--- title: "Tunisia Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/tunisia/ source_html: /jurisdictions/tunisia/index.html description: "Tunisia data protection and privacy regulation: 10 categories, 46 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 2e40a3a69ce2effa18e7911fcda8ec32a89c7f49dc940cd9b64da0d4dd3e99fc generator: "fe-fleet/md-twin@1.0" --- # Tunisia Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Tunisia Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: artificial-intelligence Last updated 2026-11-04 · 10 categories · 46 claims · 35 sources in the cumulative register Download report (PDF) Expand all Tunisia is in the midst of its most significant data-protection legal transition since 2004. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not covered: Lawful Processing & Special Data, Data Subject Rights, Controller/Processor Duties, Sectoral Watch, AdTech & Commercial Privacy, Children & Vulnerable Groups. Not fully checked this cycle: Regulator & Framework (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=TUNISIA)[Build Report](/reports/?j=TUNISIA)[Compare](/compare/?j=TUNISIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 8 Red categories 57 Sub-modules 46 Claims 0 Tier-1 sources Traffic-light mix 2 amber 8 red (sums to 10 rendered categories; click to filter) 8 categories flagged red ## Jurisdiction brief Jurisdiction lead brief 1,063 Full executive summary 381 ###### Latest update · 26 October 2026 #### Lead Signal Tunisia's data-protection regulator has undergone a leadership change against the backdrop of a long-lapsed governing-council mandate. Following the retirement of the previous president, Chawki Gaddes, the Head of Government named Hafsia Ardhaoui as interim president of the Instance Nationale de Protection des Données Personnelles. Press reporting is consistent on the fact of the appointment, though no primary government-gazette text has been retrieved this period, holding the finding at the probable rather than confirmed level. The council itself is reported to now have only one permanent member and two non-permanent members, with an administrative-magistrate seat vacant, meaning the interim presidency sits atop a governing body that is institutionally thin by its own founding design. #### Other Developments The GDPR-aligned reform bill intended to replace the 2004 data-protection law remains unenacted. Committee hearings before the Assembly of the Representatives of the People's Rights and Liberties Committee concluded in late February 2026, and no further parliamentary progress has been located since. The bill would, among other changes, introduce reinforced consent standards and materially expand the regulator's powers; none of that has legal effect under the current law, which remains Organic Law 2004-63 in its existing, unamended form on these points. Reports suggest the current parliamentary stage beyond the February hearings could not be confirmed this period, so the bill's precise standing should be treated as uncertain rather than settled. Enforcement capacity is reported constrained by the same structural gap. The regulator's enforcement and redress function sits within the same institutionally thin council described above, and the pending reform bill, were it enacted, would grant the regulator meaningfully expanded powers, including the ability to issue warnings, order cessation of unlawful processing, and impose administrative fines reportedly calculated as a percentage of global annual turnover, mirroring the structure familiar from the European General Data Protection Regulation. None of this has legal effect under the law currently in force, under which the regulator holds no comparable turnover-based fining power. #### Cross-Monitor Connections The pending reform bill's proposed turnover-based administrative fine structure and expanded regulator powers would, if enacted, bring Tunisia's data-protection enforcement architecture into closer alignment with frameworks tracked by the financial-integrity monitor's compliance-technology and governance analysis of regulated sectors generally; no specific cross-sector finding is asserted here beyond noting the structural parallel. #### Outlook Two threads will determine whether Tunisia's data-protection regime strengthens institutionally over the coming months: first, whether Hafsia Ardhaoui's interim presidency is followed by a fuller restoration of the council's membership, whose fifteen-member mandate is reported to have expired on 16 April 2024, or whether the interim arrangement persists without resolving that underlying gap; and second, whether the GDPR-aligned reform bill advances beyond its February 2026 committee stage toward a floor vote. Neither question has a clear answer in the current record, and both bear directly on whether the regulator's enforcement and redress capacity - currently constrained by a thin permanent membership and the absence of turnover-based fining