Administrative measures 

In case of violations of the provisions of Law No. 18-07 by the controller, administrative measures are taken by the national authority: 

• warning;
• formal notice;
• provisional withdrawal for a period not exceeding one year, or definitive withdrawal of the declaration receipt or authorisation;
• a fine. 

The national authority may also impose fines on the controller which: 

• refuses, without legitimate reason, the rights of information, access, rectification or opposition;
• fails to make the required notifications to the national authority. 

Criminal sanctions 

Violation of the provisions of Law No. 18-07 is punishable by imprisonment and / or a fine. 

Article 47 to 74 of the law No. 18-07 provide that non-compliance with the Data Protection Law is punishable by a fine ranging from 20,000 DZD to 1,000,000 DZD and / or imprisonment between two months and five years.

Mandatory breach notification

Where the processing of personal data over electronic communication networks results in the destruction, loss, alteration, disclosure or unauthorised access of such data, the service provider must notify the national authority and the data subject without delay where such a breach may affect the privacy of the data subject. 

Failure by a service provider to notify the national authority or the data subject of a personal data breach is punishable by imprisonment and a fine.