TunisiaOrganic Act on the Protection of Personal Data, cross-border transfer
Loi organique n° 2004-63, arts. 50-52 (transfert des données à l'étranger)
In force since .
A cross border transfer rule binding public and private bodies.
- Obligation class
- Transfer, Access restriction
- Audit expectation
- none
What it requires
- Never transfer or communicate personal data to a foreign country in a way capable of harming public security or Tunisia's vital interests.
- Before transferring personal data abroad, confirm the destination country assures an adequate level of protection, assessed against the data's nature, the processing's purpose and duration, and the safeguards in place.
- Obtain the INPDP's prior authorization before any transfer of personal data abroad, and route that request to the family court judge instead where the data concern a child.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Article 50 bars transfer abroad where it may harm public security or Tunisia's vital interests, Article 51 permits transfer only to a country with an adequate level of protection, and Article 52 makes the INPDP's authorization compulsory. These are conditions on transfer. None of the three asks for a log or record of transfers or names an audit.
- Kind
- None
- As of
What this law does
Article 50 bars communicating or transferring personal data to a foreign country in any case capable of harming public security or Tunisia's vital interests, a bar no authorization can cure.
Article 51 permits transferring personal data undergoing or destined for processing only to a country that assures an adequate level of protection, assessed against the nature of the data, the purpose and duration of the processing, the destination country, and the safeguards in place, and requires every transfer to otherwise meet the Act's conditions.
Article 52 makes the INPDP's prior authorization mandatory for every transfer of personal data abroad, requires the INPDP to decide within one month of the request, and routes the request to the family court judge rather than the INPDP where the data to be transferred concern a child.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .