Law 18-07: where must health data be hosted in Algeria?
Law 18-07 governs the processing of personal data in Algeria and reserves a particular regime for health data. What that means in practice when choosing clinic software.
Law no. 18-07 governs the processing of personal data in Algeria and classes health data among sensitive data, subject to a reinforced regime. For a care establishment, the practical consequence is simple: where the data is hosted and who controls access become selection criteria, not technical details.
This article sets out general principles and does not constitute legal advice. Have your own situation validated by a lawyer.
What does Law 18-07 say in substance?
Adopted in 2018, it establishes the framework for processing personal data: consent of the data subject, a specified purpose, proportionality of the data collected, limited retention, and rights of access and rectification for the data subject.
It also establishes a national supervisory authority, and provides for either a declaration or an authorisation regime depending on the nature of the processing.
Why is health data treated separately?
Because it falls into the category of sensitive data. A piece of health data reveals far more than a name: it exposes a person to lasting discrimination in employment, insurance or social life.
Its processing is therefore subject to stricter conditions than that of an ordinary customer file, and the establishment remains responsible for what becomes of it, including when it entrusts hosting to a third party.
What does the hosting choice actually change?
| Question | Foreign online service | Server in the establishment |
|---|---|---|
| Where is the data physically? | Often outside Algeria | Within your walls |
| Who can technically access it? | The supplier and its subcontractors | Your administrators |
| What happens in a dispute? | Law of the hosting country | Algerian law |
| Proof of location | By declaration | Physical |
| Effect of an internet outage | Service unavailable | None |
What if the software uses artificial intelligence?
This is the point most often overlooked. Software can perfectly well store its data in Algeria while sending every question put to its assistant off to a foreign AI service. The patient record then leaves the country by the back door.
The only robust answer is to run the language model on the establishment's own hardware. That is technically possible today, with open models served locally.
What should you ask before signing?
Where is the data physically stored? Do the AI features call an external service? Who, at the supplier, can access the database? What becomes of the data at the end of the contract? Does the software work without an internet connection?
Require the answers in writing. A serious supplier provides them without difficulty.
Updated Aug. 11, 2026