Tunisia Data Protection & Privacy Regulation

Controller/Processor Duties

Tunisia's current law imposes no codified controller-accountability package of the kind familiar from GDPR-aligned regimes: there is no existing requirement to appoint a data protection officer, no mandatory register of processing activities, no data protection impact assessment obligation, and no breach-notification duty to the INPDP. This absence is a function of the 2004 statute's age and design, which predates the accountability-by-design model that has become the international baseline over the past decade.

The pending GDPR-aligned reform bill, under committee hearing as of 24-25 February 2026, would introduce all four of these elements. It would require data controllers to appoint a DPO for large-scale or sensitive processing, maintain a mandatory register of processing activities, conduct a DPIA before engaging in high-risk processing, and notify personal-data breaches to the INPDP within 72 hours. This cluster of provisions would bring Tunisia's controller-obligation architecture substantially into alignment with the GDPR model, replacing an currently accountability-light regime with one built around documented, auditable compliance processes.

None of these obligations are current law, and no commencement date is available because the bill itself has not been enacted. This is an important distinction for any organisation currently assessing its Tunisia compliance posture: there is no present legal requirement to build DPO, ROPA, DPIA or 72-hour-breach-notification capability, even though such capability would likely become necessary if and when the bill passes. Organisations operating in or targeting the Tunisian market should treat the bill's eventual provisions as a forward planning consideration rather than a current obligation.

The practical significance of a future 72-hour breach-notification duty in particular should be read alongside the broader institutional picture: Tunisia's data-protection authority, the INPDP, is currently operating with a council whose mandate expired in April 2024. A breach-notification regime is only as effective as the capacity of the body receiving those notifications to act on them, so the eventual operational effectiveness of a 72-hour duty, if enacted, would depend in part on resolution of the INPDP's own institutional standing.

Outlook

The controller/processor duties module's trajectory depends entirely on the fate of the pending reform bill. No sourced update on the bill's status beyond late-February 2026 committee hearings is available, so the timeline for when -- or whether -- DPO, ROPA, DPIA and breach-notification obligations become binding Tunisian law remains unknown. This is a module to revisit once further legislative movement is confirmed; in the interim, the absence of these obligations under current law is itself the operative fact for any compliance assessment.

This content is analytical orientation only and does not constitute legal advice.

Algorithmic, Biometric & Surveillance Governance

The INPDP is reported to have been designated the central regulator for AI systems that process personal information under Tunisia's National AI Strategy 2026-2030. This designation is reported as institutional only: no substantive assessment duty, registration requirement, or enforcement mechanism attached to the designation was located this cycle, and the primary strategy document or designation instrument itself was not directly retrieved, so the practical scope of the INPDP's AI-oversight role remains to be confirmed. In the interim, the existing sensitive-data regime under Organic Law 2004-63 continues to govern biometric and genetic data as it does other sensitive categories: processing of biometric, genetic, health, racial, religious, political, and criminal data is reported to require explicit written consent from the data subject together with prior INPDP authorisation before processing may begin. No dedicated profiling, automated-decision-making, or algorithmic-risk-assessment rule exists under the currently-operative 2004 law; a secondary source reports that the pending, disputed-enactment-status reform bill would introduce provisions addressing profiling, algorithmic risk, and a right to contest automated decisions, but this is not confirmed against the bill's primary text and depends on the broader enactment-status dispute affecting the reform bill as a whole.

Outlook

The practical content of the INPDP's AI-regulator designation, and whether the reform bill's reported profiling and automated-decision provisions are in force, both turn on confirmation of underlying primary documents not retrieved this cycle: the National AI Strategy designation instrument and the reform bill's Journal Officiel text respectively.

