Tunisia

Article premier declares personal data protection a fundamental, constitutionally guaranteed right, and articles 2 and 3 apply the Act to both automated and non-automated processing by a natural or legal person, exempting only processing for a strictly personal or family purpose not passed to a third party.

Article 7 requires a prior declaration to the INPDP before any processing, deemed accepted if the INPDP does not object within one month, and article 8 sets what an authorization request must contain wherever the Act requires one. Articles 9 to 12 require processing to respect human dignity and privacy, never to be used to harm a person's reputation, and to serve only the lawful, determined and explicit purpose it was collected for, kept accurate and current.

Article 17 bars conditioning a service or a benefit on accepting processing or reuse of personal data for another purpose, and articles 18 and 19 require the controller to take all necessary precautions against unauthorized access, modification or consultation, naming physical access controls, a log of who accessed the system and when, and secure backup copies.

Article 20 requires a controller delegating processing to choose its subcontractor with care and makes both civilly liable for a breach of the Act, and article 21 requires either to correct, complete or erase a file once its inaccuracy or insufficiency comes to light, notifying the person and any recipient within two months.

Article 22 confines the role of controller, subcontractor and their staff to Tunisian nationals resident in Tunisia with no criminal record, and article 23 binds them to confidentiality even after the processing ends.

Articles 24 to 26 require notice to the INPDP three months before ceasing a processing activity, or within three months of a controller's death, bankruptcy or dissolution, so the INPDP can authorize destruction or, in limited cases, communication of the data for historical or scientific use.

Articles 44 to 46 confine collection from third parties to cases where the person consents or a statutory exception applies, and require destruction once the declared retention period or purpose lapses, by a bailiff's report made with an INPDP-appointed expert.

Articles 47 to 49 bar communicating personal data to a third party without the person's express written consent, subject to public security, defense and criminal prosecution exceptions and to an INPDP-authorized override for vital interests, historical or scientific research, or contract performance.

Articles 53 to 61 exempt public authorities, local government and administrative public establishments acting for public security, defense, criminal prosecution or their statutory missions from the declaration, authorization, consent and several other duties above, while still requiring them to correct an inaccurate file and, for public bodies outside that narrower category, to answer a correction request.

Articles 66 to 68 confine data collected for scientific research to that purpose and bar disclosing an identified result unless the person consents or the disclosure concerns a phenomenon current at the time of presentation.

Articles 69 to 74 require the INPDP's prior authorization for video surveillance, confine its use to public places and their entrances, transport and parking facilities, and collective workplaces, bar pairing it with audio recording, and require clear, permanent public notice that it is in use. Articles 104 and 105 repeal the conflicting provisions of the 2000 electronic commerce law and gave existing processors one year from the Act's entry into force to comply.

The Act states no duty to notify the INPDP or an affected person of a personal data breach. An organic bill to replace the whole Act, filed by 17 members of the Assembly of the Representatives of the People in July-August 2025, remains pending and has not been adopted.

Article 50 bars communicating or transferring personal data to a foreign country in any case capable of harming public security or Tunisia's vital interests, a bar no authorization can cure.

Article 51 permits transferring personal data undergoing or destined for processing only to a country that assures an adequate level of protection, assessed against the nature of the data, the purpose and duration of the processing, the destination country, and the safeguards in place, and requires every transfer to otherwise meet the Act's conditions.

Article 52 makes the INPDP's prior authorization mandatory for every transfer of personal data abroad, requires the INPDP to decide within one month of the request, and routes the request to the family court judge rather than the INPDP where the data to be transferred concern a child.

Article 27 requires the person's express, written consent before processing their personal data, lets that consent be withdrawn at any time, and routes consent for an incapable person through the general rules of law.

Article 29 excuses consent only where processing manifestly serves the person's own interest and contacting them is impossible, obtaining consent would take disproportionate effort, or the processing rests on a law or a contract the person is party to, and article 30 confines a given consent to the form and purpose it was given for, barring use of personal data for advertising without the person's separate, express consent.

Article 31 requires written notice, given at least one month before the data are processed, of the data's nature, the processing's purpose, whether answering is mandatory or optional and the consequences of not answering, the recipient's and controller's identity and address, the person's rights of access, withdrawal and objection, the retention period, a summary of the security measures, and the destination country of any transfer.

Article 32 defines the right of access as the right to consult, correct, complete, rectify, update, clarify or erase data that prove inaccurate, ambiguous or unlawfully processed, and to obtain a copy in clear language and, for automated processing, an intelligible form; article 33 bars waiving that right in advance.

