Organic Act on the Protection of Personal Data, enforcement and sanctions

Article 75 establishes the Instance Nationale de Protection des Données à Caractère Personnel (INPDP) as a body with legal personality and financial autonomy, seated in Tunis and budgeted through the ministry responsible for human rights.

Article 76 charges the INPDP with granting authorizations, receiving declarations, withdrawing them where the Act allows, receiving complaints, setting the safeguards personal data protection requires, accessing processed data to verify compliance, advising on the Act's application, and issuing codes of conduct.

Article 77 lets the INPDP investigate by taking statements and inspecting the premises where processing took place, other than a private home, with the assistance of sworn communications ministry agents, judicial experts or others it finds useful, and requires it to report offences it learns of to the public prosecutor, with no claim of professional secrecy standing against it.

Articles 78 to 80 set the INPDP's composition and its members' three year appointment by decree, bar any member from holding an interest in a data-processing business, and impose a lifetime confidentiality duty over what they learn in that role.

Article 81 lets the INPDP withdraw an authorization or prohibit processing that has breached the Act, after hearing the controller or subcontractor, and article 82 makes its decisions appealable to the Tunis Court of Appeal within one month, executable despite an appeal unless the court's first president stays them to prevent irreversible harm. Article 85 requires the INPDP to report annually to the President of the Republic.

Chapter VII sets tiered criminal penalties: article 86 punishes a transfer or communication of personal data abroad capable of harming public security or Tunisia's vital interests with two to five years' imprisonment and a fine of five thousand to fifty thousand dinars, and punishes the attempt too.

Article 87 fixes two years and ten thousand dinars for violating the judicial record prohibition, the first paragraph of the special category, minors or health secrecy provisions, or the video surveillance rules, and for violating the basic consent, notice, third-party collection or research disclosure duties.

Articles 88 to 99 fix lower, mostly smaller and shorter penalties for coercing consent, profiting from or maliciously disclosing personal data, processing without declaration or authorization, disclosing health data despite an INPDP ban, transferring or communicating data unlawfully, ignoring an objection, obstructing access, breaching an INPDP-imposed safeguard, obstructing the INPDP's investigations or lying to it, and violating narrower notice or dispute-flagging duties.

Article 100 lets a court additionally withdraw a processing authorization or suspend the processing on top of any other penalty. Article 101 makes the penalties for a legal person's offence fall personally on its legal or de facto director, where that director's responsibility for the acts committed is established. Articles 102 and 103 route these offences through the ordinary criminal procedure code and allow penal mediation for the narrower offences it lists.