Tunisia. Comprehensive data protection. Organic Law
Organic Law 2004-63Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data
In force
§1Summary
- Synopsis
Recognises data protection as a fundamental right and requires declaration or authorisation from the INPDP, consent-based processing and prior authorisation for transfers abroad.
- Key themes
- Unique features
Transfers abroad need INPDP authorisation and data subject consent, with an INPDP adequacy list (Decision 3/2018); healthcare establishments must appoint DPOs.
- SaaS relevance
Tunisian customers of foreign SaaS need INPDP transfer authorisation and explicit consent.
§2Obligations
- Extraterritorial
- No
- Breach notification
- None under the law (cyber incidents to ANCS under Decree-Law 2023-17)
- DPO
- Conditional
- Cross-border transfers
- INPDP prior authorisation + consent + adequacy
- Maximum penalty
- Imprisonment and fines (e.g. 1 year + TND 5,000 for unauthorised transfer)
§3Dates
- Key dates
- Adopted
- In force
- INPDP created by Decree 2007-3003; Convention 108 and Additional Protocol in force for Tunisia 1 Nov 2017; GDPR-style draft bill (2018) not adopted
§4Text and authority
- Text
- Authoritative text inpdp.tn
- Authority
- Instance Nationale de Protection des Données Personnelles (INPDP)
§5Where it applies
- Domestic law of
- Tunisia
§6Sources and verification
- Verification
High confidence.