Algeria

Loi n° 18-07 sets Algeria's general rules for processing personal data of a natural person, binding both public bodies and private persons, whether the processing is automated or held in a manual filing system, and reaching a controller established outside Algeria that uses processing means located in Algeria.

Existing data controllers had one year from the installation of the Autorité nationale de protection des données à caractère personnel (ANPDP) to comply, which Algeria's state press agency reported took place on 11 August 2022, placing that compliance deadline on 11 August 2023.

Processing sensitive data (racial or ethnic origin, political opinions, religious or philosophical convictions, trade-union membership, or health data including genetic data) is prohibited unless a listed exception applies, such as the data subject's express consent or data the data subject has manifestly made public. A data subject has rights to information, access, rectification, and opposition, and a transfer of personal data to a foreign state needs the ANPDP's prior authorization.

Loi n° 25-11 of 24 July 2025 adds a mandatory data protection officer, a right against a judicial or other legally significant decision based solely on automated processing evaluating aspects of a person's personality, a data protection impact assessment duty for processing likely to create a high risk, a five-day breach notification deadline to the ANPDP, heightened security duties specifically for sensitive and biometric data, and a defined biometric-data category.

Articles 394 bis to 394 noniès of the Penal Code punish fraudulently accessing or remaining in all or part of an automated data-processing system with three months to one year of imprisonment and a fine of 50,000 to 100,000 DA, doubled where data is suppressed or modified, and raised to six months to two years and 50,000 to 150,000 DA where the system's operation is altered (art. 394 bis).

Fraudulently introducing, deleting, or modifying data in such a system carries six months to three years and 500,000 to 2,000,000 DA (art. 394 ter). Creating, researching, assembling, distributing, or marketing tools or data by which these offences can be committed, or possessing, revealing, or using data obtained through them, carries two months to three years and 1,000,000 to 5,000,000 DA (art. 394 quater).

Penalties double where the offence harms national defense or a public-law body (art. 394 quinquiès), a legal person is fined up to five times the maximum fine for a natural person (art. 394 sixiès), and participating in a group or agreement formed to prepare one or more of these offences is punished the same as the completed offence (art. 394 septiès), attempt likewise (art. 394 noniès), and art. 394 octiès provides for confiscation of the instruments and data used and closure of the site or premises involved.

Loi n° 09-04 defines an ICT-related offence by reference to the Penal Code's automated-data-processing-system offences and any other offence committed or facilitated through a computer or electronic communications system, and sets the procedure for judicially-authorized electronic surveillance of communications in terrorism, state security, and serious computer-system-threat investigations.

Internet access providers must remove or block access to illicit content as soon as they become aware of it, directly or indirectly, and assist the competent judicial authorities; a provider's failure to comply carries six months to five years' imprisonment and a fine of 50,000 to 500,000 DA for the natural person responsible. Data gathered through surveillance may be used only for the investigation it was gathered for.

This law's obligations bind service and access providers, not a web crawler generally: art. 2(d) defines a 'fournisseur de services' as an entity offering users the means to communicate over a computer or telecommunications system, or an entity processing or storing data for that communication service or its users, which does not on its own reach an operator that only collects data from public pages it does not own.

Ordonnance n° 03-05 relative aux droits d'auteur et aux droits voisins protects a database as an original composite work only where the choice or arrangement of its contents constitutes an original creation, the same standard it applies to a collection or anthology of works; Algeria has no separate sui generis database right. Its private-use exception, which otherwise allows a single copy for personal or family use, expressly excludes the digital-form reproduction of a database. Reproducing or communicating a protected work or database without authorization is punishable as contrefaçon.

A citation or borrowing from a published work in another work is licit under ordonnance n° 03-05 where it conforms to loyal use for information or demonstration purposes, provided the author's name and the source are always given. A single-copy private reproduction of a work is otherwise licit for personal or family use, but that exception does not cover a digital-form database reproduction.

Reproducing or communicating a protected work without authorization outside these exceptions is punishable as contrefaçon.