Processes personal data, in Tunisia

Loi organique n° 2004-63 du 27 juillet 2004, portant sur la protection des données à caractère personnel, arts. 1-12, 16-26, 44-49, 53-61, 66-74, 104-105 (comprehensive regime) · Read the law's page

• File a prior declaration with the National Authority for the Protection of Personal Data (INPDP) before processing personal data, or obtain its prior authorization where the Act requires one.
• Collect and process personal data only for a lawful, determined and explicit purpose, and keep it accurate, precise and up to date.
• Do not make providing a service or granting a benefit conditional on a person accepting that their data be processed or reused for a purpose other than the one it was collected for.
• Take all necessary precautions to secure personal data against unauthorized modification, alteration or consultation, including physical access controls, a log of who accessed the system and when, and secure backup copies.
• Choose a subcontractor with care before delegating any processing to it, hold it to the Act's own obligations, and correct, complete or erase a file once you learn it is inaccurate or insufficient, notifying the person and any recipient within two months.
• Preserve the confidentiality of personal data and the information you process, even after the processing ends or you leave your position, unless the person consented in writing to its disclosure or the law provides otherwise.
• Tell the INPDP at least three months before permanently ceasing your processing activity, or within three months of a controller's death, bankruptcy or dissolution, so it can authorize the data's destruction.
• Destroy personal data once its declared or authorized retention period expires, its purpose is achieved, or it is no longer useful to your activity, by a bailiff's report made with an INPDP-appointed expert.
• Do not communicate personal data to a third party without the person's express consent given in a form leaving a written trace, unless a listed public security, defense or criminal prosecution exception applies.
• Obtain the INPDP's prior authorization before using video surveillance, confine it to the listed categories of place, never pair it with audio recording, and post clear, permanent notice that it is in use.

Loi organique n° 2004-63, arts. 13-15, 28, 62-65 (catégories particulières et mineurs) · Read the law's page

• Do not process personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record.
• Do not process data revealing racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express written consent, the data is already manifestly public, or the processing serves a historical, scientific or vital-interest purpose.
• Get the INPDP's separate authorization, decided within thirty days, before processing a special category of data under article 14, except health data.
• Process a child's personal data only with the guardian's consent and the family court's authorization, which can be withdrawn at any time, and apply that same rule wherever the Act requires a child's consent to collection, communication, transfer abroad, research disclosure or video recording.
• Process health data only through a physician or someone otherwise bound to professional secrecy, and only for a purpose article 62 lists such as the person's consent, a legal duty, public health protection, the person's own treatment, or health research.
• Get the INPDP's authorization before a physician shares health data with a research body, and never keep or use health data beyond the time its purpose requires.

Loi organique n° 2004-63, arts. 27, 29-43 (droits de la personne concernée) · Read the law's page

• Obtain the person's express, written consent before processing their personal data, and let them withdraw that consent at any time.
• Do not rely on a consent given for one form or purpose of processing to cover a different form or purpose, and do not process personal data for advertising without the person's separate, express consent.
• Give the person written notice, at least one month before processing their data, of its nature, the processing's purpose, whether their answer is mandatory or optional, the recipient's and your own identity and address, their rights of access, withdrawal and objection, the retention period, a summary of your security measures, and the destination country of any transfer.
• Let the person consult, correct, complete, rectify, update, clarify or erase their own personal data, and give them a copy in clear language and, where it was processed automatically, an intelligible form, free of charge, within one month of their request.
• Offer an electronic channel for a rectification, modification, correction or erasure request where you process personal data by automated means.
• Flag personal data as disputed for as long as its accuracy is contested.
• Stop processing a person's personal data immediately once they object for a valid, legitimate and serious reason, and honor an objection to communicating their data to third parties for advertising unconditionally.

Loi organique n° 2004-63, arts. 50-52 (transfert des données à l'étranger) · Read the law's page

• Never transfer or communicate personal data to a foreign country in a way capable of harming public security or Tunisia's vital interests.
• Before transferring personal data abroad, confirm the destination country assures an adequate level of protection, assessed against the data's nature, the processing's purpose and duration, and the safeguards in place.
• Obtain the INPDP's prior authorization before any transfer of personal data abroad, and route that request to the family court judge instead where the data concern a child.

Loi organique n° 2004-63, arts. 75-103 (l'Instance et les sanctions) · Read the law's page

• Cooperate with the INPDP's investigations, let it take statements and inspect the premises where processing took place other than a private home, and do not obstruct its work or give it inaccurate information in bad faith.
• Expect the INPDP to be able to withdraw your processing authorization or prohibit your processing, after a hearing, once it finds you have breached the Act, and expect a court to be able to add the same withdrawal or suspension on top of a criminal penalty.
• Expect criminal liability under Chapter VII for violating the Act, from two to five years' imprisonment and a fine of five thousand to fifty thousand dinars for an unlawful foreign transfer down to smaller fixed fines for narrower breaches, and expect that liability to fall personally on your legal or de facto director if you are a legal person.
• Expect a person harmed by your breach of the Act to be able to sue you civilly for it.

Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 17-20, 24-25 · Read the law's page

• This duty runs to the same Article 6 population: telecommunications and internet operators, interconnected enterprises, hosting and cloud providers, enterprises automatically processing their users' personal data over telecommunications networks, and state-designated vital digital infrastructure.
• Create your own cybersecurity emergency response center, or join a public, sectoral or private one, and have it coordinate with the national emergency-response contact point.
• Immediately inform the national contact point or your emergency response center of any cybersecurity incident or attack, and comply with the emergency measures either one orders.
• Where an incident or attack has disrupted your information system or communications network, or endangered the national cyberspace's security, remedy the failure within thirty days of the Agency's warning; in that same case the minister of communication technologies may decide, on the Agency's reasoned report, to isolate your information systems and networks temporarily, and the article does not make that decision depend on the thirty days having run.
• If you are classified at the first or second digital-trust level, expect a classification downgrade, rather than a fine, for failing to comply with an emergency measure, to remedy a failure within the article 17 deadline, or to create or join a response center.
• If you are classified at the third, unclassified level, expect a fine of 50,000 to 100,000 dinars for the same failures.

Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 6-9, 14-16, 24-25 · Read the law's page

• Where your service automatically processes your users' personal data while providing that service through Tunisia's telecommunications networks, you fall inside Article 6's mandatory-audit population; a telecommunications or internet operator, a hosting or cloud-computing provider, and a state-designated vital digital infrastructure are each named as their own separate category, and each falls inside that same population.
• Undergo a mandatory information-systems security audit, performed by an expert the National Cybersecurity Agency lists as authorized, at least once every twelve months.
• Submit a protected electronic copy of the audit report to the Agency within ten days of the audit's completion, and implement every security recommendation the report contains.
• Where you host a governmental electronic system or service, do so only with a hosting or cloud provider holding the government-cloud or national-cloud label; a first- or second-level organization that does not can be downgraded under article 24, and article 25 names no fine for this failure.
• Expect the Agency to classify you into one of three digital-trust levels from your audit compliance, your equipment and your hosting choices, and expect a formal notice giving you up to one year to meet the standard if you are classified at the lowest, unclassified level.
• If you are classified at the first or second level, expect the minister of communication technologies, on the Agency's reasoned report, to be able to downgrade your classification, rather than fine you, for failing to carry out the audit, to hand the Agency a copy of the audit report within the deadline, or to implement its recommendations within a year.
• If you are classified at the third, unclassified level, expect a fine of 50,000 to 100,000 dinars for failing to carry out the audit or to implement its recommendations (fully, within a year); article 25 does not list a late audit report copy or a breach of the hosting duty among the fined cases.