power - changes in the near term. 3 earlier updates not shown here. ###### Standing brief · as of 23 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal Tunisia is in the midst of its most significant data-protection legal transition since 2004. A 2025 organic-law bill, not yet confirmed as enacted, would replace Organic Law No. 2004-63 (which remains formally in force) with a GDPR-modelled framework and expand the mandate of the Instance Nationale de Protection des Données Personnelles (INPDP) from a consultative role to a full enforcement authority empowered to conduct audits, issue cease-and-desist orders, and impose administrative fines. The bill carries a one-year grace period, with full enforcement targeted for 11 July 2026, a date that anchors several of this cycle's other findings, including mandatory privacy-by-design and data protection impact assessments for high-risk processing, DPO appointment duties, Records of Processing Activities requirements, and a 72-hour INPDP breach-notification obligation. #### Other Developments Cross-border transfer framework modernisation. Tunisia's current cross-border transfer regime rests on Article 47 of Organic Law 2004-63, which prohibits transfer of personal data to third parties without express written consent, and on the INPDP's Decision No. 3 of 5 September 2018, which established a non-exhaustive adequacy list; INPDP adequacy decisions are appealable before the Tunis Court of Appeal. The pending 2025 bill would layer onto this a structured framework including standard contractual clauses to be published by the INPDP, formalising a transfer mechanism beyond the current consent-and-adequacy-list model. AI governance designation. The INPDP has been designated the central regulator for AI systems that process personal information under Tunisia's National AI Strategy (2026-2030), an institutional designation rather than a substantive automated-decision-making rule, but one that positions the existing data-protection regulator, rather than a new body, at the centre of AI oversight. Regulator capacity self-assessment. The INPDP's own 2025 report acknowledges that current fines are capped at levels with no deterrent effect on major platforms, and separately identifies difficulty monitoring foreign operators targeting the Tunisian market as a structural weakness, both of which the pending bill's expanded enforcement powers are apparently designed to address. #### Cross-Monitor Connections This cycle's data-protection developments intersect with, but are analytically distinct from, work published elsewhere in this fleet. Tunisia's parallel legislative activity in the financial-crime and payments space, including the draft Code des Changes reform of cross-border exchange controls, is tracked separately by the Financial Integrity Monitor and the World Payments Monitor; those instruments do not touch personal-data protection and are not analysed further here. Any operator processing Tunisian personal data through crypto or digital-asset channels sits at the intersection of this cycle's INPDP developments and separate crypto-monitor coverage, though the two regimes remain formally independent under current Tunisian law. #### Outlook Confirmation of the 2025 organic-law bill's enactment and promulgation status is the single most important open question carried into the next cycle: it is not yet confirmed whether the bill has passed the Assembly of the Representatives of the People and been published in the Journal Officiel de la République Tunisienne. If confirmed on its current terms, the 11 July 2026 full-enforcement date would arrive with a compressed timeline for controllers and processors to operationalise DPIAs, DPO appointments, Records of Processing Activities, and 72-hour breach notification. The INPDP's self-acknowledged capacity constraints around foreign-operator monitoring and deterrent-level fines suggest that even a successfully enacted framework may face an implementation gap between statutory obligation and practical enforcement capability. Read full brief · 1063 words ###### Latest update · 11 October 2026 #### Regulatory Status Tunisia's data-protection framework is governed by Organic Law n2004-63 of 27 July 2004, supervised by the Instance Nationale de Protection des Donnees Personnelles (INPDP). The INPDP's council mandate expired on 16 April 2024 without confirmed renewal, and the government's own parliamentary answer is understood to describe the underlying law as obsolete. A GDPR-aligned reform bill of 123 articles across six chapters was under committee hearing as of 24-25 February 2026, with the Health Ministry and INPDP both heard; no newer status update has been located. The pending bill would introduce controller accountability duties (DPO appointment, processing register, DPIA, 72-hour breach notification) and algorithmic/biometric/surveillance governance provisions (automated-decision transparency, AI-data-use rules, CCTV