Tunisia

Tunisia holds a notable place in African data protection history: its Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data made it the first country in Africa and the Arab world to enact a dedicated personal data protection law, and the authority established under it is the oldest data protection regulator on the continent. As an organic law it carries elevated constitutional status, reinforced by successive constitutional protections of private life (2002 amendment, 2014 Article 24, 2022 Article 30). It is supplemented by implementing Decrees No. 2007-3003 and 2007-3004 of 27 November 2007, and Tunisia ratified Convention 108 and its Additional Protocol in 2017. The law applies to automated processing and structured manual files where the controller is established in Tunisia or processing occurs on Tunisian territory. The data subject's informed, express, written consent is the general basis for processing; children's data needs a legal representative's consent and may require judicial authorisation. Sensitive data attracts heightened restrictions or prohibition. Controllers must file a mandatory prior declaration with the regulator, with prior authorisation (decided within one month) for sensitive data and cross-border transfers; transfers are barred to inadequate countries and absolutely barred where they endanger public security or vital interests. Data subjects have rights of access, rectification, updating, deletion, and objection, with objection immediately suspending processing. A 2023 cybersecurity decree-law adds annual IT audits and cyberattack-notification duties for entities processing data over telecoms networks. Enforcement rests with the Instance Nationale de Protection des Données Personnelles (INPDP), which may refer offences to the public prosecutor; penalties include up to one year's imprisonment and fines up to 5,000 dinars. A comprehensive GDPR-aligned modernisation bill is before Parliament as at June 2026 but unenacted, so the 2004 organic law remains governing. As the continent's pioneer regime with an enduring regulator, Tunisia is historically significant, though its substantive law is now dated pending reform.