Algeria

Art. 41 bis of Law 18-07, inserted by Law 25-11, requires the controller to designate a data protection officer chosen for professional qualities, and Art. 41 bis 1 lets one officer serve several controllers depending on size and structure. The officer advises on compliance and impact assessments and is the contact with the national authority.

Art. 41 of Presidential Decree 20-05 requires institutions, administrations, public bodies and private operators to designate a person responsible for information system security within one year of the decree's publication. The text read contains no incident-reporting duty.

Art. 7 of Law 18-07 makes express consent the rule for processing, with exceptions such as legal obligation, contract performance and public interest; Art. 8 requires a representative's consent for children's data. Controllers must inform data subjects (Art. 32) and honour access (Art. 34), rectification and erasure, to be carried out within ten days of a request (Art. 35), and objection (Art. 36). Processing needs a prior declaration or authorisation (Arts. 12-20).

Art. 45 bis 8 of Law 18-07, inserted by Law 25-11, requires the controller to notify the national authority of a personal data breach no later than five days after becoming aware of it, stating the reasons if later. Processors must tell the controller as soon as they learn of it. Art. 45 bis 10 requires notice to the data subject where the breach is likely to pose a high risk. Controllers must document all breaches (Art. 45 bis 9).

Art. 14 of Law 05-01 (as amended by Art. 6 of Law 23-01) requires customer due-diligence documents to be kept for at least five years after account closure, the end of the business relationship or the occasional transaction. Art. 10 bis 4 requires operation records to be kept at least five years after the operation ends.

Art. 20 of Law 05-01 requires a declaration to the specialised body (the CTRF, per Art. 4) where funds appear to come from a crime or offence or to be linked to terrorist financing. Follow-up information must be sent without delay.

Art. 35 of COSOB Regulation 24-01 requires each covered entity to appoint at least one senior executive, at general management level, as compliance officer and main contact for the CTRF, with independence and access to records.

Arts. 46-47 of COSOB Regulation 24-01 require due-diligence documents, account records and correspondence to be kept at least five years after account closure or end of the relationship, and transaction records at least five years after execution.

Arts. 22, 43 and 45 of COSOB Regulation 24-01 require a report to the CTRF as soon as suspicion arises, including after the transaction is completed, and immediately where due diligence cannot be completed.

Art. 8 of Law 18-05 requires e-commerce to be carried out by a provider registered in the trade or craft register, using a website or page hosted in Algeria with the .com.dz extension. Art. 9 requires the domain name to be filed with the national trade register centre, and Art. 25 requires transaction records to be kept and sent to that centre.

Art. 11 of Law 09-04 requires service providers to keep data identifying users, terminal equipment, communication details and visited sites for one year from recording. Art. 10 requires them to help investigators collect communication content in real time and keep the operations confidential.