Articles 34 and 36 let the person exercise access at reasonable, non-excessive intervals, against each controller separately where there is more than one, and article 37 requires an automated controller to offer an electronic channel for a rectification, modification, correction or erasure request.

Article 38 gives the person one month to receive a requested copy, one month to bring a refusal or a delay to the INPDP, and the INPDP one month to decide, or seven days where the request is to stop the destruction or concealment of the data; article 39 requires the controller to flag data under dispute until the dispute is resolved.

Article 40 lets the person demand correction, completion, clarification, updating or erasure of data that prove inaccurate, incomplete or ambiguous, or its destruction where it was unlawfully collected or used, and a free copy within one month, escalating a refusal to the INPDP within a further month.

Article 42 gives the person the right to object at any time, for valid, legitimate and serious reasons, to processing of their data, and an unconditional right to object to its communication to third parties for advertising, with the objection suspending the processing immediately; a family court judge, not the INPDP, decides an objection dispute where the person is a child.

Article 75 establishes the Instance Nationale de Protection des Données à Caractère Personnel (INPDP) as a body with legal personality and financial autonomy, seated in Tunis and budgeted through the ministry responsible for human rights.

Article 76 charges the INPDP with granting authorizations, receiving declarations, withdrawing them where the Act allows, receiving complaints, setting the safeguards personal data protection requires, accessing processed data to verify compliance, advising on the Act's application, and issuing codes of conduct.

Article 77 lets the INPDP investigate by taking statements and inspecting the premises where processing took place, other than a private home, with the assistance of sworn communications ministry agents, judicial experts or others it finds useful, and requires it to report offences it learns of to the public prosecutor, with no claim of professional secrecy standing against it.

Articles 78 to 80 set the INPDP's composition and its members' three year appointment by decree, bar any member from holding an interest in a data-processing business, and impose a lifetime confidentiality duty over what they learn in that role.

Article 81 lets the INPDP withdraw an authorization or prohibit processing that has breached the Act, after hearing the controller or subcontractor, and article 82 makes its decisions appealable to the Tunis Court of Appeal within one month, executable despite an appeal unless the court's first president stays them to prevent irreversible harm. Article 85 requires the INPDP to report annually to the President of the Republic.

Chapter VII sets tiered criminal penalties: article 86 punishes a transfer or communication of personal data abroad capable of harming public security or Tunisia's vital interests with two to five years' imprisonment and a fine of five thousand to fifty thousand dinars, and punishes the attempt too.

Article 87 fixes two years and ten thousand dinars for violating the judicial record prohibition, the first paragraph of the special category, minors or health secrecy provisions, or the video surveillance rules, and for violating the basic consent, notice, third-party collection or research disclosure duties.

Articles 88 to 99 fix lower, mostly smaller and shorter penalties for coercing consent, profiting from or maliciously disclosing personal data, processing without declaration or authorization, disclosing health data despite an INPDP ban, transferring or communicating data unlawfully, ignoring an objection, obstructing access, breaching an INPDP-imposed safeguard, obstructing the INPDP's investigations or lying to it, and violating narrower notice or dispute-flagging duties.

Article 100 lets a court additionally withdraw a processing authorization or suspend the processing on top of any other penalty. Article 101 makes the penalties for a legal person's offence fall personally on its legal or de facto director, where that director's responsibility for the acts committed is established. Articles 102 and 103 route these offences through the ordinary criminal procedure code and allow penal mediation for the narrower offences it lists.

Article 13 prohibits processing personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record, with no exception stated in the Act.

Article 14 prohibits processing data revealing, directly or indirectly, racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express consent in a form leaving a written trace, the data has become manifestly public, or the processing is necessary for historical or scientific purposes or to safeguard the person's vital interests; article 15 requires the INPDP's separate authorization for that processing, other than health data, which the INPDP must grant or refuse within thirty days, with silence counting as refusal.

Article 28 requires a child's personal data to be processed only with the guardian's consent and the family court judge's authorization, lets the judge order the processing even without the guardian's consent where the child's best interest requires it, and lets the judge withdraw that authorization at any time; the Act cross-references this same regime wherever the data subject is a child, including marketing consent, collection from third parties, communication to third parties, transfer abroad, disclosure of research results and video recording consent.

Article 62 permits processing health data beyond article 14's general exception where the person consents (subject to the article 28 regime for a child), the processing serves a purpose the law or regulations set, it serves public health protection or disease research, it benefits or is medically necessary for the person's own health, or it is scientific research in the health field.