governance), none of which are current law. Biometric data is already classified as sensitive data under the existing 2004 statute. #### Outlook Resolution of the INPDP council-mandate gap and further movement on the pending reform bill beyond its late-February 2026 committee hearings are the two developments to watch. Until the bill is enacted, Tunisia's data-protection regime continues to operate under the 2004 law's written-consent and prior-declaration model, without the accountability or algorithmic-governance provisions the pending reform would introduce. ###### Standing brief · as of 23 August 2026 #### Regulatory Status Tunisia's data-protection regime is transitioning from a procedural consent-and-declaration model under Organic Law No. 2004-63 of 2004 toward a GDPR-modelled framework carried in a 2025 organic-law bill, whose enactment and promulgation status remains unconfirmed this cycle. The bill would expand the INPDP's mandate from consultative to enforcement authority, introduce DPIA, DPO, Records of Processing Activities, and 72-hour breach-notification duties, add a structured cross-border-transfer mechanism including INPDP-published standard contractual clauses alongside the existing Article 47 consent regime and 2018 adequacy list, and target full enforcement from 11 July 2026. Separately, the INPDP has been designated central regulator for AI systems under Tunisia's 2026-2030 National AI Strategy, and its own 2025 report acknowledges capped, non-deterrent fine levels and limited capacity to monitor foreign operators. #### Outlook The 11 July 2026 full-enforcement date is the central marker across every module touched this cycle; confirmation of the bill's actual enactment and Journal Officiel publication status would resolve the largest open question in Tunisia's current data-protection picture. Read full brief · 381 words Key regulatory facts for Tunisia Regulatory Dimension Tunisia Standing Position Jurisdiction Tunisia (TN) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 46 sourced findings) Regulator & Framework Core statute and regulator are Confirmed via multiple independent secondary sources, but granular scope/registration mechanics could not be verified against primary text in this pass. Lawful Processing & Special Data No claim in this module could be raised above Speculative confidence given inability to access primary/authoritative secondary text. Data Subject Rights No sub-module claim could be raised above Speculative confidence without primary-text access. Controller/Processor Duties No sub-module claim could be raised above Speculative confidence without primary-text access; flagged for primary-source escalation given downstream consumer dependency. Primary Instruments Cited IAPP, CNIL / LINC, Arabesque.tn, Tunisia Official Instrument (webmanagercenter.com tunisie-vers-un-nouveau-cadre-le), Tuniscope Last Confirmed / Updated 2026-11-04 (35 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Tunisia: D1 Regulator & Framework5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core statute and regulator are Confirmed via multiple independent secondary sources, but granular scope/registration mechanics could not be verified against primary text in this pass. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Amber Core statute and regulator are Confirmed via multiple independent secondary sources, but granular scope/registration mechanics could not be verified against primary text in this pass. #### Sub-modules (5) #### Regulator And AuthorityGreen INPDP is confirmed as Tunisia's data protection authority, established in 2008 pursuant to the 2004 law. Claims (5): - The Instance Nationale de Protection des Données à Caractère Personnel (INPDP) is Tunisia's national data protection authority. - The INPDP was created in 2008 pursuant to Tunisia's 2004 personal data protection law. - Instance Nationale de Protection des Données Personnelles (INPDP) — The INPDP's 15-member council was appointed for a 3-year term that expired 16 April 2024; the government's own parliamentary answer describes the 2004 law as 'obsolete'. - Instance Nationale de Protection des Données Personnelles (INPDP) — Following the retirement of Chawki Gaddes, Hafsia Ardhaoui was named interim president by the Head of Government; the council now has only one permanent member and two non-permanent members, with an administrative-magistrate seat vacant. - The INPDP's governing council mandate is reported expired with no confirmed renewal. #### Act And InstrumentsGreen Organic Law No. 2004-63 of 27 July 2004 is the primary instrument; a constitutional basis exists in Article 24 (2002). Claims (4): - Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data is Tunisia's primary omnibus data-protection statute. - Article 24 of Tunisia's 2002 constitutional amendment enshrines the inviolability of personal information, forming the constitutional basis for the 2004 data protection law. - GDPR-aligned reform