Cybersecurity law & regulation in Algeria (2026)

Presidential Decree No. 26-07 requires every Algerian public institution to establish a dedicated cybersecurity unit reporting directly to the head of the organisation; units must map threats, deploy remediation plans, and coordinate incident response with ASSI. Driven by Algeria recording over 70 million cyberattacks in 2024, ranking 17th globally among most-targeted nations.

Presidential Decree No. 25-321 signed by President Tebboune formally approves Algeria's five-year national cybersecurity strategy, targeting critical infrastructure defence, digital sovereignty, and public-sector capacity-building as the overarching policy framework.

Presidential Decree No. 25-298 updates the foundational decree creating CNSSI and ASSI, refining inter-institutional mandates and coordination rules in preparation for the 2025-2029 strategy rollout.

Parliament adopted Law No. 11-25 amending the 2018 data protection law to mandate appointment of Data Protection Officers (DPOs), maintenance of detailed processing records, and Data Protection Impact Assessments (DPIAs), substantially increasing cybersecurity-linked compliance obligations.

Moroccan hacktivist groups 'Phantom Atlas' and 'Moroccan Cyber Forces' breached Algeria's Social Security Fund for postal and telecoms workers (MGPTT), leaking 13-20 GB of sensitive records including national ID numbers and administrative documents, highlighting state-adjacent cyber-conflict risks.

Algeria's 2018 data-protection law, dormant pending the ANPDP's installation, became fully binding; all public and private entities processing data of persons in Algeria must now make prior declarations or obtain authorisation from the ANPDP, with direct cybersecurity-safeguarding obligations attached.

The National Authority for the Protection of Personal Data (ANPDP), whose 16 members were appointed by Presidential Decree No. 22-187 on 18 May 2022, was formally installed on 11 August 2022, starting the one-year countdown to Law 18-07 entering into force.

Algeria adopted a comprehensive data protection statute establishing consent requirements, data subject rights, and the independent ANPDP supervisory authority; enforcement was deferred pending the authority's installation, creating a compliance obligation with a delayed trigger.

This foundational telecoms law (Article 10) formally defined 'cybersecurity' in Algerian statute and imposed binding network security, data confidentiality, and anti-interception obligations on all electronic communications operators, with criminal penalties under Article 165 for non-compliance.

Algeria's principal cybercrime law defined ICT-related offences, authorised lawful electronic surveillance and digital search-and-seizure, established a national body to coordinate cybercrime prevention and forensic assistance, and provided a framework for international judicial cooperation.

Algeria inserted Section 7 bis into the Penal Code, criminalising unauthorised access to automated data-processing systems, data integrity violations, and digital fraud, establishing the first criminal-law basis for prosecuting computer intrusions and laying the foundation for all subsequent cybersecurity legislation.