Algeria: Implemented Law Relating to the Protection of Individuals in the Processing of Personal Data (Law No. 18-07) including authorisation obligation

On 12 August 2023, the Algerian Law Relating to the Protection of Individuals in the Processing of Personal Data (Law No. 18-07) came into force. The law is applicable to the processing of personal data by both public bodies and private individuals. The law requires that any personal data processing operations must be subject to prior declaration or authorisation by the national authority. The declarations must include details regarding the processing of data, the purpose for which it is being done, and the security measures that have been put in place to protect it. In addition, there are simplified declarations that can be made for low-risk activities. The processing of sensitive data is generally prohibited, however, it may be authorised for reasons of public interest, medical purposes or legal obligations, provided that appropriate privacy safeguards are maintained. In order to guarantee the legitimacy and non-discrimination of data interconnections, authorisation is required. Furthermore, public interest health research processing is explicitly regulated. The national authority has established specific timeframes for the review and approval of authorisations, following which an implicit rejection is deemed to have occurred if no decision is reached within the designated period.