bill (Tunisia) — A GDPR-aligned reform bill of 123 articles in 6 chapters -- covering general principles, data-subject rights, processing regimes, the data-protection authority, penalties, and final/transitional provisions -- was under committee hearing as of 24-25 February 2026, including hearings of the Health Ministry and INPDP itself; not yet enacted. - GDPR-aligned reform bill (Organic Law 2004-63 replacement) — A GDPR-aligned organic-law bill to replace Law 2004-63, introducing reinforced consent standards, turnover-based sanctions and expanded INPDP powers, remains unenacted; committee hearings before the ARP's Rights and Liberties Committee concluded in late February 2026 with no further progress located this cycle. #### Material ScopeRed Material scope (what data/processing is caught) could not be verified against primary text in this pass. #### Territorial ScopeRed Territorial application to non-established controllers could not be verified against primary text in this pass. #### Regulator Registration And FilingRed Registration/filing (declaration/authorization) obligations on controllers could not be verified against primary text in this pass, though secondary listings indicate INPDP administers a declaration/authorization regime typical of pre-GDPR omnibus statutes. Claims (1): - Ordinary processing requires prior declaration to the INPDP; sensitive processing requires prior authorisation. Tunisia's data-protection regime rests on Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data, a cross-sectoral statute enforced by the Instance Nationale de Protection des Données à Caractère Personnel (INPDP), created in 2008. The regime is underpinned by Article 24 of the 2002 constitutional amendment recognising the inviolability of personal information, later carried into the 2014 and 2022 constitutional texts. Detailed procedural rules on material/territorial scope and registration/filing were not confirmed against primary INPDP text in this pass; open secondary sources (DataGuidance, IAPP) that normally carry this granularity were paywalled at retrieval time. Periodic update · new data 2026-10-26 #### Regulator & Framework Tunisia's data-protection regulator, the Instance Nationale de Protection des Données Personnelles, has a new interim president. Following the retirement of Chawki Gaddes, the Head of Government named Hafsia Ardhaoui to the role. Press reporting is consistent on the appointment itself, though no primary government-gazette text has been retrieved this period, which holds the finding at the probable rather than confirmed level. The governing council around that interim presidency is reported to be reduced to one permanent member and two non-permanent members, with an administrative-magistrate seat vacant, against a council design that calls for fifteen members. Separately, the GDPR-aligned organic-law bill intended to replace Organic Law 2004-63, which would introduce reinforced consent standards, turnover-based sanctions and expanded regulator powers, remains unenacted. Committee hearings before the Assembly of the Representatives of the People's Rights and Liberties Committee concluded in late February 2026, and no further parliamentary progress has been located since; this finding carries uncertain confidence, reflecting that the bill's current parliamentary stage beyond those hearings could not be confirmed. The current legal framework governing data protection in Tunisia therefore remains the 2004 law, unamended on these points, while the modernising replacement sits in an unresolved legislative holding pattern. #### Outlook The key question for Tunisia's regulatory framework over the coming months is whether the interim presidency is followed by a fuller restoration of the council's membership, whose mandate is reported to have expired in April 2024, or whether the interim arrangement becomes a durable substitute for that restoration. Equally important is whether the GDPR-aligned reform bill advances beyond committee stage toward a floor vote in the Assembly of the Representatives of the People; no date or scheduling signal for such a vote has been located in the current record. 2 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Regulator & Framework Tunisia's data-protection institutional position is marked by disputed and unresolved status this cycle rather than confirmed change. The INPDP's governing council is reported to have had its three-year mandate expire on 16 April 2024, with no confirmed renewal located as of 11 October 2026; no INPDP primary announcement of renewal or non-renewal was located, so the regulator's current governance status is a genuine gap rather than a settled fact. Separately, the enactment status of a GDPR-aligned reform bill intended to replace the operative Organic Law 2004-63 is itself disputed between sources: one aggregator source asserts a plenary vote on 20 June 2025, promulgation on 10 July 2025, and full legal force from 11 