scale face a materially more prescriptive compliance surface than existed before the July 2025 amendment. Periodic update · new data 2026-09-28 #### Controller/Processor Duties Law No. 25-11 is understood to codify mandatory data protection officer appointments, a five-day breach notification obligation and mandatory data protection impact assessments for controllers, a material addition to the duties previously established under Law 18-07. Read alongside ANPDP's sectoral deliberations, such as the biometric-monitoring authorisation and the special-category health-data classification, controllers now face a more codified and more actively supervised set of operational obligations than the earlier framework implied. The five-day breach notification window in particular is a specific, dated obligation that controllers must build into incident-response processes, and its introduction alongside DPO and DPIA requirements suggests ANPDP is building out a fuller accountability regime rather than relying solely on its pre-existing declaration and authorisation powers. #### Outlook The extent to which ANPDP issues implementing guidance operationalising the DPO, DPIA and breach-notification duties, for example through model DPIA templates or DPO-qualification criteria, is the key item to watch in coming cycles. D4 · Controller & Processor — Full Module Record 7 sub-modules · 68 words · 15 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Algeria: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Underlying transfer-mechanism statutory detail is unverified (red-level gap), but the AML high-risk designation is a corroborated, materially relevant cross-border data-flow risk factor (amber). Primary framework Law No. 18-07 of 10 June 2018 Supervisory authority ANPDP Traffic-light rationale — Amber Underlying transfer-mechanism statutory detail is unverified (red-level gap), but the AML high-risk designation is a corroborated, materially relevant cross-border data-flow risk factor (amber). Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy Algeria's cross-border transfer regime remains authorisation-based rather than adequacy-based: controllers are understood to require ANPDP's prior written authorisation for high-risk or cross-border processing before the activity may begin, and initiating processing ahead of that authorisation is itself understood to constitute a violation. No adequacy country list has been published, meaning there is no mechanism by which a controller could rely on a pre-cleared destination country instead of seeking case-by-case authorisation, and no SCC- or BCR-equivalent instrument has been identified as an alternative pathway. This cycle's most significant development is the signal that Law 25-11 has already triggered active ANPDP field inspections of private-sector technology companies for cross-border transfer non-compliance, with a 2026 enforcement calendar reported to be targeting medium-sized technology operators with international data dependencies, including SaaS companies and fintech platforms handling payment data. This is held at a more cautious confidence than the authorisation-regime finding itself, since it rests on a single secondary source. #### Outlook Whether ANPDP's inspection campaign converts into a published enforcement decision is the central item to watch, since it would be the first public test of how the case-by-case authorisation requirement is being enforced in practice against technology and fintech operators with cross-border data dependencies. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 98 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Algeria: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector overlay is materially corroborated (AML high-risk designation); other sectoral sub-modules are unverified gaps. Primary framework Law No. 18-07 of 10 June 2018; EU AML high-risk list (external, DZ-referencing) Supervisory authority ANPDP Traffic-light rationale — Amber Financial-sector overlay is materially corroborated (AML high-risk designation); other sectoral sub-modules are unverified gaps. Periodic update · new data 2026-09-28 #### Sectoral Watch ANPDP Deliberation No. 03 of 6 May 2026 is understood to authorise biometric workplace attendance-monitoring systems, subject to prior ANPDP authorisation and security and confidentiality obligations. Notably, employee consent is not required for this processing; instead the authorisation and security safeguards imposed directly on the controller serve as the lawful basis, with data retention limited to the duration of the employment relationship. This is the first workplace-biometrics-specific ANPDP deliberation captured this cycle and gives employers a concrete authorised pathway for what might otherwise be a contested processing activity given the sensitivity of biometric data. The combination of no-consent-required processing alongside a mandatory prior-authorisation and security-obligation structure reflects a regulatory model where ANPDP retains direct oversight of higher-risk processing categories rather than relying on individual consent as the primary safeguard. #### Outlook Whether ANPDP extends comparable sector-specific deliberations to other biometric use cases, such as customer-facing biometric authentication in banking or telecoms, is the item to watch. No such extension was identified this cycle. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 88 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Algeria: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sourced content located for any adtech/commercial-privacy sub-module specific to Algeria. Supervisory authority ANPDP Traffic-light rationale — Red No sourced content located for any adtech/commercial-privacy sub-module specific to Algeria. Periodic update · new data 2026-11-03 #### AdTech & Commercial Privacy No dedicated adtech-specific rule has surfaced in the material reviewed. The closest adjacent development is the 15 July 2026 consent requirement for publishing an identifiable person's photo or video online, which touches commercial content and social-platform practices even though it is not framed as an advertising-targeting rule as such. Its practical reach into influencer marketing, user-generated content moderation, or programmatic advertising use of identifiable imagery has not been separately addressed in the sources available. #### Outlook Whether ANPDP extends this consent principle explicitly into advertising or audience-targeting contexts, rather than leaving it as a general publication rule, is the development worth watching for commercial operators relying on identifiable imagery in marketing content. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 43 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Algeria: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sourced content located for algorithmic/biometric/surveillance-governance sub-modules specific to Algeria. Supervisory authority ANPDP Traffic-light rationale — Red No sourced content located for algorithmic/biometric/surveillance-governance sub-modules specific to Algeria. Periodic update · new data 2026-11-04 #### Algorithmic, Biometric & Surveillance Governance ANPDP Decision No. 03 of 6 May 2026 regulates the use of biometric systems for monitoring workplace attendance, placing a sector-specific constraint on biometric processing in the employment context. This sits alongside the authority's separate regulation of workplace video surveillance, and together the two decisions show the ANPDP addressing biometric and surveillance processing in the workplace through discrete sectoral decisions rather than a single consolidated biometric-governance instrument. As with the authority's other 2026 decisions noted elsewhere, this one has not been independently re-verified against primary ANPDP text as at this brief. #### Outlook The ANPDP's workplace-focused biometric and surveillance decisions suggest attendance-monitoring and access-control biometric systems are an active area of sectoral attention, and further decisions addressing other biometric use cases should be anticipated. Periodic update · new data 2026-11-03 #### Algorithmic, Biometric & Surveillance Governance ANPDP Decision No. 03, dated 6 May 2026, is reported to regulate the use of biometric systems for monitoring workplace attendance, placing a specific governance layer over an increasingly common employee-monitoring technology. This sits alongside the separately reported 4 March 2026 decision addressing workplace video surveillance, together suggesting a pattern of sector-specific attention to employer monitoring technologies rather than a single omnibus biometric or surveillance statute. Neither decision has been checked against a primary ANPDP publication in the material available, so the precise scope and compliance obligations each imposes remain to be firmed up. #### Outlook The pairing of a biometric-attendance decision with a video-surveillance decision within months of each other points to workplace monitoring technology as an active area of ANPDP attention; further sector-specific decisions addressing other monitoring technologies (such as productivity-tracking software) would be a natural next step to watch for. Periodic update · new data 2026-10-25 #### Algorithmic, Biometric & Surveillance Governance Two ANPDP decisions issued within a ten-week window in the first half of 2026 together map out a developing Algerian approach to biometric and surveillance processing. Decision No. 02 of 4 March 2026 addresses video surveillance, imposing strict regulation that requires prior declaration to the ANPDP before deployment, restricts the permissible purpose of video-surveillance processing to the security of persons and property, and layers on transparency and security obligations for operators of such systems. Decision No. 03 of 6 May 2026 addresses a narrower and more specific use case, biometric systems deployed for workplace attendance monitoring, and permits such systems for human-resources purposes under declared conditions. Read together, these two decisions reveal a differentiated regulatory posture depending on the specific surveillance or biometric technology and its purpose, rather than a single blanket rule applied uniformly across all surveillance-adjacent processing. Video surveillance is treated with a notably restrictive purpose limitation, confined to security of persons and property and excluding, by clear implication, broader uses such as general behavioural monitoring or productivity tracking through camera systems. Biometric attendance monitoring, by contrast, is treated as permissible for its stated human-resources purpose provided the declared-conditions requirement is satisfied, a more permissive posture for this particular biometric use case than the video-surveillance decision's purpose restriction would suggest applies to surveillance technology generally. This differentiation is itself informative: it indicates the ANPDP is evaluating biometric and surveillance processing technology by specific use case and purpose rather than applying a single risk category to all technologies that might be loosely grouped as "biometric" or "surveillance" in nature. Neither decision, on the reporting available, establishes a general statutory test for automated decision-making or profiling of the kind found in more developed data-protection regimes elsewhere; Law No. 25-11 is understood to have introduced profiling as a defined concept, but no ANPDP decision specifically addressing an automated-decision-making scenario, as distinct from the biometric and surveillance decisions discussed here, was identified. This is a gap in current understanding of how Algeria's profiling concept operates in practice, rather than evidence that no such test exists. Both decisions were identified through secondary legal commentary describing ANPDP decision content rather than through direct retrieval of the decisions' own texts or their publication record, and the specific wording of the declaration requirements, the full list of permitted purposes under the video-surveillance decision, and the exact conditions attached to biometric attendance systems under the Decision No. 03 framework cannot be confirmed with precision on the sourcing available. #### Outlook The marker to watch is whether the ANPDP issues a further decision specifically addressing automated decision-making or profiling as distinct concepts from the biometric and surveillance decisions already issued, which would clarify how Law No. 25-11's profiling concept is actually being applied in enforcement practice. Separately, continued issuance of further sector-specific biometric or surveillance decisions, following the pattern set by the video-surveillance and attendance-monitoring decisions, would confirm that differentiated, use-case-specific regulation is the ANPDP's settled approach to this category of processing rather than a feature of these two particular decisions alone. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 45 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Algeria: D9 Children & Vulnerable Groups 5 sub-modules Not assessed ▾ No sourced content located for any children/vulnerable-groups sub-module specific to Algeria. Supervisory authority ANPDP Traffic-light rationale — Not assessed No sourced content located for any children/vulnerable-groups sub-module specific to Algeria. #### Sub-modules (5) #### Age VerificationRed No DZ-specific age-of-consent or age-verification rule located. #### Parental ConsentRed No DZ-specific parental-consent mechanism located. #### Minor Profiling BansRed No DZ-specific minor-profiling ban located. #### Education SettingsRed No DZ-specific education-settings DP rule located. #### Dependent AdultsRed No DZ-specific dependent-adult protection rule located. No Algeria-specific provisions on age of consent for data processing, parental-consent mechanisms, minor-profiling bans, education-setting-specific rules, or dependent-adult protections were independently verified in this run. ### Algeria: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Regulator operational activity is corroborated (amber); granular penalty/funding/redress-mechanism details remain unverified (would otherwise be red). Primary framework Law No. 18-07 of 10 June 2018 Supervisory authority ANPDP Traffic-light rationale — Amber Regulator operational activity is corroborated (amber); granular penalty/funding/redress-mechanism details remain unverified (would otherwise be red). Periodic update · new data 2026-11-03 #### Enforcement & Redress Algeria's statutory penalty architecture for data protection breaches is detailed and criminal in character, with penalties reported to reach up to five years' imprisonment for the most serious offences, within a tiered structure that is said to range from two months to five years' imprisonment and fines of 20,000 to 500,000 dinars depending on the nature of the violation, covering conduct such as refusing to honour a data subject's rights, disclosing sensitive data without authorisation, accessing a protected register without authorisation, or obstructing an ANPDP action. Against that statutory severity, one secondary source characterises the enforcement record as thin, stating that as of early 2026 no enforcement actions against named controllers had been publicly reported. That characterisation is itself dated to early 2026 and has not been refreshed since, so it describes a past state of the enforcement record rather than necessarily today's. #### Outlook The gap between a criminally severe penalty framework on the statute books and an apparently thin public enforcement record is the central tension to track in this area. A first publicly reported ANPDP enforcement decision against a named controller would be a significant marker of the regime moving from statutory design into practical application. Periodic update · new data 2026-10-18 #### Enforcement & Redress The ANPDP holds a graduated set of administrative sanction powers: it may issue a warning, issue a formal notice, impose a provisional withdrawal of authorisation for up to one year, or impose a definitive withdrawal of authorisation. Separately from this administrative ladder, failure to notify a personal-data breach within the five-day deadline introduced by Law No. 25-11 is itself a criminal offence, punishable by imprisonment and a fine, giving the ANPDP's enforcement reach both an administrative and a criminal dimension. Article 27 bis of Law No. 25-11 establishes regional audit and advisory poles, intended to bring ANPDP oversight capacity closer to Algeria's wilayas rather than concentrating it centrally. Implementing regulations defining how these regional poles will actually function are expected throughout 2026; in the meantime, the core DPO, processing-records, DPIA and breach-notification obligations that these poles will presumably help enforce are already in force and enforceable through the ANPDP's existing central powers. #### Outlook The implementing regulations for Article 27 bis's regional audit and advisory poles, expected through the remainder of 2026, are the development to track. Until they are issued, enforcement of Law No. 25-11's accountability obligations continues through the ANPDP's existing central administrative and criminal sanction powers rather than through any regionalised structure. Periodic update · new data 2026-10-11 #### Enforcement & Redress The same 15 July 2026 deliberation on photo and video publication establishes a dedicated electronic complaint channel through which individuals whose images were processed or published unlawfully can bring a complaint to the ANPDP, without prejudice to their ability to pursue the matter through the courts. This gives individuals a specific administrative route for the photo/video publication issue addressed by the same deliberation, running alongside, rather than replacing, access to judicial remedies. #### Outlook The new complaint channel is likely to be the practical entry point through which the ANPDP's cross-border-transfer interpretation of foreign-hosted photo and video publication gets tested in individual cases, giving affected individuals a lower-friction route to raise a complaint than litigation alone. Periodic update · new data 2026-09-28 #### Enforcement & Redress ANPDP's administrative sanction powers are understood to include warnings, formal notices, and provisional or definitive withdrawal of authorisations, alongside fines from 20,000 to 1,000,000 dinars. Criminal sanctions of two months to five years imprisonment apply for serious violations, and Law No. 25-11 is understood to raise this ceiling further, to up to ten years imprisonment and 10,000,000 dinars for the most serious violations, a substantial strengthening of the statutory penalty architecture. Despite this strengthened framework, as of early 2026 no publicly reported enforcement action by ANPDP had been identified, meaning the higher penalty ceiling introduced by Law 25-11 has not yet been tested through a published decision. This cycle does report, with more cautious confidence given its reliance on a single source, that Law 25-11 has already triggered active ANPDP field inspections of private-sector technology companies for cross-border transfer non-compliance, with a 2026 enforcement calendar reportedly targeting medium-sized technology operators with international data dependencies. #### Outlook The central item to watch is whether ANPDP's active 2026 inspection campaign produces a first published enforcement decision, which would test the strengthened Law 25-11 penalty ceiling in practice and provide the first concrete precedent for how the authorisation-based cross-border transfer regime is enforced. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 83 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties