Algeria Law 18-07 and generative AI: what the ANPDP expects from companies

In many Algerian companies, generative AI came in through the back door. A customer advisor uses it to draft a letter, an HR officer to sort CVs, an accountant to analyze a spreadsheet. Nobody really decided it, and almost nobody declared it.

The catch is that Algeria has one of the most demanding data protection frameworks in the region. Law No. 18-07 of 10 June 2018, amended by Law No. 25-11 of 24 July 2025, requires prior formalities and strict control over transfers abroad. Pasting customer data into an AI assistant hosted outside the country runs straight into these rules.

AI is already there, just out of sight

There are no official figures on AI use in Algerian companies. A study by consultant Arnault Chatel, reported by Maghreb Émergent in September 2026, points out that banks, energy companies and retailers have said nothing on the subject. It does cite Microsoft's AI diffusion report: 13.2% of Algerians aged 15 to 64 used a generative AI tool in the first quarter of 2026.

The author believes AI is probably already widespread in offices, but invisible: employees use consumer tools without training or oversight, often without their managers knowing. That is exactly the scenario Law 18-07 makes risky.

The data involved is often the most sensitive the company holds: customer lists, salaries, occupational health files, contracts with foreign suppliers. Once it has been sent to an outside service, the company no longer controls how long it is kept or how it is reused.

The ANPDP is a very real regulator

The National Authority for the Protection of Personal Data (ANPDP) has been fully operational since August 2023. It does more than exist: it issues decisions. Since late 2025 it has set rules on the appointment of data protection officers, health data, video surveillance at work and biometric time tracking.

At the end of December 2025, the ANPDP set out how DPOs must be appointed, now a requirement for both public and private organizations. The DPO advises management, follows impact assessments and informs the authority and the people concerned when a data breach occurs. This person becomes the natural point of contact for every AI question, and should be consulted before any AI assistant is rolled out.

Declaration, authorization, transfer: three locks

Law 18-07 rests on a simple idea: the ANPDP should know what you do with personal data before you do it. Three mechanisms apply directly to AI:

1. Prior declaration: every processing operation must be declared to the ANPDP. Using AI on customer or employee data is a processing operation in its own right.

2. Prior authorization: processing that poses clear risks to privacy and freedoms requires authorization. Profiling or analyzing sensitive data with AI may fall into this category.

3. Transfers abroad: as a rule, these need ANPDP authorization unless one of the legal exceptions applies. The major AI assistants process data on servers located outside Algeria.

In other words, an employee who pastes a branch's list of unpaid accounts into ChatGPT carries out an undeclared processing operation and an unauthorized transfer in a single move. Penalties can reach five years in prison and fines of up to 500,000 dinars, depending on the offence.

What Law 25-11 changes

The July 2025 reform tightened the framework. It introduces the concepts of biometric data, profiling, pseudonymization and personal data breach. It also requires a register of processing activities and automatic logging of operations, which the ANPDP can ask to see. For a company, it is also a chance to bring some order to how data is used.

Logging matters a great deal for AI. During an inspection, a company will have to show what was processed, by whom and where it went. Without a tool that tracks exchanges with AI assistants, that is impossible. Our anatomy of an AI data leak shows how these leaks go unnoticed for months.

A realistic roadmap

Banning AI is neither desirable nor effective. Algerian companies are better off governing it, step by step:

• take stock of the AI tools actually in use, including on personal browsers;

• involve the DPO and record approved uses in the processing register;

• declare the relevant processing and request the necessary authorizations, especially for transfers;

• technically prevent personal data from leaving the device unchecked, by anonymizing it before it is sent;

• keep a record of incidents to answer the ANPDP.

Awareness alone is not enough, as we explain in why AI security training doesn't work. You need a safeguard at the moment the employee types the prompt. Format preserving anonymization keeps AI useful while removing names, account numbers or national ID numbers. To organize the rollout, our 90-day rollout playbook offers a concrete schedule.

In short

In Algeria, Law 18-07 and Law 25-11 turn generative AI into a compliance issue in its own right. The ANPDP is active, the DPO is mandatory, and transfers of data abroad require authorization. Companies that let employees use AI without control are taking a risk they cannot even measure.

ZeusLock detects sensitive data in prompts and files sent to AI assistants, anonymizes it, warns or blocks, and keeps a log you can rely on during an inspection. Book a demo to talk it through with our team.