Algeria

Article 4 of Law 18-07 borrows the older European test of 'means located on the territory', not the newer test of targeting people in the country. Pure transit through Algeria is expressly excluded. A foreign business that serves Algerian customers entirely from abroad, with no local equipment, is therefore not clearly caught by the wording, which is a real difference from Europe, India or Brazil. Article 4 also treats a controller established in a country whose law is recognised as equivalent to Algerian law as if it were established in Algeria, but no list of equivalent countries has been published in the official gazette. Separately, the Algerian courts can try offences under the data law committed outside Algeria by an Algerian, by a foreigner living in Algeria, or by an Algerian company (Article 53).

Sector by sector, checked on 18 August 2026. E-COMMERCE: hard wall. An online seller must publish a site or page hosted in Algeria with a .com.dz address, and must deposit the domain name with the national trade register centre (Law 18-05, articles 8 and 9). ELECTRONIC TRUST SERVICES (digital signatures, seals, timestamps, electronic identity): hard wall with an exit. All data collected by a trust service provider must be hosted on national territory, and may then also be transferred abroad in the course of the business (Law 26-02 of 17 February 2026, article 27). Providers must also be Algerian legal persons or Algerian nationals. GOVERNMENT: closed channel. Since 30 December 2025 the national interoperability system is the exclusive route for digital data exchange between public bodies, running on a secured national interconnection network kept separate from the internet (Presidential Decree 25-320). TELECOMS: all international traffic other than satellite must be carried entirely over the international infrastructure of the historic operator (Law 18-04, article 126), and identification and traffic data must be kept for one year (Law 09-04, article 11). HEALTH: no storage rule found, but every public and private health facility must keep a single computerised patient record and must join the national health information system (Law 18-11, articles 292 and 321). BANKING, PAYMENTS, INSURANCE, SECURITIES: no storage or localisation rule found in the monetary and banking law of 2023 or in the April 2025 regulation on payment service providers, checked 18 August 2026; the central bank's own website was unreachable, so instructions published only there could not be checked. GAMBLING: not a licensed activity in Algeria, so no rule sought. MAPPING: the national cartographic institute has held a monopoly on mapping work since 1967 under defence ministry supervision, but we found no modern instrument on mapping data, so this is flagged as unconfirmed.

Article 44 of Law 18-07 sets the authorisation rule and the test of a sufficient level of protection, judged by the authority on the law of the destination country, the security measures in place there, and the purpose, duration, nature, origin and destination of the data. Article 45 lists the exceptions that allow a transfer even to a country that fails that test. There is one absolute bar: no transfer at all where it could harm public security or the vital interests of the state. Nothing in the official gazette sets out how to apply, what the form looks like or how long a decision takes, and the authority's own website could not be reached from our checker on 18 August 2026, so the practical route to an authorisation is unverified. A separate and narrower transfer regime for police and justice bodies was added in July 2025 and requires the competent authority to assess the destination itself, with the option of asking the national authority for an opinion first.

Evidence trail from the official gazette: Presidential Decree 22-187 of 18 May 2022 appointed the president and members for five years; Presidential Decree 23-73 of 14 February 2023 organised the executive secretariat; Presidential Decree 23-147 of 5 April 2023 created the staff corps; an interministerial order of 17 September 2024 created the authority's own official bulletin; a decision of 31 August 2025 set up an internal technical committee and is signed by the president, Samir Bourehil. The July 2025 amendment gave the authority regional units for inspection and audit, but their conditions of operation still have to be set by regulation. Two caveats. First, the authority publishes its own bulletin, which we could not open, so decisions may exist outside the gazette. Second, criminal offences under the law are prosecuted by the ordinary courts on the report of judicial police officers, so a case can proceed without the authority acting at all. Sector regulators are separate and functioning: the telecoms and post regulator issues decisions regularly, and the telecoms ministry launched a sector cyber incident response centre in June 2026.

The ten-year accounting rule comes from the financial accounting law of 2007, articles 20 and 22, and covers both full and simplified bookkeeping. The one-year telecom rule comes from the 2009 cybercrime law, article 11, and covers user identification data, terminal equipment data, the time and duration of each communication, the services used, the recipients and the addresses of sites visited. Conflicts are resolved in favour of the specific keeping rule: article 65 of the data law makes it an offence to keep personal data beyond the period fixed by the legislation in force, or the period stated in your own filing, which means the filing you make becomes your own binding deadline. Article 9 also lets the authority approve longer keeping for historical, statistical or scientific purposes if you ask and can show a legitimate interest.

Article 43 of Law 18-07 is the operative rule for providers on public electronic communications networks and uses the words 'sans delai', without delay. Telling the individual is not required if the authority finds that the provider had appropriate protection measures in place. Article 66 makes failure to notify either the authority or the person a criminal offence. The July 2025 amendment created a separate Title V bis for processing to prevent, investigate and prosecute crime and to enforce sentences; inside that title, article 45 bis 8 sets a five-day deadline to inform the authority and article 45 bis 10 requires telling the individual where the risk is high, with the option to delay that where an investigation would be harmed. No general duty was found for ordinary businesses to report a cyber incident to a national agency: the national information systems security framework of January 2020, amended in November 2025, sets up a council and an agency under the Ministry of National Defence rather than a reporting deadline, and the telecoms ministry's sector incident response centre opened in June 2026 as a channel rather than a legal duty. Checked 18 August 2026.

On the criminal exposure: the maximum administrative fine the authority itself can impose is 500,000 dinars, about 3,800 US dollars, so the deterrent is not the money but the prison sentence and the power to withdraw your filing receipt or authorisation, which stops the processing. Article 48 lets the authority withdraw a filing without delay where the processing turns out to harm national security or offend public morals, a ground with no equivalent in European law. On children: processing a child's data needs the consent of the legal representative or the authorisation of a judge, and a judge can order processing without the parent's consent where the child's best interests require it, and can withdraw that at any time; the data law does not itself state the age at which someone stops being a child. On sensitive data: the categories include racial or ethnic origin, political opinions, religious or philosophical belief, trade union membership and health, including genetic data. On trust services and online selling: the provider must be an Algerian legal person or an Algerian national, and an online shop must run on Algerian hosting under a .com.dz address, which rules out a plain foreign cloud front end.

Dormant switches, in order of how quickly they could change the picture. First, the two reference frameworks under the December 2025 decree: article 19 says public bodies must begin classifying and cataloguing from the date those documents are published, and they are published by a decision of the High Commissioner for Digitalisation with no consultation step. Second, the data protection authority can decide on its own that a filing you have made should instead be put under prior authorisation, and it has ten days from your filing to say so. Third, article 15 of the data law lets the authority publish a list of low-risk processing that qualifies for a simplified filing; no such list has appeared, so today everything follows the full route. Fourth, the trust services law of February 2026 needs its implementing texts and a new national electronic certification authority; until that authority is actually set up, the existing certification bodies carry on, and the old 2015 implementing texts stay in force. Fifth, the national information systems security strategy for 2025 to 2029 was approved on 30 December 2025 and may produce further obligations.