Algeria

Law 18-07 borrows the older European test of 'means located on the territory'. It does not use the newer test of targeting people in the country. Data that only passes through Algeria is expressly left out. So a foreign business that serves Algerian customers entirely from abroad, with no local equipment, is not clearly caught by the wording. That is a real difference from Europe, India or Brazil. The law also treats a company based in a country whose law counts as equivalent to Algerian law as if it were based in Algeria. But no list of equivalent countries has been published in the official gazette. Separately, Algerian courts can try offences under this law committed outside Algeria. That covers an Algerian, a foreigner living in Algeria, or an Algerian company.

Industry by industry, checked on 18 August 2026. E-COMMERCE: closed. An online seller must publish a site or page hosted in Algeria with a .com.dz address. It must also deposit the domain name with the national trade register centre (Law 18-05). ELECTRONIC TRUST SERVICES (digital signatures, seals, timestamps, electronic identity): closed, with an exit. All data collected by a trust service provider must be hosted on national territory. It may then also be sent abroad in the course of the business (Law 26-02 of 17 February 2026). Providers must also be Algerian companies or Algerian nationals. GOVERNMENT: closed channel. Since 30 December 2025 the national interoperability system is the only route for digital data exchange between public bodies. It runs on a secured national interconnection network kept separate from the internet (Presidential Decree 25-320). TELECOMS: all international traffic other than satellite must be carried entirely over the historic operator's international infrastructure (Law 18-04). Identification and traffic data must be kept for one year (Law 09-04). HEALTH: we found no storage rule. But every public and private health facility must keep a single computerised patient record, and must join the national health information system (Law 18-11). BANKING, PAYMENTS, INSURANCE, SECURITIES: we found no storage or location rule, checked 18 August 2026. We looked at the monetary and banking law of 2023 and the April 2025 rules on payment service providers. We could not reach the central bank's own website, so instructions published only there could not be checked. GAMBLING: not a licensed activity in Algeria, so we did not look. MAPPING: the national cartographic institute has held a monopoly on mapping work since 1967, under defence ministry supervision. We found no modern rule on mapping data, so this is flagged as unconfirmed.

Law 18-07 sets the authorisation rule and the test of a sufficient level of protection. The authority judges that on the law of the destination country and the security measures in place there. It also looks at the purpose, duration, nature, origin and destination of the data. The law then lists the exceptions that allow a transfer even to a country that fails that test. One bar is absolute. No transfer at all where it could harm public security or the vital interests of the state. Nothing in the official gazette says how to apply, what the form looks like, or how long a decision takes. We could not reach the authority's own website on 18 August 2026. So the practical route to an authorisation is unverified. A separate and narrower set of transfer rules for police and justice bodies was added in July 2025. It requires the relevant authority to assess the destination itself. It can ask the national authority for an opinion first.

Here is the evidence trail from the official gazette. Presidential Decree 22-187 of 18 May 2022 appointed the president and members for five years. Presidential Decree 23-73 of 14 February 2023 organised the executive secretariat. Presidential Decree 23-147 of 5 April 2023 created the staff corps. An interministerial order of 17 September 2024 created the authority's own official bulletin. A decision of 31 August 2025 set up an internal technical committee, signed by the president, Samir Bourehil. The July 2025 amendment gave the authority regional units for inspection and audit. How those units will work still has to be set by regulation. Two warnings. First, the authority publishes its own bulletin, which we could not open. Decisions may exist outside the gazette. Second, crimes under the law are prosecuted by the ordinary courts, on a report from judicial police officers. So a case can proceed without the authority acting at all. Industry regulators are separate and working. The telecoms and post regulator issues decisions regularly. The telecoms ministry launched an industry cyber incident response centre in June 2026.

The ten-year accounting rule comes from the financial accounting law of 2007. It covers both full and simplified bookkeeping. The one-year telecom rule comes from the 2009 cybercrime law. It covers user identification data, terminal equipment data, and the time and duration of each communication. It also covers the services used, the recipients, and the addresses of sites visited. Conflicts are settled in favour of the specific keeping rule. The data law makes it an offence to keep personal data beyond the period fixed by the law in force. It is also an offence to keep it beyond the period stated in your own filing. So the filing you make becomes your own binding deadline. The law also lets the authority approve longer keeping for historical, statistical or scientific purposes. You have to ask, and show a legitimate interest.

Law 18-07 sets the rule for providers on public electronic communications networks. It uses the words 'sans delai', without delay. You do not have to tell the individual if the authority finds you had appropriate protection measures in place. Failing to notify either the authority or the person is a crime. The July 2025 amendment created a separate part of the law for data used to prevent, investigate and prosecute crime, and to enforce sentences. Inside that part, there is a five-day deadline to inform the authority. There is also a duty to tell the individual where the risk is high. That can be delayed where an investigation would be harmed. We found no general duty for ordinary businesses to report a cyber incident to a national agency. The national information systems security rules of January 2020 were amended in November 2025. They set up a council and an agency under the Ministry of National Defence. They do not set a reporting deadline. The telecoms ministry's industry incident response centre opened in June 2026 as a channel, not a legal duty. Checked 18 August 2026.

On the criminal exposure. The largest fine the authority itself can impose is 500,000 dinars, about 3,800 US dollars. So the deterrent is not the money. It is the prison sentence, and the power to withdraw your filing receipt or authorisation. That stops you using the data at all. The authority can withdraw a filing without delay where your use of data turns out to harm national security or offend public morals. There is no equivalent ground in European law. On children. Using a child's data needs the consent of the legal representative, or the authorisation of a judge. A judge can also allow it without the parent's consent where the child's best interests require it, and can withdraw that at any time. The data law does not itself say the age at which someone stops being a child. On sensitive data. The categories are racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership, and health, including genetic data. On trust services and online selling. The provider must be an Algerian company or an Algerian national. An online shop must run on Algerian hosting under a .com.dz address. That rules out a plain foreign cloud front end.

Switches that could flip, in order of how fast they could change things. First, the two reference documents under the December 2025 decree. Public bodies must begin classifying and cataloguing from the date those documents are published. The High Commissioner for Digitalisation publishes them by decision, with no consultation step. Second, the data protection authority can decide on its own that a filing you made should instead need prior authorisation. It has ten days from your filing to say so. Third, the data law lets the authority publish a list of low-risk uses of data that qualify for a simplified filing. No such list has appeared. So today everything follows the full route. Fourth, the trust services law of February 2026 needs its detailed rules and a new national electronic certification authority. Until that authority is actually set up, the existing certification bodies carry on, and the old 2015 rules stay in force. Fifth, the national information systems security strategy for 2025 to 2029 was approved on 30 December 2025, and it may produce further duties.