Cybersecurity regulation in Algeria (2026)

Presidential Decree No. 26-07 requires every Algerian public institution to establish a dedicated cybersecurity unit reporting directly to the head of the organisation; units must map threats, deploy remediation plans, and coordinate incident response with ASSI. Driven by Algeria recording over 70 million cyberattacks in 2024, ranking 17th globally among most-targeted nations.

Presidential Decree No. 25-321 signed by President Tebboune formally approves Algeria's five-year national cybersecurity strategy, targeting critical infrastructure defence, digital sovereignty, and public-sector capacity-building as the overarching policy framework.

Presidential Decree No. 25-298 updates the foundational decree creating CNSSI and ASSI, refining inter-institutional mandates and coordination rules in preparation for the 2025–2029 strategy rollout.

Parliament adopted Law No. 11-25 amending the 2018 data protection law to mandate appointment of Data Protection Officers (DPOs), maintenance of detailed processing records, and Data Protection Impact Assessments (DPIAs), substantially increasing cybersecurity-linked compliance obligations.

Moroccan hacktivist groups 'Phantom Atlas' and 'Moroccan Cyber Forces' breached Algeria's Social Security Fund for postal and telecoms workers (MGPTT), leaking 13–20 GB of sensitive records including national ID numbers and administrative documents, highlighting state-adjacent cyber-conflict risks.

Algeria's 2018 data-protection law, dormant pending the ANPDP's installation, became fully binding; all public and private entities processing data of persons in Algeria must now make prior declarations or obtain authorisation from the ANPDP, with direct cybersecurity-safeguarding obligations attached.

The National Authority for the Protection of Personal Data (ANPDP), whose 16 members were appointed by Presidential Decree No. 22-187 on 18 May 2022, was formally installed on 11 August 2022, starting the one-year countdown to Law 18-07 entering into force.

Algeria adopted a comprehensive data protection statute establishing consent requirements, data subject rights, and the independent ANPDP supervisory authority; enforcement was deferred pending the authority's installation, creating a compliance obligation with a delayed trigger.

This foundational telecoms law (Article 10) formally defined 'cybersecurity' in Algerian statute and imposed binding network security, data confidentiality, and anti-interception obligations on all electronic communications operators, with criminal penalties under Article 165 for non-compliance.

Algeria's principal cybercrime law defined ICT-related offences, authorised lawful electronic surveillance and digital search-and-seizure, established a national body to coordinate cybercrime prevention and forensic assistance, and provided a framework for international judicial cooperation.

Algeria inserted Section 7 bis into the Penal Code, criminalising unauthorised access to automated data-processing systems, data integrity violations, and digital fraud — establishing the first criminal-law basis for prosecuting computer intrusions and laying the foundation for all subsequent cybersecurity legislation.