🇩🇿Law No. 18-07 on Personal Data Protection (as amended by Law No. 25-11)
Law No. 18-07, as amended by Law No. 25-11
The official 2018 and 2025 Gazettes and the current materials of the National Authority for the Protection of Personal Data (ANPDP) are the source basis for this summary.
Core operational duties
Legal basis and regulatory filings: Articles 7-20 establish consent and other processing conditions and the declaration or prior-authorisation system administered by the ANPDP.
Transparency and rights: Articles 32-36 require information and operational access, rectification and objection procedures.
Security and processors: Articles 38-41 require appropriate technical and organisational measures, confidentiality and documented processor controls.
2025 governance additions: New Articles 41 bis, 41 bis 2 and 41 bis 3 establish Data Protection Officer, controller/processor record and automated-operation logging duties.
Transfers: Articles 44-45 restrict transfers abroad and require ANPDP authorisation and sufficient protection or a defined exception.
Filing, DPO and transfer duties should be assessed before processing begins and revisited when purposes, systems, recipients or locations change.