TunisiaOrganic Act on the Protection of Personal Data, enforcement and sanctions
Loi organique n° 2004-63, arts. 75-103 (l'Instance et les sanctions)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Cooperate with the INPDP's investigations, let it take statements and inspect the premises where processing took place other than a private home, and do not obstruct its work or give it inaccurate information in bad faith.
- Expect the INPDP to be able to withdraw your processing authorization or prohibit your processing, after a hearing, once it finds you have breached the Act, and expect a court to be able to add the same withdrawal or suspension on top of a criminal penalty.
- Expect criminal liability under Chapter VII for violating the Act, from two to five years' imprisonment and a fine of five thousand to fifty thousand dinars for an unlawful foreign transfer down to smaller fixed fines for narrower breaches, and expect that liability to fall personally on your legal or de facto director if you are a legal person.
- Expect a person harmed by your breach of the Act to be able to sue you civilly for it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Chapter VII (arts. 86-103) makes most breaches of the Act criminal offences. Article 86 punishes a transfer or communication of personal data abroad capable of harming public security or Tunisia's vital interests with two to five years' imprisonment and a fine of 5,000 to 50,000 dinars, and punishes the attempt too. Article 87 fixes a flat two years and 10,000 dinars for violating the judicial-record prohibition (art. 13), the first paragraph of the special-category (art. 14), minors (art. 28) or health-secrecy (art. 63) provisions, the video-surveillance rules (arts. 70-71), or the basic consent, notice, third-party-collection or research-disclosure duties (arts. 27, 31, 44, 68). Articles 88 to 99 fix smaller, mostly fixed fines of 1,000 to 10,000 dinars and imprisonment from one month to two years for narrower breaches: coercing consent, profiting from or maliciously disclosing personal data, processing without declaration or authorization, unlawfully transferring or communicating data, ignoring an objection, obstructing access, breaching an INPDP-imposed safeguard, obstructing the INPDP or lying to it, and violating narrower notice or procedural duties. Article 100 lets a court additionally withdraw the processing authorization or suspend the processing, and article 101 extends personal liability to a legal person's legal or de facto director.
Penalty structure
Highest tier (art. 86): two to five years' imprisonment and a fine of 5,000 to 50,000 dinars for transferring or communicating personal data abroad in a way capable of harming public security or Tunisia's vital interests. Every other breach of the Act (arts. 87-99) carries its own, lower fixed fine, from 1,000 to 10,000 dinars, most paired with a prison term from one month to two years; the fine-only offences (arts. 95, 96, 98, 99) run 1,000 to 10,000 dinars with no prison term.
- Rule
- Fixed only
- As of
- Currency
- TND
- Fixed cap
- 50,000
Who enforces it
Enforcement body
Instance Nationale de Protection des Données à Caractère Personnel (INPDP)
Settledness
- As of
- Open questions
- Which transfers of personal data abroad are "susceptible de porter atteinte à la sécurité publique ou aux intérêts vitaux de la Tunisie" (likely to harm public security or Tunisia's vital interests) under article 50, the test that decides whether article 86's penalty of two to five years' imprisonment applies, when the definitions in article 6 define neither "sécurité publique" nor "intérêts vitaux"?
What it makes you log
Who may demand the log
Regulator
Logging duty
Articles 75 to 85 set up the INPDP. Article 76 lets it access personal data being processed in order to verify them, Article 77 lets it investigate on the premises where processing took place with no professional secrecy set against it, and Article 96 makes it an offence to obstruct it or to refuse the documents it requires. These are powers of the authority to check what a controller holds, and no record is named. The Act's record duty, the access record of Article 19, is on the comprehensive row; Article 94 penalizes a breach of Articles 18 and 19. Articles 86 to 103 are offences, penalties and procedure and name no record duty of the controller.
- Kind
- None
- As of
What this law does
Article 75 establishes the Instance Nationale de Protection des Données à Caractère Personnel (INPDP) as a body with legal personality and financial autonomy, seated in Tunis and budgeted through the ministry responsible for human rights.
Article 76 charges the INPDP with granting authorizations, receiving declarations, withdrawing them where the Act allows, receiving complaints, setting the safeguards personal data protection requires, accessing processed data to verify compliance, advising on the Act's application, and issuing codes of conduct.
Article 77 lets the INPDP investigate by taking statements and inspecting the premises where processing took place, other than a private home, with the assistance of sworn communications ministry agents, judicial experts or others it finds useful, and requires it to report offences it learns of to the public prosecutor, with no claim of professional secrecy standing against it.
Articles 78 to 80 set the INPDP's composition and its members' three year appointment by decree, bar any member from holding an interest in a data-processing business, and impose a lifetime confidentiality duty over what they learn in that role.
Article 81 lets the INPDP withdraw an authorization or prohibit processing that has breached the Act, after hearing the controller or subcontractor, and article 82 makes its decisions appealable to the Tunis Court of Appeal within one month, executable despite an appeal unless the court's first president stays them to prevent irreversible harm. Article 85 requires the INPDP to report annually to the President of the Republic.
Chapter VII sets tiered criminal penalties: article 86 punishes a transfer or communication of personal data abroad capable of harming public security or Tunisia's vital interests with two to five years' imprisonment and a fine of five thousand to fifty thousand dinars, and punishes the attempt too.
Article 87 fixes two years and ten thousand dinars for violating the judicial record prohibition, the first paragraph of the special category, minors or health secrecy provisions, or the video surveillance rules, and for violating the basic consent, notice, third-party collection or research disclosure duties.
Articles 88 to 99 fix lower, mostly smaller and shorter penalties for coercing consent, profiting from or maliciously disclosing personal data, processing without declaration or authorization, disclosing health data despite an INPDP ban, transferring or communicating data unlawfully, ignoring an objection, obstructing access, breaching an INPDP-imposed safeguard, obstructing the INPDP's investigations or lying to it, and violating narrower notice or dispute-flagging duties.
Article 100 lets a court additionally withdraw a processing authorization or suspend the processing on top of any other penalty. Article 101 makes the penalties for a legal person's offence fall personally on its legal or de facto director, where that director's responsibility for the acts committed is established. Articles 102 and 103 route these offences through the ordinary criminal procedure code and allow penal mediation for the narrower offences it lists.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .