Algeria Data Protection & Privacy Regulation

Lawful Processing & Special Data

Two recent ANPDP actions have tightened the practical lawful-processing surface in Algeria without amending the governing statute. Rules reported as adopted on 15 July 2026 require explicit consent before identifiable photographs or videos containing personal information are collected, stored, retained or published online, extending consent obligations squarely into image-sharing activity. Separately, ANPDP Decision No. 01 of 25 February 2026 classifies negative drug and psychotropic-substance test results obtained during recruitment screening as health data, a special category under the regime, subjecting such results to a declaration obligation and capping their retention at three months. Neither development has been independently re-verified against primary ANPDP text as at this brief, and both should be read as recently adopted sectoral applications of the existing special-category and consent architecture rather than as changes to the underlying statute.

Outlook

The direction of travel is toward more granular, context-specific consent and special-category rules issued by sectoral ANPDP decision rather than by statutory amendment, and further decisions of this kind addressing other common processing contexts should be anticipated.

Lawful Processing & Special Data

Two discrete developments are understood to have reached the special-category and lawful-basis space this year. A rule dated 15 July 2026 is reported to impose a consent requirement before an identifiable person's image or video may be published online, a measure with evident relevance to social and commercial content practices. Separately, a decision dated 25 February 2026 is reported to classify a negative drug-test result as health data, which if accurate would pull a category of workplace screening information squarely inside the special-data regime rather than treating it as routine personnel data. Neither development has been corroborated against a primary ANPDP text in the material reviewed, and both should be treated as provisional pending that confirmation.

Outlook

The drug-test classification, in particular, is the kind of interpretive extension that could have broader knock-on effects for employment screening practices generally if it is confirmed and applied consistently; it is worth tracking whether ANPDP issues further guidance generalising the principle beyond the single reported decision.

Lawful Processing & Special Data

The ANPDP issued Decision No. 01 on 25 February 2026 addressing a specific and commercially significant processing scenario: the status of negative drug and psychotropic-substance test results obtained by employers for recruitment purposes. The decision classifies these results as health data, bringing them within Algeria's special-category data framework as introduced or clarified under Law No. 25-11, and accordingly subjects their processing to a declaration requirement with the ANPDP. Beyond the special-category classification itself, the decision imposes a specific and operationally concrete constraint: retention of these results is limited to a period of three months.

This three-month retention ceiling is a notably precise rule compared to the more general data-minimisation and purpose-limitation principles that typically govern retention under data-protection frameworks of this kind. By specifying an exact retention period for this particular category of recruitment-related health data, the ANPDP has removed a degree of interpretive latitude that employers might otherwise have exercised under a general minimisation principle, replacing it with a bright-line rule that is straightforward to apply and, in principle, straightforward to enforce. The choice of recruitment-stage drug testing as the subject of this specific decision suggests the ANPDP identified this as a recurring processing activity in the Algerian labour market significant enough to warrant dedicated regulatory attention, rather than treating it as adequately covered by the special-category framework's general provisions alone.

The decision sits within Algeria's broader lawful-processing architecture, which Law No. 25-11 is understood to have modernised to include concepts such as profiling and pseudonymisation alongside the special-category framework into which the drug-testing decision falls. The decision does not, on the reporting available, address what lawful basis beyond the special-category declaration requirement an employer must additionally establish for the underlying processing, for example whether consent, a legal obligation, or an employment-contract necessity basis is also required alongside the declaration; this is a gap in the available findings rather than a conclusion that no such additional basis is required.

No other special-category or lawful-processing decision specific to Algeria was identified beyond the drug-testing decision discussed above. The biometric and video-surveillance decisions issued by the ANPDP in the same period are treated separately under the algorithmic, biometric and surveillance governance heading, reflecting their distinct subject matter even though they share the same underlying statutory framework and the same issuing authority.

The drug-testing decision was identified through secondary legal commentary summarising ANPDP decisions rather than through direct retrieval of the ANPDP's own decision text or its publication in the official gazette; this sourcing limitation means the precise wording of the declaration requirement and any exceptions or qualifications the decision text may contain cannot be confirmed at this point.

Outlook

The marker to watch is whether the ANPDP issues further special-category decisions addressing other recurring employment-screening or health-adjacent processing scenarios beyond recruitment-stage drug testing, which would indicate the agency is working systematically through common Algerian employment-sector processing practices rather than having addressed this single scenario in isolation. Retrieval of the primary decision text, whether from the ANPDP's own publications or Algeria's official gazette, would also materially improve confidence in the precise scope of the declaration requirement and the three-month retention rule, including whether any exceptions apply.

Lawful Processing & Special Data

ANPDP Decision No. 01/2026 classifies the negative results of drug-screening tests requested of candidates during recruitment as health data under Law No. 18-07 as amended by Law No. 25-11, and limits retention of such results to three months. This is a regulator-level interpretive act applying the special-category concept to a specific, previously unaddressed employment scenario, and it signals that the ANPDP is actively extending the special-categories framework to new fact patterns rather than leaving the concept abstract.

A related rule allows processing that poses an obvious risk to privacy to proceed for HR-management purposes subject to prior ANPDP authorisation, without requiring the employee's own consent as the legal basis. Retention under this companion rule is tied to the duration of the employment relationship, except where the narrower three-month limit for health data specifically applies, as it does to the drug-screening results addressed in Decision No. 01/2026.

Taken together, these two findings describe an emerging regulatory position on employment-context special-category data: consent is not the operative basis for high-risk HR processing in Algeria, and regulator authorisation functions as the substitute safeguard, paired with retention limits that vary depending on the sensitivity of the specific data category involved.

Outlook

Employers conducting recruitment or employment screening that touches special-category data, including health-adjacent results such as drug-screening, should expect the three-month retention ceiling applied in Decision No. 01/2026 to serve as a reference point for how the ANPDP treats comparable categories of employment data going forward.

Controller/Processor Duties

Law No. 25-11 is reported to have introduced three duties of note for controllers and processors: a mandatory Data Protection Officer requirement for organisations processing sensitive data or processing at large scale; a breach-notification duty requiring notice to the ANPDP within five days of discovery; and a Data Protection Impact Assessment requirement for high-risk processing. These duties date to the 2025 amendment and their practical enforcement maturity has not been independently verified as at this brief. Alongside the statutory duties, ANPDP Decision No. 02 of 4 March 2026 regulates workplace video surveillance specifically, requiring a prior declaration to the authority, restricting the purpose of such systems to the security of persons and property, and imposing transparency and security obligations on the controller operating the system.

Outlook

The combination of newly codified statutory duties (DPO, breach notification, DPIA) and a sector-specific decision on workplace surveillance points to an expanding compliance surface for controllers; confirmation of how the ANPDP is supervising the statutory duties in practice would clarify how far this expansion has moved from paper obligation into active oversight.

Controller/Processor Duties

Law No. 25-11 is reported to introduce a mandatory Data Protection Officer requirement for organisations that process sensitive data or process personal data at large scale, with the officer serving as the designated point of contact for the ANPDP. The same amending law is understood to carry a five-day breach notification obligation owed to the ANPDP and a data protection impact assessment requirement for high-risk processing, though the breach-notification figure is currently sourced to a single compliance-vendor characterisation rather than a primary legal text. A separate decision dated 4 March 2026 is reported to address workplace video surveillance, adding a further sector-specific duty on employers operating camera systems. Taken together, these developments move Algeria's controller obligations meaningfully closer to a structured compliance-programme model, though the DPO mandate itself is currently carried at a lower confidence than the other duties given the limited sourcing behind it.

Outlook

Confirmation of the exact breach-notification window and the precise scope of the DPO trigger (what counts as "large scale" processing) against a primary legal text would materially firm up the compliance picture; until then, organisations operating in Algeria are working from secondary characterisations of these duties rather than settled primary text.

Controller/Processor Duties

Law No. 25-11 introduces a cluster of new accountability duties that did not previously exist under Algeria's data-protection framework. DPO appointment is now mandatory for organisations conducting significant or high-risk processing; the DPO appointed must be independent, must have direct access to organisational leadership, must serve as the primary point of contact for the ANPDP, and the DPO's contact details must be communicated to the ANPDP directly.

A Data Protection Impact Assessment is required for any new processing activity, or any existing processing activity undergoing significant change, that presents a high risk to individuals' rights. This DPIA duty sits alongside the DPO requirement as part of the same accountability package introduced by Law No. 25-11, and both obligations are already in force.

The breach-notification duty is the most heavily weighted of the new obligations in terms of consequence: organisations must notify the ANPDP of a personal-data breach within five days of becoming aware of it, and must also notify the individuals affected by that breach. Failure to meet the five-day deadline is punishable by imprisonment and a fine, meaning this is not simply an administrative filing requirement but one that carries criminal exposure for non-compliance.

Outlook

All three obligations described here - DPO appointment, DPIA, and five-day breach notification - are already in force following Law No. 25-11's 24 July 2025 enactment. Organisations operating in Algeria that carry out significant or high-risk processing are already subject to this accountability architecture; there is no transition period or phase-in described in the available record.

Controller/Processor Duties

Algeria's controller-duty regime tightened materially through the ANPDP's 2025-2026 implementing wave. On 24 December 2025 the authority published its first deliberation fixing the conditions, missions and operating modalities for designating a Data Protection Officer. Under Law n°25-11, DPO appointment moved from a recommendation to a mandatory obligation, and organisations are required to communicate their DPO's contact details to the ANPDP.

A second deliberation, dated 4 March 2026, addresses workplace video-surveillance specifically. It requires employers to make a prior declaration to the ANPDP before installing a video-surveillance system, prohibits connecting such systems to the internet, and prohibits the installation of cameras in high-privacy areas, naming toilets and changing rooms as examples.

Law n°25-11 of 24 July 2025 is also understood to impose a short breach-notification deadline: controllers must notify the ANPDP within five days of becoming aware of a personal data breach, and must separately notify the individuals affected.

Outlook

These three measures, taken together, move Algeria's controller-duty regime from a largely statutory baseline toward an actively supervised one, with concrete appointment, declaration and notification deadlines now attached to the general obligations in Law n°18-07 as amended. Organisations operating workplace surveillance or holding personal data at scale face a materially more prescriptive compliance surface than existed before the July 2025 amendment.

Controller/Processor Duties

Law No. 25-11 is understood to codify mandatory data protection officer appointments, a five-day breach notification obligation and mandatory data protection impact assessments for controllers, a material addition to the duties previously established under Law 18-07. Read alongside ANPDP's sectoral deliberations, such as the biometric-monitoring authorisation and the special-category health-data classification, controllers now face a more codified and more actively supervised set of operational obligations than the earlier framework implied.

The five-day breach notification window in particular is a specific, dated obligation that controllers must build into incident-response processes, and its introduction alongside DPO and DPIA requirements suggests ANPDP is building out a fuller accountability regime rather than relying solely on its pre-existing declaration and authorisation powers.

Outlook

The extent to which ANPDP issues implementing guidance operationalising the DPO, DPIA and breach-notification duties, for example through model DPIA templates or DPO-qualification criteria, is the key item to watch in coming cycles.

Cross-Border & Adequacy

Algeria's cross-border transfer regime remains authorisation-based rather than adequacy-based: controllers are understood to require ANPDP's prior written authorisation for high-risk or cross-border processing before the activity may begin, and initiating processing ahead of that authorisation is itself understood to constitute a violation. No adequacy country list has been published, meaning there is no mechanism by which a controller could rely on a pre-cleared destination country instead of seeking case-by-case authorisation, and no SCC- or BCR-equivalent instrument has been identified as an alternative pathway.

This cycle's most significant development is the signal that Law 25-11 has already triggered active ANPDP field inspections of private-sector technology companies for cross-border transfer non-compliance, with a 2026 enforcement calendar reported to be targeting medium-sized technology operators with international data dependencies, including SaaS companies and fintech platforms handling payment data. This is held at a more cautious confidence than the authorisation-regime finding itself, since it rests on a single secondary source.

Outlook

Whether ANPDP's inspection campaign converts into a published enforcement decision is the central item to watch, since it would be the first public test of how the case-by-case authorisation requirement is being enforced in practice against technology and fintech operators with cross-border data dependencies.

Sectoral Watch

ANPDP Deliberation No. 03 of 6 May 2026 is understood to authorise biometric workplace attendance-monitoring systems, subject to prior ANPDP authorisation and security and confidentiality obligations. Notably, employee consent is not required for this processing; instead the authorisation and security safeguards imposed directly on the controller serve as the lawful basis, with data retention limited to the duration of the employment relationship. This is the first workplace-biometrics-specific ANPDP deliberation captured this cycle and gives employers a concrete authorised pathway for what might otherwise be a contested processing activity given the sensitivity of biometric data.

The combination of no-consent-required processing alongside a mandatory prior-authorisation and security-obligation structure reflects a regulatory model where ANPDP retains direct oversight of higher-risk processing categories rather than relying on individual consent as the primary safeguard.

Outlook

Whether ANPDP extends comparable sector-specific deliberations to other biometric use cases, such as customer-facing biometric authentication in banking or telecoms, is the item to watch. No such extension was identified this cycle.

