A New Accountability Layer on Top of Law 18-07
Algeria’s original data protection law — Law 18-07 of 10 June 2018 — created the National Authority for the Protection of Personal Data (ANPDP) and set out basic processing principles. It did not, however, require organizations to prove their compliance. Controllers could claim they respected the rules without ever documenting anything.
Law No. 25-11 of 24 July 2025, amending and supplementing Law 18-07, closes that gap. According to the CMS Expert Guide on Algeria data protection, the 2025 amendment introduces “stronger accountability, risk-based, and governance requirements” along with specific definitions for biometric data, profiling, pseudonymisation, and data breaches. In practice, this means Algerian controllers must now build and keep the evidence that shows how they handle personal data.
This article is an explainer for businesses and engineering teams preparing for 2026. It focuses on what the accountability principle, the risk-based approach, and the DPO documentation duty mean in day-to-day operations — not on a critique of any authority.
The Accountability Principle in Practice
Under the amendment, the controller is no longer judged only by outcomes (did a breach happen?) but also by process (can you show the measures you took?). That translates into three documentation bundles that a modern data team should maintain:
- Records of processing activities — a live register listing each processing purpose, the categories of data, the retention period, the recipients, and the security measures. This is the single most important artefact for any future ANPDP inspection.
- Policies and procedures — written data protection policy, data retention schedule, data subject rights procedure, and a breach response plan.
- Training logs and access controls — evidence that staff who handle personal data were trained and that access to records is restricted and logged.
As CookieYes notes in its Algeria guide, the 2025 amendment aligns the country’s framework more closely with the European Union’s General Data Protection Regulation (GDPR), which is useful: most compliance templates GDPR programmes already produce (ROPA spreadsheets, DPIA templates, SCCs) can be adapted rather than rebuilt.
Risk-Based Governance: DPIAs and Prior Consultation
Law 25-11 introduces a risk-based approach. The bigger and more sensitive the processing, the more documentation and review the controller must perform. Two tools carry most of that weight:
- Data Protection Impact Assessments (DPIAs), mandatory for high-risk processing — for example, large-scale biometric processing, systematic monitoring of a public area, or profiling that produces legal effects. A DPIA must describe the processing, assess the necessity and proportionality, identify the risks to data subjects, and list the mitigations.
- Prior consultation with the ANPDP when the DPIA shows residual high risk that the controller cannot mitigate alone. In that case the processing cannot start until the authority has been consulted.
DLA Piper’s Algeria chapter confirms that the DPIA requirement and the prior-consultation procedure are part of the amended framework, mirroring GDPR Articles 35 and 36. Banks, insurers, healthcare platforms, and e-commerce companies that rely on behavioral profiling all fall squarely in scope.
Advertisement
DPO Documentation: More Than a Business Card
Appointing a Data Protection Officer is now mandatory for organizations processing at scale or handling sensitive categories. But the law does not stop at the title — it expects the DPO’s activities to be documented and auditable.
A compliant DPO file should contain:
- The appointment letter, including a description of the DPO’s tasks and the reporting line (the DPO must report to the highest level of management).
- The DPO’s qualifications — relevant training, certifications, or professional experience in data protection.
- An annual work plan and evidence of its execution (audits performed, DPIAs reviewed, training sessions delivered).
- A log of data subject requests handled (access, correction, deletion) and of interactions with the ANPDP.
- A declaration of independence: the DPO must not receive instructions on how to perform their tasks and cannot be penalized for carrying them out.
A single DPO may be appointed for several organizations if their size and structure allow it — useful for Algerian groups with multiple subsidiaries, or for small companies sharing an external DPO-as-a-service.
Practical Compliance Checklist for 2026
For CTOs, general counsel, and compliance officers of Algerian businesses, the following checklist covers the core obligations created by Law 25-11:
- [ ] Appoint a DPO (internal or external) and publish the contact details.
- [ ] Build a Record of Processing Activities covering every business process that touches personal data.
- [ ] Map processing activities against the “high-risk” criteria and run DPIAs where needed.
- [ ] Update privacy notices on websites and apps to reflect the new rights and the DPO contact.
- [ ] Implement a 72-hour-ready breach response procedure, aligned with the notification rules of Law 25-11.
- [ ] Train every employee who handles personal data at least once a year and keep attendance records.
- [ ] Add data protection clauses to all processor contracts (hosting, SaaS, payroll, marketing).
- [ ] Review cross-border transfers and document the legal basis for each.
None of these items requires waiting for secondary regulations — they all stem directly from the amended Law 18-07 and can be implemented now using existing GDPR-style templates adapted to the Algerian context.
Frequently Asked Questions
When does Law 25-11 take effect in Algeria?
Law 25-11 was adopted on 24 July 2025 and amends Law 18-07 of 2018. Its core obligations — accountability, DPO appointment, DPIAs, and breach notification — are already in force. Secondary regulations may refine the details, but businesses should treat the requirements as live in 2026.
Do small Algerian companies need a Data Protection Officer?
A DPO is mandatory when an organization processes personal data at scale or handles sensitive categories (health, biometrics, profiling). Very small companies with limited processing may be exempt, but sharing an external DPO across several small entities is explicitly allowed under the amendment.
How does Law 25-11 compare to GDPR for Algerian businesses?
The 2025 amendment brings Algeria’s framework closer to GDPR on accountability, DPIAs, DPO duties, breach notification, and data subject rights. Companies already running a GDPR programme can adapt most of their existing documentation. The main local specificities are the role of the ANPDP and the criminal penalties attached to certain breaches of Algerian law.
Frequently Asked Questions
When does Law 25-11 take effect in Algeria?
Law 25-11 was adopted on 24 July 2025 and amends Law 18-07 of 2018. Its core obligations — accountability, DPO appointment, DPIAs, and breach notification — are already in force. Secondary regulations may refine the details, but businesses should treat the requirements as live in 2026.
Do small Algerian companies need a Data Protection Officer?
A DPO is mandatory when an organization processes personal data at scale or handles sensitive categories (health, biometrics, profiling). Very small companies with limited processing may be exempt, but sharing an external DPO across several small entities is explicitly allowed under the amendment.
How does Law 25-11 compare to GDPR for Algerian businesses?
The 2025 amendment brings Algeria’s framework closer to GDPR on accountability, DPIAs, DPO duties, breach notification, and data subject rights. Companies already running a GDPR programme can adapt most of their existing documentation. The main local specificities are the role of the ANPDP and the criminal penalties attached to certain breaches of Algerian law.
