LexLint

Know the law where your app runs.

Law / Tunisia

Organic Act on the Protection of Personal Data

Loi organique n° 2004-63 du 27 juillet 2004, portant sur la protection des données à caractère personnel

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 30 July 2004.

A comprehensive regime rule binding public and private bodies.

As of 5 September 2026.

What it requires

  • File a prior declaration with the National Authority for the Protection of Personal Data (INPDP) before processing personal data, or obtain its prior authorization where the Act requires one.
  • Collect and process personal data only for a lawful, determined and explicit purpose, and obtain the person's express, written consent before processing, unless a statutory exception applies.
  • Before collecting personal data, give the person written notice of the processing's purpose, its recipients, their access and objection rights, the retention period, and the country to which the data may be transferred.
  • Let a person access, correct, update or erase their own personal data, and stop processing it once they object for a valid, legitimate and serious reason.
  • Do not process data revealing racial or genetic origin, religious, political, philosophical or trade-union views, or health, without the person's express consent or a narrow statutory exception.
  • Obtain the INPDP's prior authorization before transferring personal data outside Tunisia, and never transfer it in a way capable of harming public security or Tunisia's vital interests.
  • Do not use personal data for advertising purposes without the person's separate, express consent.

If you get it wrong

Criminal exposureYes

Private right of actionYes

Criminal exposure note

Chapter VII (arts. 86-99) makes most breaches of the Act criminal offences: two to five years' imprisonment and a fine of 5,000 to 50,000 dinars for a transfer or communication of personal data abroad capable of harming public security or Tunisia's vital interests (art. 86); lower fixed fines (1,000 to 10,000 dinars) and shorter imprisonment terms (one month to two years) attach to breaches of narrower duties, such as processing without the required declaration or authorization, ignoring an objection, or obstructing the INPDP (arts. 87-99).

Penalty structure

Highest tier (art. 86): two to five years' imprisonment and a fine of 5,000 to 50,000 dinars for transferring or communicating personal data abroad in a way capable of harming public security or Tunisia's vital interests. Most other breaches of the Act (arts. 87-99) carry their own, lower fixed fine, from 1,000 to 10,000 dinars, several paired with a shorter prison term.

Rule
Fixed only
As of
5 September 2026
Currency
TND
Fixed cap
50,000

Who enforces it

Enforcement body

Instance Nationale de Protection des Données à Caractère Personnel (INPDP)

What it reaches

Obligation class

Consent, Disclosure, Data subject rights, Transfer, Security, Licensing

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article premier declares the protection of personal data a fundamental, constitutionally guaranteed right, and article 2 applies the Act to both automated and non-automated processing carried out by a natural or legal person, with article 3 exempting processing for a strictly personal or family purpose not communicated to a third party.

Article 7 requires a prior declaration to the INPDP before any processing, deemed accepted if the INPDP does not object within one month, and article 8 requires the INPDP's prior authorization for the processing listed elsewhere in the Act.

Article 14 prohibits processing data revealing racial or genetic origin, religious, political, philosophical or trade-union views, or health, unless the person gives express consent in a form leaving a written trace, the data has become manifestly public, or the processing is necessary for historical or scientific purposes or to safeguard the person's vital interests, with article 15 requiring the INPDP's separate authorization for that processing (except health data).

Article 27 requires the person's express, written consent before processing, and article 31 requires advance written notice of the processing's purpose, its recipients, the person's access and objection rights, the retention period, and the destination country of any transfer.

Articles 32 to 43 give the data subject a right of access, rectification, and objection, enforceable before the INPDP, and articles 51 and 52 require the INPDP's prior authorization before any transfer of personal data abroad, conditioned on the destination country assuring an adequate level of protection. Article 50 separately bars any transfer of personal data abroad capable of harming public security or Tunisia's vital interests, regardless of that authorization. Article 20 makes the data controller and processor civilly liable for a breach of the Act's provisions.

When LexLint raises it

  • crawls_web
  • trains_models
  • automated_outreach
  • processes_biometrics

Read the law

Full French text of Loi organique n° 2004-63
hosted by the Agence Tunisienne de Certification Électronique (ATCT), a Tunisian public establishment the reproduced text carries the branding of the legislation-securite.tn consolidated-law database it was drawn from

Back to the example  ·  Lint your app