What Decree 25-320 Establishes
On 30 December 2025, Algeria issued Presidential Decree No. 25-320 setting up a national data governance framework. Based on tracking from the Digital Policy Alert register and the CMS Expert Guide chapter on Algeria, the decree defines three pillars:
- Data classification — a structured taxonomy for data held by public administrations, covering sensitivity levels (public, internal, restricted, confidential) and business domains.
- Data cataloguing — every public administration is expected to maintain a catalogue of its data assets, describing them in a way that makes reuse and controlled sharing possible.
- Secure interoperability — public administrations must be able to exchange data with each other over secure, standardised channels, aligned with cybersecurity and personal data protection rules.
This sits alongside existing instruments: Law 18-07 on personal data protection (as amended by Law 25-11), the 2024 cybersecurity law, and the cloud computing regulation that ARPCE enforces. Decree 25-320 is the layer that tells public bodies how to organise their data so the other laws can work on top of it.
This article is an explainer for vendors, integrators, and cloud architects who sell to or build for the Algerian public sector — not a critique of the decree or the administrations implementing it.
Who This Matters To
Even though the decree addresses public administrations directly, the operational impact spreads across the vendor ecosystem:
- SaaS providers that serve ministries, agencies, local authorities, hospitals, or public universities — their platforms must fit the classification and catalogue model.
- System integrators building or upgrading public-sector information systems — tenders will increasingly reference the decree.
- Cloud architects designing landing zones for public clients — their reference architectures should support classified storage, catalogue hooks, and interoperability APIs out of the box.
- Consultancies supporting public-sector digital transformation — data governance maturity assessments become a recurring engagement.
Private-sector companies are not directly bound by Decree 25-320, but those whose products are consumed by public administrations (or that exchange data with them) will effectively inherit its expectations.
Data Classification: The Tagging Layer Every Product Needs
Classification is the foundation. Without it, neither cataloguing nor interoperability can work cleanly. A typical implementation aligned with Decree 25-320 expectations will need:
- A classification scheme with clear criteria for each level (e.g., public data on the administration’s website, internal data used for daily operations, restricted data on citizens, confidential data linked to state security).
- A labelling mechanism at the data layer — tags in the database, metadata in document stores, classification attributes in file headers, or labels in object storage buckets.
- A propagation rule — when data moves between systems, the classification follows. This is where most implementations fail: reports exported to Excel lose their sensitivity label unless the platform enforces it.
For vendors, the design implication is clear: platforms sold to Algerian public clients in 2026 should expose a classification field by default and allow administrators to configure the taxonomy.
Advertisement
Cataloguing: From Spreadsheet to API
A catalogue is more than an inventory. Under the framework, each administration should be able to describe its datasets — who owns them, how they were created, at what frequency they are updated, who can access them, under which conditions they can be shared.
Practical requirements vendors should anticipate:
- Metadata standards — support for common standards (DCAT-AP is a reasonable baseline) to make cross-administration discovery possible.
- Lifecycle events — the catalogue should reflect creation, updates, archiving, and deletion.
- Access controls linked to the classification — catalogue entries must be visible only to the people authorised to see them.
- Machine-readable interfaces — a public catalogue is useful for citizens, a catalogue API is useful for other administrations.
An implementation team preparing for a ministry tender should treat “catalogue API” as a first-class requirement, not an afterthought.
Secure Interoperability: The Real Engineering Work
Interoperability is where architectural discipline pays off. The decree frames exchanges between public administrations as a secure, documented channel — not a CSV emailed between ministries.
A conformant interoperability stack looks like this:
- Authenticated endpoints — mutual TLS between administration systems, with certificates issued under a recognised hierarchy.
- Identity and authorisation — each request is signed by a known administration and scoped to a specific classification level.
- Transport and payload security — encryption in transit is mandatory; encryption at rest should follow the classification level.
- Logging and audit — every exchange is logged with a tamper-evident trail for later audit, consistent with cybersecurity obligations.
- Data protection alignment — when the exchanged data includes personal information, the exchange must respect Law 18-07 / Law 25-11 lawfulness and minimisation principles.
Cloud architects designing landing zones for public clients should bake these controls into the reference design, so that every new workload inherits them without re-arguing security.
Frequently Asked Questions
Who does Decree 25-320 apply to?
Decree 25-320 applies to Algerian public administrations — ministries, agencies, public establishments, and local authorities. Private companies are not directly bound, but vendors and integrators working with public clients will see its expectations cascade through tenders and contracts.
How does Decree 25-320 interact with the data protection Law 18-07 / Law 25-11?
Decree 25-320 focuses on how public administrations organise, catalogue, and exchange data. Law 18-07 (as amended by Law 25-11) governs how personal data is processed. When personal data is involved in an inter-administration exchange, both frameworks apply: the exchange must be classified, catalogued, and secure (Decree 25-320) and also lawful, minimised, and rights-respecting (Law 25-11).
What should a cloud architect change in reference designs for Algerian public clients?
Build classification tags as a first-class attribute of storage services, integrate a catalogue API hook in data pipelines, require mutual TLS plus centralised logging for any cross-administration exchange, and align encryption settings with the classification level. Treat these as default controls rather than add-ons.
Frequently Asked Questions
Who does Decree 25-320 apply to?
Decree 25-320 applies to Algerian public administrations — ministries, agencies, public establishments, and local authorities. Private companies are not directly bound, but vendors and integrators working with public clients will see its expectations cascade through tenders and contracts.
How does Decree 25-320 interact with the data protection Law 18-07 / Law 25-11?
Decree 25-320 focuses on how public administrations organise, catalogue, and exchange data. Law 18-07 (as amended by Law 25-11) governs how personal data is processed. When personal data is involved in an inter-administration exchange, both frameworks apply: the exchange must be classified, catalogued, and secure (Decree 25-320) and also lawful, minimised, and rights-respecting (Law 25-11).
What should a cloud architect change in reference designs for Algerian public clients?
Build classification tags as a first-class attribute of storage services, integrate a catalogue API hook in data pipelines, require mutual TLS plus centralised logging for any cross-administration exchange, and align encryption settings with the classification level. Treat these as default controls rather than add-ons.
