Organic Act on the Protection of Personal Data, sensitive categories and minors

Loi organique n° 2004-63, arts. 13-15, 28, 62-65 (catégories particulières et mineurs)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 30 July 2004.

A sensitive categories rule binding public and private bodies.

As of 19 September 2026.

What it requires

Do not process personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record.
Do not process data revealing racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express written consent, the data is already manifestly public, or the processing serves a historical, scientific or vital-interest purpose.
Get the INPDP's separate authorization, decided within thirty days, before processing a special category of data under article 14, except health data.
Process a child's personal data only with the guardian's consent and the family court's authorization, which can be withdrawn at any time, and apply that same rule wherever the Act requires a child's consent to collection, communication, transfer abroad, research disclosure or video recording.
Process health data only through a physician or someone otherwise bound to professional secrecy, and only for a purpose article 62 lists such as the person's consent, a legal duty, public health protection, the person's own treatment, or health research.
Get the INPDP's authorization before a physician shares health data with a research body, and never keep or use health data beyond the time its purpose requires.

What it reaches

Obligation class

Prohibition, Consent, Biometric, Age verification

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 13 prohibits processing personal data about a person's criminal offences, their detection, prosecution, penalties, preventive measures or judicial record, with no exception stated in the Act.

Article 14 prohibits processing data revealing, directly or indirectly, racial or genetic origin, religious, political, philosophical or trade union opinions, or health, unless the person gives express consent in a form leaving a written trace, the data has become manifestly public, or the processing is necessary for historical or scientific purposes or to safeguard the person's vital interests; article 15 requires the INPDP's separate authorization for that processing, other than health data, which the INPDP must grant or refuse within thirty days, with silence counting as refusal.

Article 28 requires a child's personal data to be processed only with the guardian's consent and the family court judge's authorization, lets the judge order the processing even without the guardian's consent where the child's best interest requires it, and lets the judge withdraw that authorization at any time; the Act cross-references this same regime wherever the data subject is a child, including marketing consent, collection from third parties, communication to third parties, transfer abroad, disclosure of research results and video recording consent.

Article 62 permits processing health data beyond article 14's general exception where the person consents (subject to the article 28 regime for a child), the processing serves a purpose the law or regulations set, it serves public health protection or disease research, it benefits or is medically necessary for the person's own health, or it is scientific research in the health field.

Article 63 confines processing of health data to physicians or others bound by professional secrecy, and lets a physician share it with a research body only on the INPDP's authorization, decided within one month. Article 64 caps that processing at the time necessary for its purpose, and article 65 lets the INPDP set the precautions a health data authorization must carry and bar the data's dissemination outright.

When LexLint raises it

crawls_web
trains_models
processes_biometrics
processes_voice
serves_minors
handles_health_records

Read the law

Full French text of Loi organique n° 2004-63
hosted by the Agence Tunisienne de Certification Électronique (ATCT), a Tunisian public establishment the reproduced text carries the branding of the legislation-securite.tn consolidated-law database it was drawn from

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app