Algorithmic, Biometric & Surveillance Governance

Tunisia's current data-protection law already treats biometric data as a category of sensitive data under the 2004 statute, meaning biometric processing is not wholly unregulated today even in the absence of a dedicated algorithmic-governance framework. What does not currently exist is any codified regime addressing automated decision-making transparency, AI-specific data-use rules, or CCTV surveillance governance as distinct categories, beyond whatever general obligations the 2004 law's written-consent and prior-declaration model imposes on any processing activity, including one that happens to involve algorithmic, biometric or surveillance elements.

The pending GDPR-aligned reform bill, under committee review as of late February 2026, would introduce transparency rights specifically tied to automated decision-making, a framework addressing AI-related data use, and rules governing CCTV surveillance. This would represent a meaningful expansion of Tunisia's data-protection law into territory that the current 2004 statute does not address in any targeted way, reflecting the kind of modernisation that has occurred in comparable reform processes elsewhere as automated-decision and surveillance technologies have become more pervasive since the original law's drafting two decades ago.

The practical significance of introducing automated-decision-making transparency rights would be to give data subjects a mechanism to understand and potentially contest decisions made about them by algorithmic systems -- a right that does not exist in any form under current Tunisian law. Similarly, a dedicated AI-related data-use framework would be the first Tunisia-specific regulatory engagement with AI as a distinct category of data processing, separate from the general processing rules that currently apply to any form of data handling regardless of whether automated or algorithmic systems are involved. CCTV surveillance governance, meanwhile, would address a widely deployed technology that currently sits outside any dedicated statutory framework beyond general data-protection principles.

As with the other provisions of the pending bill, none of these algorithmic, biometric or surveillance-governance elements have legal effect as of the current reporting; they remain proposals under committee review, and no commencement date is available even in the event of eventual enactment. The existing treatment of biometric data as sensitive data is the one element of this module that is current law rather than a future prospect, and that treatment is not reported to be changing under the pending bill -- rather, the bill would add new categories (automated decision-making, AI, CCTV) around and beyond the existing biometric-sensitive-data baseline.

Outlook

The algorithmic, biometric and surveillance-governance provisions of the pending reform bill are among its more forward-looking elements, addressing technology categories that have expanded significantly in deployment since Tunisia's 2004 law was drafted. Their eventual enactment would be a significant modernisation step, but the bill's status beyond late-February 2026 committee hearings is not confirmed in available sourcing, so no timeline can currently be given. In the interim, biometric data retains its existing sensitive-data classification under the 2004 law, while automated-decision-making, AI-specific, and CCTV-specific governance remain unaddressed by any dedicated current rule.

This content is analytical orientation only and does not constitute legal advice.

Algorithmic, Biometric & Surveillance Governance

The development in this module for Tunisia this cycle is adjacent to the core data-protection perimeter rather than inside it. A text dated 30 September 2026 amended Article 24 of Decree-Law 54 of 13 September 2022, the statute governing information-system offences in Tunisia, revising its sanctions schedule: a repeat offence now carries six months' imprisonment and a fine of TND 50,000. Decree-Law 54 is a criminal-law instrument addressing online-content and information-system conduct; it is not a personal-data-processing law, and this amendment does not touch Tunisia's data-protection statute, which remains Organic Law No. 2004-63. The amendment is reported at a probable tier, resting on a single Tunisian press source describing the 30 September 2026 text.

The reason this sits in the algorithmic, biometric and surveillance governance module at all is architectural rather than substantive: Decree-Law 54 forms part of the broader digital-governance and online-conduct legal environment that surrounds, and will eventually interact with, any enacted data-protection reform. Tunisia's pending data-protection reform bill (tracked separately in the regulator-and-framework module and withheld from this cycle's write-list as stable) would, if enacted, introduce automated-decision-making and profiling provisions. Those provisions, were they to be enacted, would sit in an information-governance landscape that already includes Decree-Law 54's criminal sanctions for information-system offences -- meaning the two instruments are structurally adjacent even though neither currently cross-references the other in available reporting. No sourced provision in Decree-Law 54, as amended, itself addresses automated decision-making, profiling, biometric processing, or state-surveillance carve-outs in data-protection terms; the amendment is confined to sanction severity for repeat offences.

