A Quiet Decree With Loud Consequences for Vendors
When most of Algeria’s cybersecurity headlines went to Presidential Decree No. 26-07 — the January 2026 text that requires every public institution to stand up a dedicated cybersecurity unit — a second, equally consequential text passed with far less noise. Presidential Decree No. 25-320 of 30 December 2025 establishes a national data governance framework that defines, for the first time, how the Algerian state will classify its data, catalogue it, and move it securely between administrations, according to the CMS Expert Guide to data protection in Algeria.
On paper, the decree targets public administrations. In practice, it reaches deep into the private sector. The integrators, hosting providers, payroll processors, and SaaS vendors who sell to ministries, public banks, and state-owned enterprises will inherit these classification rules through their contracts. If a public client must label its citizen records as “restricted,” the vendor that stores, transmits, or backs up those records has to honor the same label — with the access controls, encryption, and logging that the label implies.
This is the moment to get ahead of it. Data classification is one of the few security disciplines that pays for itself: it tells you exactly which systems deserve your strongest defenses and which can run on a lighter footing. For an Algerian market that absorbed more than 13 million phishing attempts in a single year, per Kaspersky figures cited by L’Algérie Aujourd’hui, knowing where your crown-jewel data lives is the difference between a contained incident and a catastrophic breach.
What Decree 25-320 Actually Requires
The decree sits inside a tight cluster of late-2025 and early-2026 texts that together form Algeria’s modern cybersecurity architecture. Decree No. 25-321, signed the same day, approved the National Cybersecurity Strategy 2025-2029. Decree No. 26-07 of 7 January 2026 created the operational cybersecurity units inside public institutions. And the older Decree No. 20-05 — originally from January 2020 and amended on 10 November 2025 — defines the governance bodies, the strategic coordination council and the national information systems security agency (ANSSI) that operate under the Ministry of National Defense.
Decree 25-320 is the data layer of that architecture. Its core ideas are straightforward:
Classification. Every dataset held by a public administration gets a sensitivity label. While the decree’s internal tiers are administrative, they map cleanly onto the four-level scheme that the rest of the world uses under ISO 27001 — Public, Internal, Confidential, and Restricted, as the Konfirmity 2026 classification guide describes. A press release is Public; an internal procedure is Internal; a citizen’s tax file is Confidential or Restricted.
Cataloguing. Administrations must maintain an inventory of what data they hold and where it lives. You cannot protect — or classify — data you have not inventoried.
Secure interoperability. When data moves between administrations, it must move over controlled, authenticated channels appropriate to its classification. A Restricted record cannot travel the same casual path as a public notice.
The link to existing law is explicit. The decree ties data governance to both cybersecurity and personal data protection under Law 18-07 of 10 June 2018, which Law No. 25-11 of 24 July 2025 sharpened with mandatory Data Protection Officers, processing registers, and a five-day breach-notification window. The National Authority for the Protection of Personal Data (ANPDP), installed in August 2022, can impose fines and, in serious cases, sanctions ranging up to criminal penalties — so a misclassified personal dataset is not just an IT problem, it is a legal exposure.
Advertisement
Why Vendors Cannot Wait for the Contract to Force Them
Three forces make data classification urgent for Algerian vendors right now, even before a specific clause lands in a tender.
First, the threat volume is real and rising. Algeria blocked more than 70 million cyberattacks in 2024 and ranks among the 20 most-targeted nations globally, according to figures relayed by Africa Cybersecurity Mag. Attackers do not waste effort on public brochures; they hunt the Confidential and Restricted tiers. A vendor that has not separated those tiers is defending everything equally — which means defending nothing well.
Second, classification is the prerequisite for almost every other control. You cannot apply proportionate encryption, access management, or retention rules until you know a record’s sensitivity. ISO 27001’s information-classification control (Annex A 5.12) sits early in any certification effort precisely because the rest of the standard depends on it, as Advisera’s implementation guide explains. An Algerian SME chasing an ISO 27001 certificate to win bigger contracts will hit this requirement on day one.
Third, the public sector is now a buyer that asks. With cybersecurity units mandated inside every public institution under Decree 26-07, the people writing tenders increasingly have a security counterpart who reviews vendor data-handling. The vendor who can present a clean classification scheme, a data catalogue, and matching access controls will clear that review fast. The vendor who improvises will not.
