Organic Act on the Protection of Personal Data

Article premier declares personal data protection a fundamental, constitutionally guaranteed right, and articles 2 and 3 apply the Act to both automated and non-automated processing by a natural or legal person, exempting only processing for a strictly personal or family purpose not passed to a third party.

Article 7 requires a prior declaration to the INPDP before any processing, deemed accepted if the INPDP does not object within one month, and article 8 sets what an authorization request must contain wherever the Act requires one. Articles 9 to 12 require processing to respect human dignity and privacy, never to be used to harm a person's reputation, and to serve only the lawful, determined and explicit purpose it was collected for, kept accurate and current.

Article 17 bars conditioning a service or a benefit on accepting processing or reuse of personal data for another purpose, and articles 18 and 19 require the controller to take all necessary precautions against unauthorized access, modification or consultation, naming physical access controls, a log of who accessed the system and when, and secure backup copies.

Article 20 requires a controller delegating processing to choose its subcontractor with care and makes both civilly liable for a breach of the Act, and article 21 requires either to correct, complete or erase a file once its inaccuracy or insufficiency comes to light, notifying the person and any recipient within two months.

Article 22 confines the role of controller, subcontractor and their staff to Tunisian nationals resident in Tunisia with no criminal record, and article 23 binds them to confidentiality even after the processing ends.

Articles 24 to 26 require notice to the INPDP three months before ceasing a processing activity, or within three months of a controller's death, bankruptcy or dissolution, so the INPDP can authorize destruction or, in limited cases, communication of the data for historical or scientific use.

Articles 44 to 46 confine collection from third parties to cases where the person consents or a statutory exception applies, and require destruction once the declared retention period or purpose lapses, by a bailiff's report made with an INPDP-appointed expert.

Articles 47 to 49 bar communicating personal data to a third party without the person's express written consent, subject to public security, defense and criminal prosecution exceptions and to an INPDP-authorized override for vital interests, historical or scientific research, or contract performance.

Articles 53 to 61 exempt public authorities, local government and administrative public establishments acting for public security, defense, criminal prosecution or their statutory missions from the declaration, authorization, consent and several other duties above, while still requiring them to correct an inaccurate file and, for public bodies outside that narrower category, to answer a correction request.

Articles 66 to 68 confine data collected for scientific research to that purpose and bar disclosing an identified result unless the person consents or the disclosure concerns a phenomenon current at the time of presentation.

Articles 69 to 74 require the INPDP's prior authorization for video surveillance, confine its use to public places and their entrances, transport and parking facilities, and collective workplaces, bar pairing it with audio recording, and require clear, permanent public notice that it is in use. Articles 104 and 105 repeal the conflicting provisions of the 2000 electronic commerce law and gave existing processors one year from the Act's entry into force to comply.

The Act states no duty to notify the INPDP or an affected person of a personal data breach. An organic bill to replace the whole Act, filed by 17 members of the Assembly of the Representatives of the People in July-August 2025, remains pending and has not been adopted.