LexLint.ioBeta

Know the law your code answers to.

Law / Tunisia

Organic Act on the Protection of Personal Data

Loi organique n° 2004-63 du 27 juillet 2004 portant sur la protection des données à caractère personnel, arts. 1-12, 16-26, 44-49, 53-61, 66-74, 104-105 (comprehensive regime)

In force since .

A comprehensive regime rule binding public and private bodies.

Obligation class
Licensing, Governance, Security, Disclosure, Retention
Audit expectation
none

What it requires

  • File a prior declaration with the National Authority for the Protection of Personal Data (INPDP) before processing personal data, or obtain its prior authorization where the Act requires one.NIST Privacy FrameworkGV.PO-P5
  • Collect and process personal data only for a lawful, determined and explicit purpose, and keep it accurate, precise and up to date.NIST Privacy FrameworkGV.PO-P1
  • Do not make providing a service or granting a benefit conditional on a person accepting that their data be processed or reused for a purpose other than the one it was collected for.NIST Privacy FrameworkCT.PO-P1
  • Take all necessary precautions to secure personal data against unauthorized modification, alteration or consultation, including physical access controls, a log of who accessed the system and when, and secure backup copies.NIST Privacy FrameworkPR.AC-P2NIST Privacy FrameworkCT.DM-P8NIST Privacy FrameworkPR.PO-P3
  • Choose a subcontractor with care before delegating any processing to it, hold it to the Act's own obligations, and correct, complete or erase a file once you learn it is inaccurate or insufficient, notifying the person and any recipient within two months.NIST Privacy FrameworkID.DE-P3NIST Privacy FrameworkCM.AW-P5
  • Preserve the confidentiality of personal data and the information you process, even after the processing ends or you leave your position, unless the person consented in writing to its disclosure or the law provides otherwise.NIST Privacy FrameworkPR.PO-P9
  • Tell the INPDP at least three months before permanently ceasing your processing activity, or within three months of a controller's death, bankruptcy or dissolution, so it can authorize the data's destruction.NIST Privacy FrameworkGV.PO-P5
  • Destroy personal data once its declared or authorized retention period expires, its purpose is achieved, or it is no longer useful to your activity, by a bailiff's report made with an INPDP-appointed expert.NIST Privacy FrameworkCT.DM-P5
  • Do not communicate personal data to a third party without the person's express consent given in a form leaving a written trace, unless a listed public security, defense or criminal prosecution exception applies.NIST Privacy FrameworkCT.PO-P1
  • Obtain the INPDP's prior authorization before using video surveillance, confine it to the listed categories of place, never pair it with audio recording, and post clear, permanent notice that it is in use.NIST Privacy FrameworkGV.PO-P5NIST Privacy FrameworkCM.AW-P1

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework
  • ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
  • GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
  • GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
  • CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
  • CT.DM-P5Data are destroyed according to policy.
  • CT.DM-P8Audit/log records are determined, documented, implemented, and reviewed in accordance with policy and incorporating the principle of data minimization.
5 more
  • CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
  • CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
  • PR.PO-P3Backups of information are conducted, maintained, and tested.
  • PR.PO-P9Privacy procedures are included in human resources practices (e.g., deprovisioning, personnel screening).
  • PR.AC-P2Physical access to data and devices is managed.
NIST CSF 2.0
  • ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
FINOS AIGF

Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

What the log must hold

Event time, Actor identity, Access record

Logging duty

Article 19 lists the precautions that Article 18 requires of any person who processes personal data. One of them is to guarantee that the identity of the persons who accessed the information system, the data entered into it, the time of entry and the person who made it can be verified afterwards, which requires a record of access and entry. The Act sets no period for keeping that record. Articles 7 and 8 (a declaration to, or an authorization from, the INPDP), Article 24 (notice before ceasing activity) and Article 45 (a bailiff's record of the destruction of data) are filings or one-off records and not a log of processing. Articles 76 and 77 (the INPDP's access to processed data and its investigations) and Article 96 (the offence of refusing the documents it requires) sit outside the articles this row cites and are recorded on the row for the Authority. Article 22 makes Tunisian nationality, residence in Tunisia and a clean record conditions for the person who processes data; that is a condition on the processor and not a scope clause, and a nationality test gives no hook value, so the row names no jurisdiction hook.

Kind
Explicit
As of
Provision
Article 19, fifth indent (the precautions Article 18 requires must guarantee after-the-fact verification of who accessed the information system, what data were entered, when and by whom)
Trigger
personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Article premier declares personal data protection a fundamental, constitutionally guaranteed right, and articles 2 and 3 apply the Act to both automated and non-automated processing by a natural or legal person, exempting only processing for a strictly personal or family purpose not passed to a third party.

Article 7 requires a prior declaration to the INPDP before any processing, deemed accepted if the INPDP does not object within one month, and article 8 sets what an authorization request must contain wherever the Act requires one. Articles 9 to 12 require processing to respect human dignity and privacy, never to be used to harm a person's reputation, and to serve only the lawful, determined and explicit purpose it was collected for, kept accurate and current.

Article 17 bars conditioning a service or a benefit on accepting processing or reuse of personal data for another purpose, and articles 18 and 19 require the controller to take all necessary precautions against unauthorized access, modification or consultation, naming physical access controls, a log of who accessed the system and when, and secure backup copies.

Article 20 requires a controller delegating processing to choose its subcontractor with care and makes both civilly liable for a breach of the Act, and article 21 requires either to correct, complete or erase a file once its inaccuracy or insufficiency comes to light, notifying the person and any recipient within two months.

Article 22 confines the role of controller, subcontractor and their staff to Tunisian nationals resident in Tunisia with no criminal record, and article 23 binds them to confidentiality even after the processing ends.

Articles 24 to 26 require notice to the INPDP three months before ceasing a processing activity, or within three months of a controller's death, bankruptcy or dissolution, so the INPDP can authorize destruction or, in limited cases, communication of the data for historical or scientific use.

Articles 44 to 46 confine collection from third parties to cases where the person consents or a statutory exception applies, and require destruction once the declared retention period or purpose lapses, by a bailiff's report made with an INPDP-appointed expert.

Articles 47 to 49 bar communicating personal data to a third party without the person's express written consent, subject to public security, defense and criminal prosecution exceptions and to an INPDP-authorized override for vital interests, historical or scientific research, or contract performance.

Articles 53 to 61 exempt public authorities, local government and administrative public establishments acting for public security, defense, criminal prosecution or their statutory missions from the declaration, authorization, consent and several other duties above, while still requiring them to correct an inaccurate file and, for public bodies outside that narrower category, to answer a correction request.

Articles 66 to 68 confine data collected for scientific research to that purpose and bar disclosing an identified result unless the person consents or the disclosure concerns a phenomenon current at the time of presentation.

Articles 69 to 74 require the INPDP's prior authorization for video surveillance, confine its use to public places and their entrances, transport and parking facilities, and collective workplaces, bar pairing it with audio recording, and require clear, permanent public notice that it is in use. Articles 104 and 105 repeal the conflicting provisions of the 2000 electronic commerce law and gave existing processors one year from the Act's entry into force to comply.

The Act states no duty to notify the INPDP or an affected person of a personal data breach. An organic bill on the protection of personal data, filed by 17 members of the Assembly of the Representatives of the People on , remains in committee and has not been adopted.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example  ·  Lint your app

Page updated .