Handles health records, in Tunisia

Loi organique n° 2004-63, arts. 13-15, 28, 62-65 (catégories particulières et mineurs) · Read the law's page

• Do not process personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record.
• Do not process data revealing racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express written consent, the data is already manifestly public, or the processing serves a historical, scientific or vital-interest purpose.
• Get the INPDP's separate authorization, decided within thirty days, before processing a special category of data under article 14, except health data.
• Process a child's personal data only with the guardian's consent and the family court's authorization, which can be withdrawn at any time, and apply that same rule wherever the Act requires a child's consent to collection, communication, transfer abroad, research disclosure or video recording.
• Process health data only through a physician or someone otherwise bound to professional secrecy, and only for a purpose article 62 lists such as the person's consent, a legal duty, public health protection, the person's own treatment, or health research.
• Get the INPDP's authorization before a physician shares health data with a research body, and never keep or use health data beyond the time its purpose requires.

Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 17-20, 24-25 · Read the law's page

• This duty runs to the same Article 6 population: telecommunications and internet operators, interconnected enterprises, hosting and cloud providers, enterprises automatically processing their users' personal data over telecommunications networks, and state-designated vital digital infrastructure.
• Create your own cybersecurity emergency response center, or join a public, sectoral or private one, and have it coordinate with the national emergency-response contact point.
• Immediately inform the national contact point or your emergency response center of any cybersecurity incident or attack, and comply with the emergency measures either one orders.
• Where an incident or attack has disrupted your information system or communications network, or endangered the national cyberspace's security, remedy the failure within thirty days of the Agency's warning; in that same case the minister of communication technologies may decide, on the Agency's reasoned report, to isolate your information systems and networks temporarily, and the article does not make that decision depend on the thirty days having run.
• If you are classified at the first or second digital-trust level, expect a classification downgrade, rather than a fine, for failing to comply with an emergency measure, to remedy a failure within the article 17 deadline, or to create or join a response center.
• If you are classified at the third, unclassified level, expect a fine of 50,000 to 100,000 dinars for the same failures.

Décret-loi n° 2023-17 du 11 mars 2023, relatif à la cybersécurité, Arts. 6-9, 14-16, 24-25 · Read the law's page

• Where your service automatically processes your users' personal data while providing that service through Tunisia's telecommunications networks, you fall inside Article 6's mandatory-audit population; a telecommunications or internet operator, a hosting or cloud-computing provider, and a state-designated vital digital infrastructure are each named as their own separate category, and each falls inside that same population.
• Undergo a mandatory information-systems security audit, performed by an expert the National Cybersecurity Agency lists as authorized, at least once every twelve months.
• Submit a protected electronic copy of the audit report to the Agency within ten days of the audit's completion, and implement every security recommendation the report contains.
• Where you host a governmental electronic system or service, do so only with a hosting or cloud provider holding the government-cloud or national-cloud label; a first- or second-level organization that does not can be downgraded under article 24, and article 25 names no fine for this failure.
• Expect the Agency to classify you into one of three digital-trust levels from your audit compliance, your equipment and your hosting choices, and expect a formal notice giving you up to one year to meet the standard if you are classified at the lowest, unclassified level.
• If you are classified at the first or second level, expect the minister of communication technologies, on the Agency's reasoned report, to be able to downgrade your classification, rather than fine you, for failing to carry out the audit, to hand the Agency a copy of the audit report within the deadline, or to implement its recommendations within a year.
• If you are classified at the third, unclassified level, expect a fine of 50,000 to 100,000 dinars for failing to carry out the audit or to implement its recommendations (fully, within a year); article 25 does not list a late audit report copy or a breach of the hosting duty among the fined cases.