AdTech & Commercial Privacy

No dedicated adtech-specific rule has surfaced in the material reviewed. The closest adjacent development is the 15 July 2026 consent requirement for publishing an identifiable person's photo or video online, which touches commercial content and social-platform practices even though it is not framed as an advertising-targeting rule as such. Its practical reach into influencer marketing, user-generated content moderation, or programmatic advertising use of identifiable imagery has not been separately addressed in the sources available.

Outlook

Whether ANPDP extends this consent principle explicitly into advertising or audience-targeting contexts, rather than leaving it as a general publication rule, is the development worth watching for commercial operators relying on identifiable imagery in marketing content.

Algorithmic, Biometric & Surveillance Governance

ANPDP Decision No. 03 of 6 May 2026 regulates the use of biometric systems for monitoring workplace attendance, placing a sector-specific constraint on biometric processing in the employment context. This sits alongside the authority's separate regulation of workplace video surveillance, and together the two decisions show the ANPDP addressing biometric and surveillance processing in the workplace through discrete sectoral decisions rather than a single consolidated biometric-governance instrument. As with the authority's other 2026 decisions noted elsewhere, this one has not been independently re-verified against primary ANPDP text as at this brief.

Outlook

The ANPDP's workplace-focused biometric and surveillance decisions suggest attendance-monitoring and access-control biometric systems are an active area of sectoral attention, and further decisions addressing other biometric use cases should be anticipated.

Algorithmic, Biometric & Surveillance Governance

ANPDP Decision No. 03, dated 6 May 2026, is reported to regulate the use of biometric systems for monitoring workplace attendance, placing a specific governance layer over an increasingly common employee-monitoring technology. This sits alongside the separately reported 4 March 2026 decision addressing workplace video surveillance, together suggesting a pattern of sector-specific attention to employer monitoring technologies rather than a single omnibus biometric or surveillance statute. Neither decision has been checked against a primary ANPDP publication in the material available, so the precise scope and compliance obligations each imposes remain to be firmed up.

Outlook

The pairing of a biometric-attendance decision with a video-surveillance decision within months of each other points to workplace monitoring technology as an active area of ANPDP attention; further sector-specific decisions addressing other monitoring technologies (such as productivity-tracking software) would be a natural next step to watch for.

Algorithmic, Biometric & Surveillance Governance

Two ANPDP decisions issued within a ten-week window in the first half of 2026 together map out a developing Algerian approach to biometric and surveillance processing. Decision No. 02 of 4 March 2026 addresses video surveillance, imposing strict regulation that requires prior declaration to the ANPDP before deployment, restricts the permissible purpose of video-surveillance processing to the security of persons and property, and layers on transparency and security obligations for operators of such systems. Decision No. 03 of 6 May 2026 addresses a narrower and more specific use case, biometric systems deployed for workplace attendance monitoring, and permits such systems for human-resources purposes under declared conditions.

Read together, these two decisions reveal a differentiated regulatory posture depending on the specific surveillance or biometric technology and its purpose, rather than a single blanket rule applied uniformly across all surveillance-adjacent processing. Video surveillance is treated with a notably restrictive purpose limitation, confined to security of persons and property and excluding, by clear implication, broader uses such as general behavioural monitoring or productivity tracking through camera systems. Biometric attendance monitoring, by contrast, is treated as permissible for its stated human-resources purpose provided the declared-conditions requirement is satisfied, a more permissive posture for this particular biometric use case than the video-surveillance decision's purpose restriction would suggest applies to surveillance technology generally. This differentiation is itself informative: it indicates the ANPDP is evaluating biometric and surveillance processing technology by specific use case and purpose rather than applying a single risk category to all technologies that might be loosely grouped as "biometric" or "surveillance" in nature.

Neither decision, on the reporting available, establishes a general statutory test for automated decision-making or profiling of the kind found in more developed data-protection regimes elsewhere; Law No. 25-11 is understood to have introduced profiling as a defined concept, but no ANPDP decision specifically addressing an automated-decision-making scenario, as distinct from the biometric and surveillance decisions discussed here, was identified. This is a gap in current understanding of how Algeria's profiling concept operates in practice, rather than evidence that no such test exists.

Both decisions were identified through secondary legal commentary describing ANPDP decision content rather than through direct retrieval of the decisions' own texts or their publication record, and the specific wording of the declaration requirements, the full list of permitted purposes under the video-surveillance decision, and the exact conditions attached to biometric attendance systems under the Decision No. 03 framework cannot be confirmed with precision on the sourcing available.

