My company works in Algeria. What does the law ask of us when an AI agent reads our data?
The short answer
Law 18-07 of 10 June 2018 applies, and Law 25-11 of 24 July 2025 amended it. Processing personal data needs the person's express consent unless one of the law's exceptions applies, and every processing must first be declared to the national authority or authorized by it. Sending data to a model abroad needs the authority's authorization and a destination with sufficient protection, unless an exception applies. Since 2025 every controller must also appoint a data protection officer.
The law that applies
Law 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data was published in Official Journal 34 of 2018. Law 25-11 of 24 July 2025 amended and completed it, and was published in Official Journal 48 of 2025. The law created an independent administrative authority, which it calls the national authority, with its seat in Algiers. It gave those already processing personal data one year from the installation of that authority to comply.
The law covers controllers established in Algeria. It also covers a controller outside Algeria that uses means located in Algeria to process personal data. That controller must give the authority the identity of a representative based in Algeria.
Can the agent read personal data at all?
The default rule is that personal data may be processed only with the express consent of the person, and the person may withdraw it at any time. Consent is not needed where the processing is necessary for one of the cases the law lists. Among them are a legal obligation, performing a contract the person is party to, and a legitimate interest of the controller, subject to the person’s interests, rights and freedoms.
Three rules matter most for an agent:
- Declare first. Every processing of personal data needs a prior declaration to the national authority, or its authorization. If the authority sees clear dangers to privacy or rights in a declared processing, it decides to require prior authorization. It must give reasons and notify the controller within 10 days of the declaration.
- Processing sensitive data is forbidden by default. The law allows it only in the cases it lists. Among them are the person’s express consent, a legal provision, and the authority’s authorization.
- Decisions made by machine. The 2018 text barred decisions with legal effects taken solely on automated processing meant to profile a person. The 2025 amendment repealed that article, together with the article before it on data about offences and penalties. It placed similar wording in a new part of the law on processing for crime prevention, investigation and prosecution. The amendment also added a definition of profiling.
The model provider, and data sent abroad
When the agent sends text to a model run by a provider, the provider processes that data on your behalf. You must choose a processor that gives sufficient guarantees on technical and organizational security. A contract must bind the processor, and it must state that the processor acts only on your instructions.
The law allows a transfer to a foreign country only with the authorization of the national authority, and only if that country offers a sufficient level of protection. The authority judges that level from the country’s laws, its security measures and the nature of the processing. By way of exception, you may transfer to a country without that protection in listed cases. They include the person’s express consent, performing a contract with the person, and the authority’s authorization where the processing respects human dignity, private life and people’s rights, as the law’s general principle requires.
The 2025 amendment added two duties that apply to every controller:
- A data protection officer. You must appoint one, chosen for professional qualities and knowledge of data protection law and practice, and give the authority the officer’s contact details.
- A record of processing. You must keep a record of your processing activities. It must list, among other things, the purposes, the legal basis and the recipients of the data, including recipients in other countries.
When something goes wrong
The 2018 law requires providers of electronic communications services open to the public to warn the authority and the person without delay of a breach that may harm the person’s privacy. The 2025 amendment added a duty to notify the authority of a breach within 5 days, and a duty to study the impact of high-risk processing before it starts. Both sit in the new part on processing for crime prevention and prosecution.
The authority may issue a warning, a formal notice, a fine, or the withdrawal of the declaration receipt or authorization, for up to one year or for good. It imposes a fine of 500,000 dinars on a controller that refuses, without a legitimate reason, the person’s rights of information, access, rectification or objection. Processing without the required declaration or authorization can bring 2 to 5 years in prison and a fine of 200,000 to 500,000 dinars. A transfer abroad in breach of the law can bring 1 to 5 years in prison and a fine of 500,000 to 1,000,000 dinars.
What Algeria says about AI itself
On 25 May 2026 the government met to review a draft national AI strategy, as reported by APS, the state news agency. I found no published text of the strategy and no Algerian law that regulates AI as such, as of October 2026. For an agent that handles personal data, the binding rules are Law 18-07 and its 2025 amendment.
What this means for you
- Declare each processing the agent performs to the national authority before it starts, and check whether it needs prior authorization.
- Record the legal basis for each kind of data the agent reads, and obtain express consent where no exception applies.
- Appoint a data protection officer and keep a record of processing that lists any recipient abroad.
- If your model provider processes data outside Algeria, settle the transfer route, usually the authority’s authorization, before you go live.
I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.
References
- Official Journal of Algeria No. 34 of 10 June 2018, Law 18-07 (French edition)
- Official Journal of Algeria No. 34 of 10 June 2018, Law 18-07 (Arabic edition)
- Official Journal of Algeria No. 48 of 24 July 2025, Law 25-11 (French edition)
- Official Journal of Algeria No. 48 of 24 July 2025, Law 25-11 (Arabic edition)
- APS, PM chairs Government meeting on national AI strategy, May 2026