Data protection & privacy laws in Tunisia (2026)

Organic Law No. 2004-63 of 27 July 2004 establishes the comprehensive data protection regime, covering collection, use, storage, and transfer of personal data by public and private actors, with written consent and data minimization as core principles. It applies to both domestic and foreign organizations handling Tunisian personal data.

The Instance Nationale de Protection des Données Personnelles (INPDP), established by the 2004 law and described as the oldest data protection authority in Africa and the Arab world, monitors compliance, examines controller declarations and authorization requests, investigates complaints, and issues corrective measures.

Article 24 of Tunisia's 2022 Constitution explicitly protects the right to privacy and the protection of personal data, reinforcing the 2014 Constitution's earlier privacy provisions and providing a strong constitutional foundation for the data protection framework.

Tunisia became the 51st Party to Council of Europe Convention 108 on 1 November 2017, and signed the modernized Protocol (Convention 108+) on 24 May 2019, committing to align domestic law with updated international data protection standards including on supervisory authorities and cross-border data flows.

A draft organic law comprising 123 articles was introduced in 2025 to replace the 2004 law, introducing GDPR-aligned rights (portability, erasure/right to be forgotten), mandatory Data Protection Impact Assessments for high-risk AI and biometric processing, and enhanced INPDP quasi-judicial enforcement powers including administrative fines. As of February 2026 the Rights and Freedoms Committee of parliament was still reviewing the bill's initial provisions.

Under the 2004 law, data subjects hold rights of access, rectification, and objection. Controllers must file declarations with or seek prior authorization from the INPDP depending on processing type; cross-border transfers require INPDP approval or a finding of adequate protection in the destination country.