Tunisia
ModerateOrganic Law No. 2004-63 on the Protection of Personal Data
Authority: Instance Nationale de Protection des Données Personnelles (INPDP) | Enforcement: partial | Enacted: July 2004
Overview
Tunisia was one of the first African countries to enact data protection legislation in 2004. The INPDP was established as the supervisory authority. The law covers consent, data subject rights, and cross-border transfers, though enforcement resources are limited.
14-Topic Coverage
Data Protection Authority
Fully AddressedINPDP oversees compliance and handles complaints. Limited enforcement resources.
Consent Requirements
Fully AddressedConsent of the data subject required for processing.
Data Subject Rights
Fully AddressedRights to access, rectification, and objection.
Cross-Border Transfer
Fully AddressedTransfers to countries with adequate protection or with INPDP authorisation.
Breach Notification
Not AddressedNo mandatory breach notification requirement.
DPO Requirements
Partially AddressedData processors must declare processing to INPDP. No formal DPO role.
Children's Data
Partially AddressedGeneral provisions apply. Parental consent for minors implied.
Penalties & Enforcement
Fully AddressedFines and imprisonment up to 2 years for violations.
Sector-Specific Rules
Partially AddressedBanking and health sector data guidelines.
Cookie/Tracking
Not AddressedNo specific cookie regulation.
AI & Automated Decisions
Not AddressedNo specific provisions on automated decisions.
Data Localisation
Not AddressedNo general data localisation requirement.
Significant Data Fiduciary
Not AddressedNo equivalent concept.
Government Data
Partially AddressedLaw applies to government processing with national security exemptions.
Coverage Summary
Quick Navigation
Need Compliance Help?
Our data privacy team can help you navigate Tunisia's regulations.
Book a Consultation