Outlook

The marker to watch is whether the ANPDP issues a further decision specifically addressing automated decision-making or profiling as distinct concepts from the biometric and surveillance decisions already issued, which would clarify how Law No. 25-11's profiling concept is actually being applied in enforcement practice. Separately, continued issuance of further sector-specific biometric or surveillance decisions, following the pattern set by the video-surveillance and attendance-monitoring decisions, would confirm that differentiated, use-case-specific regulation is the ANPDP's settled approach to this category of processing rather than a feature of these two particular decisions alone.

Enforcement & Redress

Algeria's statutory penalty architecture for data protection breaches is detailed and criminal in character, with penalties reported to reach up to five years' imprisonment for the most serious offences, within a tiered structure that is said to range from two months to five years' imprisonment and fines of 20,000 to 500,000 dinars depending on the nature of the violation, covering conduct such as refusing to honour a data subject's rights, disclosing sensitive data without authorisation, accessing a protected register without authorisation, or obstructing an ANPDP action. Against that statutory severity, one secondary source characterises the enforcement record as thin, stating that as of early 2026 no enforcement actions against named controllers had been publicly reported. That characterisation is itself dated to early 2026 and has not been refreshed since, so it describes a past state of the enforcement record rather than necessarily today's.

Outlook

The gap between a criminally severe penalty framework on the statute books and an apparently thin public enforcement record is the central tension to track in this area. A first publicly reported ANPDP enforcement decision against a named controller would be a significant marker of the regime moving from statutory design into practical application.

Enforcement & Redress

The ANPDP holds a graduated set of administrative sanction powers: it may issue a warning, issue a formal notice, impose a provisional withdrawal of authorisation for up to one year, or impose a definitive withdrawal of authorisation. Separately from this administrative ladder, failure to notify a personal-data breach within the five-day deadline introduced by Law No. 25-11 is itself a criminal offence, punishable by imprisonment and a fine, giving the ANPDP's enforcement reach both an administrative and a criminal dimension.

Article 27 bis of Law No. 25-11 establishes regional audit and advisory poles, intended to bring ANPDP oversight capacity closer to Algeria's wilayas rather than concentrating it centrally. Implementing regulations defining how these regional poles will actually function are expected throughout 2026; in the meantime, the core DPO, processing-records, DPIA and breach-notification obligations that these poles will presumably help enforce are already in force and enforceable through the ANPDP's existing central powers.

Outlook

The implementing regulations for Article 27 bis's regional audit and advisory poles, expected through the remainder of 2026, are the development to track. Until they are issued, enforcement of Law No. 25-11's accountability obligations continues through the ANPDP's existing central administrative and criminal sanction powers rather than through any regionalised structure.

Enforcement & Redress

The same 15 July 2026 deliberation on photo and video publication establishes a dedicated electronic complaint channel through which individuals whose images were processed or published unlawfully can bring a complaint to the ANPDP, without prejudice to their ability to pursue the matter through the courts.

This gives individuals a specific administrative route for the photo/video publication issue addressed by the same deliberation, running alongside, rather than replacing, access to judicial remedies.

Outlook

The new complaint channel is likely to be the practical entry point through which the ANPDP's cross-border-transfer interpretation of foreign-hosted photo and video publication gets tested in individual cases, giving affected individuals a lower-friction route to raise a complaint than litigation alone.

Enforcement & Redress

ANPDP's administrative sanction powers are understood to include warnings, formal notices, and provisional or definitive withdrawal of authorisations, alongside fines from 20,000 to 1,000,000 dinars. Criminal sanctions of two months to five years imprisonment apply for serious violations, and Law No. 25-11 is understood to raise this ceiling further, to up to ten years imprisonment and 10,000,000 dinars for the most serious violations, a substantial strengthening of the statutory penalty architecture.

Despite this strengthened framework, as of early 2026 no publicly reported enforcement action by ANPDP had been identified, meaning the higher penalty ceiling introduced by Law 25-11 has not yet been tested through a published decision. This cycle does report, with more cautious confidence given its reliance on a single source, that Law 25-11 has already triggered active ANPDP field inspections of private-sector technology companies for cross-border transfer non-compliance, with a 2026 enforcement calendar reportedly targeting medium-sized technology operators with international data dependencies.

Outlook

The central item to watch is whether ANPDP's active 2026 inspection campaign produces a first published enforcement decision, which would test the strengthened Law 25-11 penalty ceiling in practice and provide the first concrete precedent for how the authorisation-based cross-border transfer regime is enforced.