What Decree 25-320 Establishes
Presidential Decree No. 25-320, signed in December 2025, represents a foundational milestone in Algeria’s Digital Algeria 2030 strategy. It establishes the legal and technical framework governing how data held by Algerian public administrations is classified, catalogued, and exchanged — both between government bodies and with authorized private sector partners.
The decree operates across three pillars. The first pillar is data classification. All data held by public administrations is now required to be classified into one of four tiers: open (publicly accessible, API-available), restricted (accessible to authorized government bodies and vetted private partners), confidential (accessible only to designated government entities with security clearance requirements), and secret (accessible only with ministerial authorization and subject to encryption standards defined by the national cybersecurity authority, DGSI). The classification exercise is not a one-time labelling effort — administrations must review and potentially reclassify data every two years.
The second pillar is a National Data Catalog (NDC). The decree requires every public administration to register its data assets in a centralized national catalog, managed by the Ministry of Digitalization. This catalog will be partially public — open and restricted data assets will be searchable by private sector entities seeking API access — and is intended to be operational by the end of 2026. The NDC architecture is modeled on frameworks implemented in France (data.gouv.fr’s catalog layer) and Singapore’s government data inventory system, which have enabled significant growth in public-private data partnerships.
The third pillar is secure interoperability. The decree mandates that all data exchanges between public administrations must use standardized protocols defined in a technical reference document published by the Ministry of Digitalization. These protocols specify API standards (REST with OAuth 2.0 authentication), data format requirements (JSON-LD for structured data, with metadata schema aligned to the DCAT-AP European standard), logging requirements, and encryption standards. Private sector systems that interface with public administration APIs must implement these same standards.
The Private Sector Implications
Decree 25-320 is primarily a public sector governance instrument, but its implications extend significantly into private enterprise territory through four channels.
The first channel is API access. Companies that currently have informal or legacy data-sharing arrangements with government bodies — often established through bilateral agreements or manual data export processes — must migrate to the decree’s standardized API framework by the deadline that each administration sets for its own systems. The Ministry of Digitalization has indicated that migration schedules will be published on a ministry-by-ministry basis through 2026, with core social protection and taxation systems targeted for Q4 2026 API launch.
The second channel is health and financial data. Two sectors with dense public-private data interdependencies — healthcare and financial services — are explicitly referenced in the decree’s implementing guidelines as priority interoperability domains. Healthcare platforms (telemedicine providers, private hospitals, laboratory information systems) that exchange patient data with CNAS (the national social security fund) must implement the decree’s interoperability protocols to maintain their data sharing authorizations. Banks and payment services that interface with the tax authority’s (DGI) API for identity verification and residence confirmation — a requirement for KYC compliance — face similar migration obligations.
The third channel is cloud and data center services. Companies hosting government data or providing cloud services to public administrations must certify their infrastructure meets the decree’s confidentiality-tier security standards. This certification requirement creates a new market for cloud compliance assessment services and aligns with the broader mandatory cloud certification framework that Algeria’s national cybersecurity authority has been developing since 2024.
The fourth channel is procurement. Any technology company seeking to participate in Digital Algeria 2030 projects — including the 500+ digitalization projects announced for 2025-2026 — will be required to demonstrate compliance with the decree’s data classification and interoperability standards as a precondition for contract award.
Advertisement
What Enterprises Must Build Now
1. Conduct a Data Interface Inventory Across All Government Touchpoints
Organizations should begin by mapping every data exchange currently occurring with government systems — not only formal API connections but also manual data feeds, file transfers, and report submissions that carry structured data. This inventory will identify which systems need to migrate to the decree’s standard protocols and which existing data flows may need reclassification under the new four-tier system. For healthcare platforms, this means mapping CNAS data exchanges, Ministry of Health reporting flows, and any municipal health authority integrations. For financial services, this means mapping DGI identity verification calls, Bank of Algeria regulatory reporting, and any interoperability with CIB payment infrastructure. The inventory should document the data classification tier (open/restricted/confidential/secret) that the decree would assign to each data type — this classification determines the security and authentication requirements for the corresponding API.
