Since it came into force, Law 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data constitutes the Algerian legal framework for data protection. If you own a website, an application, or if you collect information about your customers, this law directly concerns you.

"Any Algerian business that collects, processes or stores personal data — even a simple email address — is subject to the obligations of Law 18-07."

What is Law 18-07?

Law 18-07 is the Algerian equivalent of Europe's GDPR. It was adopted to regulate the collection and processing of personal data of Algerian citizens and guarantee their right to privacy in the digital age.

It draws heavily on international standards (GDPR, Council of Europe Convention 108) and creates an Authority for the Protection of Personal Data (APDP) responsible for overseeing its application.

Personal data means any information that allows a person to be identified: name, surname, email, phone number, IP address, location, photo, etc.

Who Is Affected?

Law 18-07 applies to any natural or legal person, public or private, who processes personal data of Algerian residents, whether the processing takes place in Algeria or from abroad.

Concretely, you are affected if you:

  • Own a website with a contact or registration form
  • Manage an online store (e-commerce)
  • Use a CRM to manage your customers
  • Send newsletters or marketing SMS
  • Collect data via a mobile application
  • Store customer, supplier or employee files
  • Use web analytics tools (Google Analytics, etc.)

Main Obligations

1

Declaration to the APDP

Any processing of personal data must be declared or authorised by the Authority for the Protection of Personal Data before its implementation. Sensitive processing (health data, ethnic origin, political opinions) requires prior authorisation.
2

Explicit Consent of the Individual

You must obtain the free, informed and explicit consent of the person before collecting their data. On a website, this translates to a checkbox (not pre-ticked) and a clear statement about data use. Consent must be withdrawable at any time.
3

Transparent Information

Individuals whose data you collect must be informed of: the identity of the data controller, the purpose (why you collect this data), the retention period, their rights (access, rectification, deletion). This information must appear in a privacy policy accessible on your site.
4

Data Security

You are required to implement technical and organisational measures to protect data against any loss, destruction, alteration or unauthorised access. This includes: data encryption, strong passwords, limited access, regular backups, HTTPS on your website.
5

Rights of Individuals

The law guarantees each person the right to access their data, rectify it, object to its processing and have it deleted. You must put in place a means to respond to these requests within a reasonable timeframe (generally 30 days).

Penalties for Non-Compliance

⚠️ Penalties under Law 18-07

• Fines ranging from 200,000 DA to 2,000,000 DA depending on the severity of the offence

• In case of repeat offence: doubled fines

• Criminal sanctions of up to 5 years imprisonment for the most serious offences (intentional disclosure of sensitive data)

• Injunction to cease data processing

• Publication of the sanction decision (reputational damage)

What This Means Concretely for Your Website

For a standard website, compliance with Law 18-07 involves several concrete actions:

  • Privacy policy: a dedicated page explaining what data you collect, why and how
  • Legal notices: clear identification of the company responsible for the site
  • Compliant forms: unticked checkbox + link to the privacy policy
  • Cookie banner: if you use cookies (Google Analytics, Facebook Pixel, etc.)
  • Mandatory HTTPS: your site must be secured (SSL certificate)
  • Secure hosting: preference for a host that meets security standards

Checklist: Are You Compliant?

✅ Law 18-07 Compliance Checklist

Your site is on HTTPS (padlock in the address bar)
A privacy policy is accessible on your site
Your forms have an unticked consent checkbox
You have declared your processing to the APDP
You have a means of responding to data access/deletion requests
Your customer data is stored securely
You don't send marketing emails without prior consent
You have a procedure in case of data breach

How WEBMINDS Supports You

Compliance with Law 18-07 is not just a legal obligation — it is also a trust signal for your customers. At WEBMINDS, we integrate the requirements of Law 18-07 from the design of your digital projects:

  • Drafting legal notices and privacy policies tailored to your activity
  • Integration of compliant forms with explicit consent
  • Setting up the SSL certificate (HTTPS) on your hosting
  • Secure configuration of databases
  • Compliance audit of your existing site

We also offer a dedicated Law 18-07 compliance service to guide you through all your compliance steps.

Law 18-07 GDPR Algeria Data protection APDP Compliance Cybersecurity
⚖️
WEBMINDS Team
Digital compliance experts — Algiers, Algeria
WEBMINDS has been helping Algerian businesses with Law 18-07 compliance and their overall digital transformation for over 18 years.