Law: Organic Act No. 2004-63 of 27 July 2004 on the Protection of Personal Data (only available in French and Arabic here) (the Law)

Regulator: Tunisian data protection authority (INPDP)

Summary: On July 27, 2004, Tunisia adopted Organic Act No. 2004-63 on the Protection of Personal Data (only available in French here) (the Law), establishing the Tunisian data protection authority (INPDP). The Law establishes general data protection requirements in Tunisia, and addresses data processing notifications, data subject rights, and data transfers. The Law provides for penalties of up to TND 50,000 (approx. $15,660) for the violation of its provisions. Several technical regulations have been enacted such as the Law and Decree No. 2007-3004 of November 27, 2007, Laying Down the Conditions and Procedures for the Declaration and Authorisation of the Processing Of Personal Data (available only in Arabic and French here), in order to supplement and enhance data protection in Tunisia. In 2017, Tunisia became a signatory to Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) and, in 2019, Tunisia signed the Amending Protocol to the Convention for the Protection of Individuals with regard to the Processing of Personal Data (Convention 108+), although it has yet to ratify this latter protocol. Tunisia signed the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention) on April 23, 2019.