Algeria energy sector: AI, strategic data and insider risk

At a base in Hassi Messaoud, a reservoir engineer is preparing a note for management. He has well logs, a reservoir model and a report from a foreign contractor in front of him. To save an hour, he pastes part of the report into an AI assistant and asks for a summary. The text reads well and the note goes out on time. But a piece of strategic technical data has just left the company.

In Algeria's energy sector and large state-owned companies, this is nothing unusual. The issue is not only personal data protection. It is the protection of the country's technical assets, and the insider risk that comes with them.

AI is reaching the oil fields

Artificial intelligence is now at the centre of industry discussions. At the 14th NAPEC in Oran in October 2026, Sonatrach said AI must be built in to speed up enhanced recovery in mature fields. Baker Hughes and Halliburton presented these tools as a way to produce more from ageing reservoirs.

The same report by Maghreb Émergent says Sonatrach expects 26% of its exploration and production budget to be spent in partnership. That means a lot of data exchanged with foreign oil companies, service firms and engineering consultancies. Every exchange is another chance for a document to be pasted into a tool nobody has approved.

Not all sensitive data is personal

In an energy company, the most sensitive information is often not names or phone numbers. It is:

• seismic data, well logs and reservoir models;

• facility drawings and diagrams of power and gas networks;

• tender specifications, commercial bids and contract terms with partners;

• incident reports, security audits and operating procedures.

Much of this falls outside Law No. 18-07 on personal data, but a leak can cost far more than a fine. It helps competitors, the other side of a negotiation, or attackers preparing an intrusion.

Algeria's framework is getting stricter

Personal data still matters. HR files, occupational health records and contractor lists fall under Law 18-07, amended by Law No. 25-11 of July 2025, and are supervised by the ANPDP. As we explained in our guide to Law 18-07 and generative AI, transferring this data abroad generally requires authorisation.

Cybersecurity has also moved forward. Presidential Decree No. 26-07 of 7 January 2026 requires public institutions, administrations and bodies to set up a dedicated information systems security unit, separate from IT and reporting to the top executive. It must map risks, monitor systems continuously, report incidents without delay and ensure confidentiality clauses are written into subcontracting contracts. In March 2026, the Information Systems Security Agency, which reports to the Ministry of National Defence, presented the 2025-2029 national strategy, which lists AI among the technologies creating new attack surfaces.

Insider risk is often unintentional

When people hear "insider threat", they picture a malicious employee stealing files before leaving. That happens, and AI makes it easier: an assistant can summarise hundreds of confidential pages in seconds. But most leaks come from well-meaning staff who want to work faster. This shadow AI has a real cost that is rarely measured.

An engineer translating a technical report, a buyer comparing two bids, a lawyer rewording a clause: none of them thinks they are doing anything wrong. Yet once sent, the information is outside the company's control. Traditional network tools cannot see what is pasted into a prompt, as we explain in why email and network DLP fails on ChatGPT.

What a large state-owned company can do

Banning AI only pushes it onto personal phones. A sounder approach is to manage how it is used:

1. classify information: strategic technical data, commercial data, personal data;

2. map the AI tools in use, including those used by contractors on site;

3. offer approved tools for everyday tasks such as translation and summaries;

4. check on the workstation what is sent to an AI assistant, and block or anonymise sensitive content;

5. log every incident for the security unit, auditors and, where relevant, the ANPDP.

That last point matches the logging requirements of Law 25-11 and the incident reporting duty in Decree 26-07. Our 90-day rollout playbook sets out a practical timeline for a large organisation.

Detecting data that has no fixed format

A phone number is easy to spot. A well name, drilling coordinates or a tender reference are much harder. A DLP tool fit for this sector must learn the company's own markers: field names, project codes, classification keywords, in Arabic as well as French. That is what it takes to protect know-how, not just personal data.

In short

In Algerian energy, AI is arriving just as partnerships multiply and the state tightens information systems security. Technical and strategic data are the most exposed, often through well-meaning employees. Managing AI use, controlling what leaves and keeping a record of incidents is now a matter of sovereignty as much as compliance.

ZeusLock detects sensitive data and your company's own markers before they reach an AI assistant, blocks or anonymises them, and keeps a usable log. Book a demo to talk it through with our team.