🇹🇳
Tunisia
Organic Act No. 2004-63 on the Protection of Personal Data
Africa🔵 Substantial
Compliance Score
36%
5 Addressed
7 Partial
2 None
Authority
National Authority for the Protection of Personal Data (INPDP)
Overview
Tunisia's Organic Act No. 2004-63 establishes personal-data protections and an oversight authority, the INPDP. The framework predates many modern GDPR-style laws; check current reforms and implementation practice.
14-Topic Coverage Analysis
Data Protection Authority
AddressedConsent Requirements
AddressedData Subject Rights
AddressedCross-Border Transfer
AddressedBreach Notification
PartialDPO Requirements
PartialChildren's Data
PartialPenalties & Enforcement
AddressedSector-Specific Rules
PartialCookie/Tracking
PartialAI & Automated Decisions
NoneData Localisation
PartialSignificant Data Fiduciary
NoneGovernment Data
Partial? Frequently Asked Questions
What is the primary data protection law in Tunisia?+
Tunisia is governed by the Organic Act No. 2004-63 on the Protection of Personal Data. The law is enforced by the National Authority for the Protection of Personal Data (INPDP). According to our analysis, the country has a Substantial level of data protection framework.
Does Tunisia require a Data Protection Officer (DPO)?+
Partially. The Organic Act No. 2004-63 on the Protection of Personal Data may require a DPO only for specific high-risk organizations or sectors. It is not universally mandatory for all businesses.
What are the data localisation rules in Tunisia?+
Partially. While Organic Act No. 2004-63 on the Protection of Personal Data may not mandate general localisation, specific sectoral laws (like finance or health) might require data to be stored locally.
What are the breach notification requirements in Tunisia?+
The Organic Act No. 2004-63 on the Protection of Personal Data has limited breach notification requirements. It may only require notifying the regulator, without mandating notification to affected individuals.