Law 18-07 and prospecting: what you are allowed to do

Law no. 18-07 on the protection of natural persons in the processing of personal data is Algeria's reference text on the subject. It is regularly quoted, rarely read, and almost always confused with the European GDPR.

Here is what it means when your job is to contact companies.

This article is a reading guide, not legal advice. For anything that engages your liability, consult a lawyer.

What the law protects: people, not companies

This is the most useful distinction, and the one most often missed. Law 18-07 protects natural persons. A corporate name, a switchboard number, a registered-office address or a generic contact@ email address are not, in themselves, personal data.

On the other hand, as soon as a piece of data identifies a person — karim.benali@company.dz, a mobile number attached to a named manager, a job title tied to a name — you are within the scope of the law.

In practice: a file of companies with switchboards and generic emails and a file of named contacts are not handled the same way. The second one calls for discipline.

Three obligations that bear directly on prospecting

A stated purpose. You must know — and be able to say — why you hold this data. "B2B commercial prospecting" is a legitimate and sufficient purpose. What causes problems is collection with no object: building up a stockpile "just in case".

A right of access, rectification and erasure. Someone who writes to ask what you hold about them, or to be removed from your lists, must get an answer and an effect. That means being able to find a contact in your files — which is impossible with fifteen Excel files scattered across a sales team.

Limited retention. A contact who has not replied in three years no longer has any reason to be in your database. Purging is not only an obligation, it is also what keeps a file useful.

What the law does not forbid

Contacting a company you have never met remains perfectly legal. Cold B2B prospecting is not prohibited by Law 18-07.

What is regulated is where the data comes from and what you do with it:

• collecting from public, accessible sources: yes;
• buying a file whose seller cannot say where it came from: this is where the risk starts, because you inherit their collection;
• reselling to a third party data collected for your own prospecting: no, unless you planned for it and said so.

The question to ask any data provider

Just one, and it settles the matter: where does this data come from?

A provider who cannot answer precisely is transferring their risk to you. "From our proprietary database" is not an answer — it is a way of not giving one.

For Linkiw, the answer is public and fits in one sentence: public and legal sources only — professional registers, business mapping services, companies' own official websites. We buy no lists and use no database of opaque origin.

As for your own data, we apply the same law: consent collected at sign-up, rights of access, rectification and erasure from your settings, and no resale to third parties. The detail is in our privacy policy.

What to remember

• The law protects natural persons, not companies.
• Cold B2B prospecting remains legal.
• The origin of the data is where your liability is decided.
• A named contact must be findable and erasable on request.
• A file whose seller cannot account for its origin is a risk you are buying.