Cold outreach by email, SMS or phone in Algeria: what law 18-07 on personal data says

Buying or collecting a list of contacts and sending them a commercial offer they never asked for is exactly what article 37 of law 18-07 targets. The text is stricter than many guides say: prior consent is the rule, and penalties go up to three years in prison. Here is what the Official Journal says, and what we could not confirm.

The main rule

Article 37 bans direct marketing by automated calling system, fax, email or “means using technology of the same nature” that uses the contact details of an individual who has not given prior consent. Article 7 specifies that consent must be express and that the person can withdraw it. Article 36 also gives the right to object, notably to commercial marketing.

The exception for customers

Email marketing is allowed in one case: you collected the address directly from the person, on the occasion of a sale or service, and what you offer is similar (same person or same company). The person must then be able to refuse, free of charge and clearly, in every message. You must not hide your identity, and the subject of the message must relate to the service.

The penalties

Article 55 punishes with one to three years’ imprisonment and a fine of 100,000 to 300,000 DA anyone who processes data without respecting article 7 or despite the person’s objection. Article 56 targets processing without the conditions of article 12, that is, without prior declaration or authorisation by the national authority. If you keep a prospect database, look at that obligation too.

What law 25-11 changed

Law 25-11 of 24 July 2025 amends law 18-07. In the copy we read, it leaves articles 7, 36, 37 and 55 alone. It adds organisational duties: a data protection officer, registers and logs, breach notification within five days, impact assessments. We mark this “to verify” because the copy is not the Official Journal.

What we do not know

Three questions have no written answer in what we read. Do SMS, WhatsApp and direct messages fall within the “means of the same nature” wording? Is a named business address (firstname.lastname@company) the contact detail of an “individual”? Is a B2B contact protected like a private person? When in doubt, treat the contact like a private person.

A prudent practice

Build your lists with consent you can prove: an unticked box, the date, the source. In each message say who you are, why the person is getting it and how to unsubscribe in one click. Honour unsubscriptions at once and keep the record. Avoid buying lists whose origin you do not know. For the invoicing of what you then sell, see the auto-entrepreneur invoice; for paid campaigns, the Meta Ads guide.

We show no contact card for the national personal data protection authority (ANPDP): its website was unreachable when we checked, and we do not publish contact details we have not read on an official page.

This article is not legal advice: for a large-scale campaign, have your process reviewed by a lawyer.