2. Implement OAuth 2.0 and JSON-LD Across Government-Facing APIs
The decree’s technical reference mandates OAuth 2.0 as the authentication standard and JSON-LD with DCAT-AP-aligned metadata schemas for structured data. Legacy government system interfaces that use API keys, custom authentication tokens, or XML-based data formats — common in systems built before 2022 — are not compliant with the decree. Engineering teams should prioritize refactoring these integration points. The good news is that OAuth 2.0 and JSON-LD are well-established open standards with mature Algerian developer community support through the ALNRT developer network. Teams that need capability uplift can access the Ministry of Digitalization’s API integration training curriculum, which was launched in Q1 2026 as part of the decree’s implementation program.
3. Register Data Assets in the National Data Catalog When the Portal Opens
When the National Data Catalog opens for private sector submissions — expected in H2 2026 — organizations that hold data with potential public-interest value or that wish to establish data-sharing partnerships with government bodies should proactively register their data assets. The NDC operates bidirectionally: governments discover private sector data assets for potential partnership, and private companies discover government data assets for API access. Early registration builds positioning for data partnership opportunities under Digital Algeria 2030 — particularly in agricultural data, transport telemetry, and environmental monitoring, sectors where public and private data assets are complementary.
4. Budget for Cloud Compliance Certification
For companies hosting government data or seeking contracts under Digital Algeria 2030, the decree’s confidentiality-tier cloud certification requirement introduces a new compliance cost that was not previously budgeted. The certification process — still being finalized by the national cybersecurity authority — is expected to include: security architecture review, penetration testing against defined standards, log retention verification, and physical security audit for on-premises components. International cloud providers operating Algerian data centers (AWS, Google Cloud, Microsoft Azure all maintain presence in Algeria through local partners) are expected to pursue certification in parallel. Algerian companies that host government data on international clouds need to verify their hosting provider’s certification status.
Where This Fits in Algeria’s 2026 Digital Ecosystem
Decree 25-320 does not exist in isolation. It is one instrument in a coordinated legislative stack that Algeria has assembled over 2024–2025 to formalize its digital infrastructure. Law 18-07 and its 2025 amendment (Law 25-11) govern personal data protection. Law 25-10 regulates digital asset prohibition. Decree 25-320 governs data governance and interoperability between institutions. A fourth instrument — the national cybersecurity strategy decree — governs organizational cybersecurity obligations.
Together, these instruments create a coherent regulatory architecture that positions Algeria to participate in international data partnership agreements, particularly with the EU under the EU-Africa digital partnership framework. The interoperability standards in Decree 25-320 align with EU standards (DCAT-AP, OAuth 2.0) by design — enabling future data space participation without requiring system rebuilds. For Algerian technology companies, the decree is both a compliance obligation and a strategic positioning opportunity: building data infrastructure that meets Decree 25-320 standards is simultaneously building infrastructure that meets international data partnership requirements.
The enterprises that treat this decree as a technical standards upgrade rather than a bureaucratic compliance exercise will be the ones positioned to win the first wave of public-private data partnerships under Digital Algeria 2030.
Frequently Asked Questions
Which enterprises are most directly affected by Decree 25-320’s interoperability requirements?
Healthcare platforms (exchanging patient data with CNAS), financial services firms (interfacing with DGI for KYC identity verification), cloud and data center providers hosting government data, and technology companies competing for Digital Algeria 2030 contracts are the most directly affected. Any organization with legacy bilateral data-sharing agreements with government bodies must migrate to the decree’s standardized API framework.
What technical standards does Decree 25-320 mandate for data exchange?
The decree’s technical reference specifies REST APIs with OAuth 2.0 authentication, JSON-LD for structured data exchange, and DCAT-AP-aligned metadata schemas. These are internationally established open standards, consistent with EU data space standards, which means Algerian companies building to these requirements are simultaneously building to international partnership-ready specifications.
When does the National Data Catalog open for private sector use?
The National Data Catalog, managed by the Ministry of Digitalization, is targeted for launch in H2 2026. Upon launch, public-tier government data assets will be searchable and API-accessible to authorized private sector users. Private companies wishing to establish data-sharing partnerships with government bodies can register their own data assets in the catalog. Early registration is advisable for companies in sectors where public-private data complementarity is high, such as agriculture, transport, and environmental monitoring.
—
Sources & Further Reading
🔗 Related Intelligence
Presidential Decree 25-320: Algeria’s First National Data Governance Framework and What It Means for Every Public Institution
Algeria’s Law 25-11: The GDPR-Aligned Data Protection Update Every Enterprise Must Act On
Algeria’s Decree 25-320: National Data Governance for Classification and Security
Algeria’s Data Protection Law (18-07): What Every Business Must Know in 2026
