Algeria's personal data law applies the moment your business sends a customer's message to an AI model. Here is what it covers, where AI meets it, and the steps that keep your data flows within it.
Answers
Algeria Law 18-07 personal data protection
Your business uses AI: a support bot, a summarising tool, a chat window your staff use every day. Somewhere in those messages are names, phone numbers and details about real people.
Algeria has a law for that. This guide explains what it covers, where AI meets it, and what to do. Each section leads to an article that goes further.
Law 18-07 of 10 June 2018 protects people when their personal data is processed. It applies to companies, administrations, associations and freelancers alike.
Processing means any operation on personal data: collecting it, storing it, reading it, sending it. Its role in the law is to decide when the rules start to apply.
Personal data is any information that identifies a person, directly or not. A name, a phone number, an address and a medical detail all count. So does a mix of details that points to one person.
The law created a national authority to supervise it: the ANPDP, the national authority for the protection of personal data. Some processing must be declared to it, and some needs its authorisation first.
We are a small company. Does the law really apply to us?
Yes. The law does not set a size below which it stops. A freelancer processing his clients' data and a bank processing millions of accounts answer to the same text.
An AI model needs to read a message to answer it. In most cases, the model runs on a provider's servers outside Algeria.
So when your app sends a customer's message to a model, that message travels abroad. If it holds personal data, that is a transfer abroad, and the law conditions it, notably on the ANPDP's authorisation.
The article on hosting data under Law 18-07 follows that path from the user's message to the model, and shows where the personal data hides.
A transfer abroad is not only a database copied to a foreign server. A single customer message sent to a model abroad can be one.
Most businesses do not plan to send personal data to a model. It arrives inside what people type and upload.
Look at three places. Your forms, where customers write freely. Your chats, where staff paste emails and files. Your documents, where contracts and reports carry names on every page.
Let's see right away what one ordinary message carries.
A customer writes his name, his phone number and his address, then asks where his order is. Three pieces of personal data travel with one question about a parcel. The answer needed none of them.
The best protection is to send less. Remove what the answer does not need before any model sees it.
On OpenDunes, requests arrive in Algeria before they reach a model, and your privacy settings decide what happens next. Redact replaces the personal data a message contains before sending it. Block rejects the request. Warn records the detection and sends anyway.
The same settings let you turn off training on your data, so requests go only to providers that do not train on them. Zero data retention limits routing to providers that do not keep request data.
Send every message as it was typed, and trust that nothing personal is inside.
Turn Redact on, turn training off, and keep only the fields each answer truly needs.
Some professions carry a duty older than Law 18-07. Doctors, lawyers and others are bound by professional secrecy, and the Penal Code punishes its breach.
For them, removing names is the start, not the end. A rare diagnosis and a small town can identify a patient as surely as a name. The article on professional secrecy and artificial intelligence sets out how to strip a document before any tool reads it.
The law also matters in the other direction: when you ask a model about it. A general model may answer a question on Algerian law with another country's code, article numbers included.
The fix is to give the model the official text from the Journal officiel and ask it to quote the passage it relies on. The article on artificial intelligence and Algerian law shows how to build answers you can verify.
Here is the order to work in, from the first look to the daily habit:
These steps sit under Law and privacy, with the other questions on AI and the law in Algeria.