Article 63 confines processing of health data to physicians or others bound by professional secrecy, and lets a physician share it with a research body only on the INPDP's authorization, decided within one month. Article 64 caps that processing at the time necessary for its purpose, and article 65 lets the INPDP set the precautions a health data authorization must carry and bar the data's dissemination outright.

Article 16 punishes anyone who knowingly accesses or remains illegally in a computer system, in whole or in part, and imposes the same penalty on anyone who knowingly exceeds the limits of an access right they have been granted; an attempt is also punishable. The offence carries three months to one year of imprisonment and a fine of 10,000 dinars.

Because the offence's trigger is illegal access or exceeding a granted access right, reading a public, unauthenticated page that defeats no access control falls outside a plain reading of the provision. Article 37 repeals the former articles 199 bis and 199 ter of the Penal Code, which the decree-loi's Chapter III offences supersede.

Article 6 subjects every public and private organization in five categories to a mandatory, periodic information-systems security audit: a public telecommunications network operator or telecommunications and internet service provider, an enterprise whose information networks are interconnected through telecommunications networks, a hosting or cloud-computing service provider, an enterprise that automatically processes its users' personal data while providing its service through telecommunications networks, and a vital digital infrastructure the state designates by decree.

Article 7 requires that audit to run at least once every twelve months, performed by an expert the Agency lists as authorized to practice cybersecurity auditing. Article 8 requires the audited organization to submit a protected electronic copy of the audit report to the Agency within ten days of the audit's completion, and to implement every recommendation the report contains.

Article 14 requires the same organizations to host any governmental electronic system or service only with a cloud-computing or hosting provider that holds the Article 12 government-cloud or national-cloud label. Article 15 subjects the same organizations to a mandatory, periodic classification into three digital-trust levels, set from their audit compliance, their use of approved equipment and solutions, and whether they host their systems with a labeled provider.

Article 16 gives an organization classified at the lowest, unclassified third level up to one year, after a formal notice, to meet the classification standard. Article 24 lets the minister of communication technologies downgrade an organization classified at the first or second level, rather than fine it, for failing to audit, to submit its audit report on time, to implement the report's recommendations, or to honor the Article 14 hosting duty.

Article 25 fines an organization classified at the third level 50,000 to 100,000 dinars for failing to audit or to implement the report's recommendations.

Article 19 requires the same Article 6 population, telecommunications and internet operators, interconnected enterprises, hosting and cloud providers, enterprises that automatically process their users' personal data over telecommunications networks, and vital digital infrastructure, to create its own cybersecurity emergency response center or to join a public, sectoral or private one, and to coordinate that center with the national emergency-response contact point Article 18 has the Agency designate.

Article 20 requires those organizations to immediately inform the national contact point or their emergency response center of any cybersecurity incident or attack, and to comply with the emergency measures either one orders.

Article 17 lets the Agency warn an organization whose incident or attack has disrupted its information system or communications network, or endangered the national cyberspace's security, to remedy the failure within thirty days, and lets the minister of communication technologies order the temporary isolation of its systems on the Agency's own reasoned report.

Article 24 lets the minister downgrade an organization classified at the first or second level, rather than fine it, for failing to comply with an emergency measure, to remedy a failure within the Article 17 deadline, or to create or join an emergency response center. Article 25 fines an organization classified at the third level 50,000 to 100,000 dinars for the same failures.

Article premier extends copyright to every original literary, scientific or artistic work but states that protection covers expressions and does not extend to official legislative, administrative or judicial texts and their official translations, or to the news of the day or miscellaneous facts that have the character of simple press information; a bare fact or news item is therefore never a protected work under Tunisian law, whichever outlet reports it first.

Article 11 separately authorises quotations and borrowings taken from a work already lawfully made accessible to the public, including quotations and borrowings from articles in the form of press reviews, on condition that they conform to fair practice and are justified by a scientific, educational or informational purpose, used in their original version or in translation, and accompanied by mention of the source and the author's name where it appears in the source.

The exception is not capped at a headline-length or short-extract threshold and is not confined to the press industry; whether it reaches a systematic aggregator's reproduction of headlines and snippets, as opposed to a traditional press review, has not been tested in a located Tunisian decision.

Article 51 arms a rightholder with civil damages for a breach of copyright or related rights, and article 52 sets a criminal fine of 1,000 to 50,000 dinars, doubled on repeat offence with up to twelve months' imprisonment added, for exploiting a protected work without the required authorization.