What Algerian Vendors Should Do Now
1. Build a four-tier classification scheme this quarter
Adopt a simple, defensible model: Public, Internal, Confidential, Restricted. Write a one-page policy that defines each tier with concrete Algerian examples — a marketing PDF is Public, an internal HR memo is Internal, a client’s financial records are Confidential, and citizen identity or health data is Restricted. Keep the scheme simple enough that a non-technical employee can apply it correctly. Four tiers is the sweet spot recommended across ISO 27001 practice; more tiers create confusion, fewer leave sensitive data under-protected. Assign a data owner for each major system who is accountable for labeling decisions, and make classification a required field when any new dataset is created.
2. Inventory and catalogue your data before the tender does
You cannot classify what you have not found. Run a discovery exercise across your systems — production databases, backups, shared drives, email archives, and the laptops of staff who handle client data. Produce a catalogue that records, for each dataset, what it contains, its classification tier, where it is stored, who can access it, and how long you keep it. This catalogue is exactly what Decree 25-320 expects public administrations to maintain, and a vendor who already has one walks into procurement reviews with the hardest deliverable already done. Review the catalogue at least annually and whenever a system changes.
3. Attach controls to the labels, not to every system equally
Classification is worthless if Confidential data gets the same protection as a public webpage. Map each tier to a defined control baseline. Restricted and Confidential data should require encryption at rest and in transit, multi-factor authentication, role-based access limited to staff who genuinely need it, and full access logging. Internal data needs basic access control and backups. Public data needs integrity protection so it cannot be tampered with. This proportionate approach lets a resource-constrained Algerian SME spend its security budget where it matters — protecting the 5 percent of data that would cause real harm if leaked, rather than gold-plating everything. It also produces the exact evidence a public-sector cybersecurity unit will ask for.
Where This Fits in Algeria’s Bigger Cyber Picture
Decree 25-320 completes a logic that started with the National Cybersecurity Strategy 2025-2029 and the cybersecurity units of Decree 26-07. Strategy set the direction, the units gave institutions hands to act, and data governance gives them a map of what they are defending. For Algerian businesses, this is a genuine opening: the companies that internalize data classification now will be the ones public clients trust with their most sensitive systems over the next five years.
Data classification is the unglamorous foundation that makes every other security investment pay off. It is cheap to start, it scales with the business, and it converts directly into procurement advantage as the public sector tightens its vendor requirements. The Algerian vendors who treat the decree as a head start — rather than waiting for a contract clause to force the work — will be the ones writing the references that competitors scramble to match.
Frequently Asked Questions
Does Decree 25-320 apply directly to private companies?
Not directly — the decree governs public administrations. But its requirements reach private vendors through contracts. When a ministry or public bank classifies its data as Confidential or Restricted, the vendors that store, transmit, or process that data must honor the same classification and apply matching controls. In practice, any company selling to the public sector should prepare to comply.
What is the difference between data classification and the breach-notification rules in Law 25-11?
They work together but solve different problems. Data classification, the focus of Decree 25-320, sorts data by sensitivity so you can protect it proportionately. Law No. 25-11 of 24 July 2025 governs what happens after a breach — it requires notifying the ANPDP within five days and mandates Data Protection Officers and processing registers. Good classification reduces breach risk; the notification rules apply when a breach occurs anyway.
How many classification tiers should an Algerian SME use?
Four is the recommended standard: Public, Internal, Confidential, and Restricted. This aligns with ISO 27001 practice and balances simplicity against precision. Fewer tiers leave sensitive data under-protected; more tiers confuse the non-technical staff who actually apply the labels day to day. Start with four, define each with concrete examples, and adjust only if a clear need emerges.
Sources & Further Reading
- Data protection and cybersecurity laws in Algeria — CMS Expert Guide
- Cybersécurité : l’Algérie adopte sa stratégie nationale 2025-2029 — We Are Tech Africa
- L’Algérie publie officiellement sa première Stratégie Nationale — Africa Cybersecurity Mag
- ISO 27001 Data Classification Guide 2026 — Konfirmity
- Information Classification According to ISO 27001 — Advisera
- Développement du secteur de la cybersécurité : l’appel des start-up — L’Algérie Aujourd’hui