No other algorithmic, biometric or surveillance-governance development for Tunisia was sourced this cycle. In particular, no provision establishing or amending facial-recognition, biometric-identification or automated-decision-making rules specific to data protection has been located; the facial-recognition requirement reported elsewhere this cycle for Tunisia's payment sector is a payments-regulatory development outside this monitor's module and is not analysed here.

Outlook

The amendment's practical effect for this cycle is confined to the criminal-sanctions schedule attaching to repeat information-system offences; it does not change Tunisia's data-protection statute or introduce any new algorithmic-governance rule. The item to watch is whether Tunisia's pending data-protection reform bill, if and when it advances past committee review, introduces automated-decision-making or profiling provisions that would populate this module substantively. As at the most recent corroborated reporting, that bill remained under ARP committee review with no floor vote reported, so no near-term change to this module's substantive content is confirmed.

Enforcement & Redress

Tunisia's data-protection enforcement capacity sits within the same institutionally constrained regulator described in the framework assessment above: a governing council reduced to one permanent and two non-permanent members, against a founding design of fifteen, with an administrative-magistrate seat vacant. That thinness in permanent membership is reported as a probable constraint on the regulator's practical capacity to pursue enforcement and redress matters, independent of whatever formal powers it holds on paper.

The pending GDPR-aligned reform bill would, if enacted, materially expand those formal powers. Reports suggest it would grant the regulator the ability to issue warnings, order cessation of unlawful processing, and impose administrative fines reportedly calculated as a percentage of global annual turnover, a structure mirroring the European General Data Protection Regulation's penalty architecture. None of this has legal effect under the law currently in force; the regulator today holds no comparable turnover-based fining power, and this entire power set remains prospective and attributed to law-firm commentary rather than to primary legislative text, warranting a hedged reading of its eventual shape and timing.

Outlook

Whether Hafsia Ardhaoui's interim presidency resolves or merely continues to sit atop the lapsed council mandate is directly relevant to enforcement capacity: a fuller council, if restored, would plausibly strengthen the regulator's practical ability to pursue cases, independent of any change in its formal legal powers. The enactment of the pending reform bill, which remains stalled since its February 2026 committee hearings with no further progress confirmed, would be the more significant structural shift, introducing for the first time a turnover-based fining power and expanded cessation and warning powers; until enactment, Tunisia's enforcement and redress regime remains bounded by the weaker 2004-law powers and a thin permanent membership.

Enforcement & Redress

Tunisia's enforcement and redress picture this cycle centres on a public capacity-and-governance intervention rather than a specific enforcement action. On 5 October 2026 the digital-rights organisation Forum Chawki Gaddes publicly called for urgent reactivation of the INPDP and for the regulator to be given the autonomy and means necessary to carry out its missions, a call made in the context of a reported proliferation of social-media disclosures of sensitive personal data. Independently of that call, data subjects retain a judicial route: INPDP decisions of a jurisdictional nature on complaints are reported to be appealable before the Tunis Court of Appeal. On penalties, the currently-operative regime under Organic Law 2004-63 is reported to carry fixed fines, reported in a range between 1,000 and 50,000 Tunisian dinars depending on the violation, together with imprisonment of up to five years for the more serious categories of breach; the exact figures have not been independently verified against primary statutory text this cycle. A reform bill with disputed enactment status is reported to propose introducing turnover-based fines in place of, or alongside, the current fixed-fine structure, but whether this provision is in force depends on the same contested enactment question affecting the reform bill generally.

Outlook

Whether the Forum Chawki Gaddes's public call generates a dated institutional response from the INPDP or the Tunisian government is the next concrete development to watch in this module, together with any resolution of the reform bill's enactment status that would clarify whether the reported turnover-based fine structure is currently enforceable.