Algeria: Implemented Law Relating to the Protection of Individuals in the Processing of Personal Data (Law No. 18-07) including cybersecurity regulation

On 12 August 2023, the Algerian Law Relating to the Protection of Individuals in the Processing of Personal Data (Law No. 18-07) came into force. The law is applicable to the processing of personal data by both public bodies and private individuals. The data controller is obliged to implement the requisite technical and organisational measures to safeguard personal data against unauthorised access, loss, destruction, alteration, or illicit processing. In the event that data processing is outsourced, the controller is obliged to ensure that the processor provides sufficient security guarantees, which must be formalised in a legal contract that mandates adherence to the obligations set out in the contract. Service providers must notify the national authority and affected individuals without delay of any personal data breaches in public electronic communication networks that may impact privacy unless the authority determines that adequate data protection measures are in place. Furthermore, service providers must maintain a current record of breaches and remedial actions.