In this article
The bottom line Algerian law does not require all data to be hosted in the country. It strictly regulates personal data leaving for abroad, and a few cases require local hosting. The right decision is not made for "IT" as a whole: it is made data by data, knowing what each one contains.
What the law actually requires
Personal data. Law 18-07 of 10 June 2018 protects the data of natural persons: customers, employees, applicants, patients, users. Its articles 44 and 45 regulate transfers to a foreign country, which require authorisation from the national personal data protection authority (ANPDP). Law 25-11 of 24 July 2025, which amended law 18-07, left those two articles unchanged. It did, however, make a data protection officer and a register of processing operations mandatory, and the register must list recipients located abroad.
In practice, email, payroll software, a CRM or a backup hosted outside Algeria almost always contain personal data. Placing them abroad is a transfer within the meaning of the law.
E-commerce. Law 18-05 of 10 May 2018 requires e-suppliers to have a website hosted in Algeria, with a ".com.dz" domain. A company selling online to consumers is covered.
Cloud providers. The telecom regulator's specifications require cloud providers licensed in Algeria to host their databases on national territory. Choosing a locally licensed host therefore means the data stays in the country.
Regulated sectors. Banks, insurers, healthcare and public bodies have their own rules or contractual requirements. For public bodies, decree 26-07 on cybersecurity adds a control requirement over their providers. Check your sector's rules before deciding.
Not all data is equal
Before choosing where to host, classify what you host. An example for a mid-sized manufacturing company:
| Data or application | Personal data? | What it implies |
|---|---|---|
| Brochure website | Usually not | Can be hosted anywhere |
| Yes | Regulated transfer if hosted abroad | |
| ERP and invoicing | Yes (customers, suppliers) | Regulated transfer if hosted abroad |
| Payroll and HR | Yes, and sensitive | Preferably kept in Algeria |
| Customer files and CRM | Yes | Regulated transfer if hosted abroad |
| Backups | Yes (a copy of everything else) | Follow the rule of the most sensitive data |
The last row is the one most often forgotten: a backup sent abroad transfers all the data it holds, payroll included.
Three possible locations
For each block there are three answers, and not all of them are cloud:
- Local servers, outside the cloud, in your own premises. Full control, but physical security, power, cooling, backups and maintenance are yours to handle.
- A host or cloud in Algeria. The data stays in the country and a third party runs the infrastructure. Algérie Télécom operates its own data centres, and several operators and hosts offer colocation and virtual servers.
- An international provider. The richest and most mature services, but personal data goes abroad, so ANPDP authorisation is needed, and billing is in foreign currency, which remains a real constraint for many companies.
The state is also investing in its own infrastructure: the Algerian national digital services centre in Mohammadia was inaugurated on 5 July 2026. It is public infrastructure, not a commercial offer open to companies.
Choosing between these options follows the same logic as choosing between public, private or hybrid cloud: there is no right model in general, only a right model for each use.
Questions to ask an Algerian host
Local hosting is neither reliable nor risky by nature. It has to be checked:
- Where exactly are the servers, and where is the backup made? A second copy on another site is essential.
- What power and network redundancy: backup power, dual connections, stated autonomy.
- What service commitments: availability, response time, penalties.
- Which certifications or audits can be shown.
- How you get your data back at the end of the contract, in what format and how quickly.
A four-step method
- Inventory applications and data, including tools adopted by teams without going through IT.
- Classify each block: personal data or not, sensitive or not, sector obligations.
- Decide the location block by block, recording the reason, and file an ANPDP authorisation request for whatever goes abroad.
- Put it in the contract: data location written down in black and white, reversibility, incident notification.
This approach is at the heart of our cloud migration and hosting work. It also underpins data security, because you protect better what you have located.
Frequently asked questions
Can an Algerian company use Microsoft 365 or Google Workspace?
These services are hosted outside Algeria. Email and documents contain personal data, so the law 18-07 regime for transfers abroad applies. The question to settle is mainly regulatory: ANPDP authorisation, informing the people concerned, recording it in the register of processing operations.
Does everything have to be brought back to Algeria?
No. A brochure website without personal data can stay where it is. Payroll, customer files, email and backups are what need a considered decision, case by case.
Are servers in our own premises a cloud?
No. Servers installed in your premises remain local infrastructure that you run yourself. Cloud means resources supplied and run by a provider, in Algeria or abroad.
Sources: law 18-07 of 10 June 2018 and law 25-11 of 24 July 2025 (Official Journal no. 48), ANPDP notice relayed by Radio Algérie, ARPT cloud specifications, APS.