DZ Privacy Compass

Open Algerian Data Protection Governance & Compliance Toolkit

Discover → Map → Assess → Implement → Operate → Evidence → Audit

Privacy governance built for Algeria. Open source by design.

Created and maintained by Taher Amine ELHOUARI
🌐 taheramine.org

---

🧭 What is DZ Privacy Compass?

DZ Privacy Compass is a privacy-first, self-hostable platform for implementing, operating, assessing, and evidencing an organisation's Algerian personal-data protection programme.

It brings legal requirements, processing activities, risks, evidence, DPO operations, data-subject rights, ANPDP readiness, privacy-by-design, assurance, reporting, and governance workflows into one operational workspace.

The project is centred on:

• Law 18-07 on the protection of individuals in the processing of personal data
• Law 25-11 amending and supplementing Law 18-07
• practical privacy governance and accountability
• evidence-based compliance and assurance

DZ Privacy Compass is independent open-source software. It is not an ANPDP or Algerian Government application and does not replace qualified legal advice.

---

✨ Built for real privacy operations

Area	What you can manage
🗺️ Data Mapping	Legal entities, departments, systems, data assets, processing activities and processor registers
⚖️ Legal & Compliance	Legal library, applicability, assessments, compliance mapping and legal dossiers
👤 DPO Governance	DPO activities, annual reporting, reviews and governance records
📨 Rights Management	Data-subject request workflows, deadlines, correspondence and status tracking
🏛️ ANPDP Readiness	Formality assessment, preparation workflows and readiness packs
🛡️ Risk & Assurance	Risks, controls, findings, corrective actions, audits and assurance activities
📁 Evidence Vault	Controlled evidence storage, SHA-256 integrity and authenticated retrieval
🌍 Third Parties & Transfers	Vendors, processors, subprocessors and international transfers
🧩 Privacy by Design	Privacy reviews and impact-assessment workflows
🔎 Special Reviews	Minors, sensitive data, biometrics, profiling and direct marketing
📊 Executive Dashboard	Operational privacy, compliance, risk, evidence and remediation indicators
📄 Reporting & Export	HTML, PDF, CSV, JSON and XLSX outputs where supported
🔐 Backup & Restore	Database + Evidence Vault backup, manifests, verification and controlled restore

---

📊 A dashboard for DPOs, CISOs and privacy leaders

DZ Privacy Compass is designed to answer operational questions quickly:

• How much of the legal framework has actually been assessed?
• What requires attention now?
• Which risks and actions are overdue?
• Where is evidence missing or stale?
• What privacy reviews are pending?
• What is happening across rights requests, incidents, vendors and transfers?
• What should management or the DPO focus on next?

Metrics are derived from real workspace data — not fabricated compliance scores.

---

🇩🇿 Legal integrity first

The legal model is intentionally conservative.

v1.0.0 includes:

• 104 legal provision records
• 58 source-verified operational requirement summaries
• deliberate coverage of all 76 Law 18-07 articles
• deliberate coverage of all 8 Law 25-11 amending articles
• 359 / 359 extracted clauses mechanically recovered from archived official sources
• 358 independently approved interpretations
• 1 explicitly quarantined interpretation rather than falsely presenting uncertainty as settled law

Official statutory text and DZ Privacy Compass implementation guidance are kept conceptually separate.

A specific guardrail is also enforced for Title V bis, which is treated as a specialised competent-authority criminal-justice regime rather than being indiscriminately applied to ordinary private-sector organisations.

For the full methodology, see LEGAL_METHODOLOGY.md and LEGAL_COVERAGE_REPORT.md.

---

🔐 Secure by default

Security is part of the product architecture, not an afterthought.

• Argon2id password hashing with deployment pepper
• opaque, revocable server-side sessions
• optional local TOTP MFA
• AES-256-GCM protection for MFA secrets
• one-use MFA recovery codes
• server-side RBAC
• workspace / tenant isolation
• exact-origin CSRF enforcement
• login throttling and lockout
• authenticated Evidence Vault retrieval
• SHA-256 evidence integrity
• upload type/signature validation
• tamper-evident audit and operation chains
• permission-aware search and exports
• secure response headers and CSP
• operator-mediated password and MFA recovery
• no required SaaS identity provider
• no required telemetry or external analytics

Archive uploads remain deliberately disabled until complete hostile-archive protections are implemented and validated.

See SECURITY.md and SECURITY/THREAT_MODEL.md.

---

🌐 Multilingual by design

DZ Privacy Compass supports:

🇫🇷 Français · 🇩🇿 العربية · 🇬🇧 English

Arabic includes proper RTL behavior, and the v1.0.0 release underwent browser validation across all three language foundations.

The interface supports:

• Dark
• Light
• System

themes and responsive desktop/laptop layouts.

---

🚀 Quick start — macOS

Requirements

• Node.js 22+
• npm
• Docker Desktop
• Git

Clone the repository and enter the project:

git clone https://github.com/MrTaherAmine/DZ-Privacy-Compass.git
cd DZ-Privacy-Compass

Run the guided local setup:

npm run local:setup

The setup process:

1. creates a safe local .env when one does not exist;
2. installs dependencies from the committed lockfile;
3. starts loopback-only PostgreSQL;
4. validates and generates Prisma;
5. applies the committed database migration;
6. seeds the fictional demo workspace and legal corpus.

Create your first local administrator:

DZPC_BOOTSTRAP_EMAIL='admin@example.test' \
DZPC_BOOTSTRAP_NAME='Local Administrator' \
DZPC_BOOTSTRAP_PASSWORD='replace-with-a-unique-long-password' \
DZPC_BOOTSTRAP_WORKSPACE='primary' \
DZPC_BOOTSTRAP_WORKSPACE_NAME='My Organisation' \
npm run admin:bootstrap

Verify the installation:

npm run local:verify

Then start the application:

npm run dev

Open:

http://localhost:3000

French is the default locale. Arabic and English are available through /ar and /en.

Never use the example administrator password literally. Choose a unique strong local password.

---

🐳 Docker deployment

Docker Compose is the primary packaged deployment model.

The application is designed so that the application runtime, PostgreSQL database and Evidence Vault can remain under the operator's control without mandatory cloud dependencies.

For production deployments, configure:

• TLS termination
• exact canonical APP_URL
• strong independent secrets
• persistent PostgreSQL storage
• persistent private Evidence Vault storage
• encrypted/off-host backups
• trusted proxy configuration where applicable

See DEPLOYMENT.md before exposing an installation beyond localhost.

---

🏗️ Architecture

┌─────────────────────────────────────────────────────────┐
│                    DZ Privacy Compass                   │
├─────────────────────────────────────────────────────────┤
│ Next.js 16 · React 19 · TypeScript                     │
│ App Router · Server-rendered application               │
├─────────────────────────────────────────────────────────┤
│ Authentication · MFA · RBAC · Workspace isolation      │
├─────────────────────────────────────────────────────────┤
│ Privacy · Legal · Risk · Evidence · DPO · Assurance    │
├─────────────────────────────────────────────────────────┤
│ Prisma ORM                                             │
├─────────────────────────────────────────────────────────┤
│ PostgreSQL 17                                          │
├─────────────────────────────────────────────────────────┤
│ Private Evidence Vault                                 │
└─────────────────────────────────────────────────────────┘

The project follows a security-conscious modular-monolith approach intended to remain understandable, deployable and maintainable without unnecessary infrastructure complexity.

For deeper technical detail, see ARCHITECTURE.md and API.md.

---

🧪 v1.0.0 validation

The final v1 release passed:

Validation area	Status
Clean locked dependency install	✅
Lint & TypeScript	✅
Automated regression suite	✅
Production build	✅
Prisma validation & generation	✅
Fresh PostgreSQL migration	✅
Legal corpus verification	✅
Authentication & MFA	✅
RBAC & tenant isolation	✅
Origin / CSRF / session controls	✅
Representative CRUD	✅
Evidence Vault integrity	✅
Reports & exports	✅
Database + Evidence Vault restore	✅
FR / AR / EN browser QA	✅
RTL & responsive validation	✅
Docker clean start	✅
Dependency audit	✅
SBOM generation	✅
Container security scan	✅
Reproducible source artifact	✅

The release process and evidence are documented in RELEASE_CHECKLIST.md, RELEASE.md, TESTING.md, and release-evidence/.

---

📚 Documentation

Document	Purpose
ARCHITECTURE.md	System architecture
API.md	API documentation
DEPLOYMENT.md	Production deployment
DEVELOPMENT.md	Development environment
SECURITY.md	Security model and reporting
BACKUP_RESTORE.md	Backup and restore
LEGAL_METHODOLOGY.md	Legal research methodology
LEGAL_COVERAGE_REPORT.md	Legal coverage
TESTING.md	Testing strategy
TRANSLATION.md	FR / AR / EN guidance
CONTRIBUTING.md	Contribution rules
CHANGELOG.md	Release history
ROADMAP.md	Future direction

---

🤝 Contributing

Contributions are welcome.

The most important rule is simple:

Do not invent legal requirements.

Contributions affecting legal content should be traceable to authoritative primary sources and include appropriate verification evidence and tests.

Please also:

• never commit client data;
• never commit credentials or secrets;
• preserve tenant-isolation and authorization controls;
• add regression coverage for behavioral changes;
• keep legal interpretation uncertainty explicit rather than silently resolving it.

See CONTRIBUTING.md.

---

🛡️ Vulnerability reporting

Please do not publish exploit details in public GitHub issues.

Use the private maintainer contact route described in SECURITY.md.

Cross-tenant access, authentication bypass, Evidence Vault disclosure, integrity-chain bypass, and secret exposure are treated as release-blocking security defects.

---

⚖️ Disclaimer

DZ Privacy Compass is an independent open-source project.

It:

• is not ANPDP;
• is not an Algerian Government application;
• does not issue certification;
• does not guarantee legal compliance;
• does not replace qualified legal, privacy, cybersecurity or regulatory advice.

Organisations remain responsible for evaluating their own legal and operational circumstances.

See DISCLAIMER.md.

---

📜 License

Licensed under the Apache License 2.0.

See LICENSE, NOTICE, and CITATION.cff.

If you use DZ Privacy Compass in research, training, advisory work or publications, citation is appreciated.

---

Built for organisations. Designed for trust. Open for all.

Created by Taher Amine ELHOUARI

Independent vCISO · Senior Advisor · Accredited Auditor · Certified Trainer

Website · GitHub

DZ Privacy Compass · v1.0.0