July 2026, while a jurisdiction-tracking brief and a digital-rights forum both continue to treat the 2004 law as the operative basis as of October 2026. The reform bill, reported as spanning approximately 123 to 132 articles across six chapters, was reported under hearing before the Committee on Rights and Liberties as of February 2026. Neither the promulgation claim nor the continuing-2004-law claim has been confirmed against a Journal Officiel or parliamentary primary text this cycle, so the dispute is reported here as unresolved rather than decided either way. Adding to the institutional picture, the digital-rights organisation Forum Chawki Gaddes publicly called on 5 October 2026 for urgent reactivation of the INPDP and for it to be given the autonomy and means necessary to accomplish its missions, a call issued in response to a reported proliferation of social-media disclosures of sensitive personal data. #### Outlook Resolution of the reform bill's actual enactment status against a primary Journal Officiel text is the single development that would most change this picture, since it determines whether the sensitive-data, breach-notification, and profiling provisions reported in connection with the bill are already binding or remain prospective. Confirmation of the INPDP council's governance status, and any institutional response to the Forum Chawki Gaddes's 5 October 2026 call for reactivation, are the next items to watch. Periodic update · new data 2026-10-11 #### Regulator & Framework Tunisia's data-protection framework currently rests on Organic Law n2004-63 of 27 July 2004, with the Instance Nationale de Protection des Donnees Personnelles (INPDP) as the designated data-protection authority. The institutional picture surrounding INPDP is currently unsettled: its fifteen-member council was appointed for a three-year term that expired on 16 April 2024, and no confirmed renewal has been located in sourcing available this cycle. This matters structurally because a regulator operating beyond its council's mandated term raises questions about the legal standing of decisions taken during the interim period, even though the statutory existence of the authority itself is not in question. The government's own parliamentary answer is understood to describe the 2004 law as obsolete, which is a notable admission from within government itself regarding the adequacy of the current statutory framework, independent of any external commentary. Against that institutional backdrop, a substantial reform effort has been underway. A GDPR-aligned bill comprising 123 articles across six chapters -- addressing general principles, data-subject rights, processing regimes, the data-protection authority itself, penalties, and final and transitional provisions -- was under committee hearing as of 24-25 February 2026, with both the Ministry of Health and the INPDP heard during that process. The breadth of the bill, spanning the full architecture of a modern data-protection law rather than a narrow amendment, suggests an intent to replace rather than patch the 2004 framework. The inclusion of a dedicated chapter addressing the data-protection authority itself is particularly relevant given the current council-mandate gap: the bill may address the INPDP's own institutional structure and appointment mechanics as part of the broader reform, though the precise content of that chapter has not been confirmed in sourcing retrieved this cycle. No status update on the bill's progress beyond the late-February 2026 committee hearings has been located, meaning its current position in the legislative process -- whether it remains in committee, has advanced to a floor reading, or has stalled -- cannot be confirmed as of the most recent available reporting. This is itself a notable gap: a bill of this scope and apparent government backing (given ministries were heard in committee) might be expected to generate further news coverage as it progresses, and the absence of such coverage could indicate either continued committee-stage deliberation or a slowing of legislative momentum, though neither can be confirmed from available sourcing. The combination of a lapsed regulatory-authority mandate and a stalled-or-quiet pending comprehensive reform is the single most consequential structural fact about Tunisia's data-protection regime at present. It affects not only the content of substantive data-protection law but the institutional credibility of the body charged with enforcing whatever law is in force, whether the current 2004 statute or a future reformed one. #### Outlook Two developments would most clearly indicate forward movement: a formal announcement of INPDP council renewal or reconstitution, and any report of the GDPR-aligned bill advancing beyond committee hearings toward a floor vote. Absent either, Tunisia's data-protection framework remains in a holding pattern -- operating under an acknowledged-obsolete 2004 statute, supervised by an authority whose council mandate has lapsed, with a comprehensive reform bill whose progress since February 2026 cannot be confirmed. Readers assessing Tunisia data-protection risk should treat the current framework as institutionally fragile pending resolution of either or both threads. This content is analytical orientation only and does not constitute legal advice. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (10) - [IAPP](https://westin.iapp.org/resources/global-privacy-directory/) — The Instance Nationale de Protection des Données à Caractère Personnel (INPDP) is Tunisia's national data protection authority. - [CNIL / LINC](https://linc.cnil.fr/en/1970-2021-data-protection-spreads-world) — The INPDP was created in 2008 pursuant to Tunisia's 2004 personal data protection law. - [IAPP](https://westin.iapp.org/resources/global-privacy-directory/) — Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data is Tunisia's primary omnibus data-protection statute. - [CNIL / LINC](https://linc.cnil.fr/en/1970-2021-data-protection-spreads-world) — Article 24 of Tunisia's 2002 constitutional amendment enshrines the inviolability of personal information, forming the constitutional basis for the 2004 data protection law. - [Arabesque.tn](https://www.arabesque.tn/fr/article/131043/tunisie-reforme-des-instances-des-donnees-personnelles-et-de-l-acces-a-l-information) — Instance Nationale de Protection des Données Personnelles (INPDP) — The INPDP's 15-member council was appointed for a 3-year term that expired 16 April 2024; the government's own parliamentary answer describes the 2004 law as 'obsolete'. - [https://www.webmanagercenter.com/2026/02/23/562193/tunisie-vers-un-nouveau-cadre-legal-pour-renforcer-la-protection-des-donnees-personnelles/](https://www.webmanagercenter.com/2026/02/23/562193/tunisie-vers-un-nouveau-cadre-legal-pour-renforcer-la-protection-des-donnees-personnelles/) — GDPR-aligned reform bill (Tunisia) — A GDPR-aligned reform bill of 123 articles in 6 chapters -- covering general principles, data-subject rights, processing regimes, the data-protection authority, penalties, and final/transitional provisions -- was under committee hearing as of 24-25 February 2026, including hearings of the Health Ministry and INPDP itself; not yet enacted. - [Tuniscope](https://www.tuniscope.com/article/361169/actualites/tunisie/ardhaoui-544012) — Instance Nationale de Protection des Données Personnelles (INPDP) — Following the retirement of Chawki Gaddes, Hafsia Ardhaoui was named interim president by the Head of Government; the council now has only one permanent member and two non-permanent members, with an administrative-magistrate seat vacant. - [WebManagerCenter](https://www.webmanagercenter.com/2026/02/23/562193/tunisie-vers-un-nouveau-cadre-legal-pour-renforcer-la-protection-des-donnees-personnelles/) — GDPR-aligned reform bill (Organic Law 2004-63 replacement) — A GDPR-aligned organic-law bill to replace Law 2004-63, introducing reinforced consent standards, turnover-based sanctions and expanded INPDP powers, remains unenacted; committee hearings before the ARP's Rights and Liberties Committee concluded in late February 2026 with no further progress located this cycle. - [dataprotection.gi](https://dataprotection.gi/jurisdictions/tunisia/) — The INPDP's governing council mandate is reported expired with no confirmed renewal. - [INPDP](https://www.inpdp.tn/Procedures.pdf) — Ordinary processing requires prior declaration to the INPDP; sensitive processing requires prior authorisation. ### Tunisia: D2 Lawful Processing & Special Data4 sub-modulesRedEnacted in forceModule confidence: Probable▾ No claim in this module could be raised above Speculative confidence given inability to access primary/authoritative secondary text. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red No claim in this module could be raised above Speculative confidence given inability to access primary/authoritative secondary text. D2 · Lawful Processing — Full Module Record 4 sub-modules · 63 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Tunisia: D3 Data Subject Rights5 sub-modulesRedEnacted in forceModule confidence: Uncertain▾ No sub-module claim could be raised above Speculative confidence without primary-text access. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red No sub-module claim could be raised above Speculative confidence without primary-text access. #### Sub-modules (5) #### Access RightRed Subject-access request framework not confirmed against primary text. #### Rectification And ErasureRed Rectification/erasure rights not confirmed against primary text. #### Restriction And ObjectionRed Restriction/objection rights not confirmed. #### Data PortabilityRed Portability is not a feature of most pre-GDPR-era omnibus statutes; presence in Tunisian law not confirmed either way. #### Deadlines And Response WindowsRed Statutory response-window for controller replies not confirmed. Claims (1): - INPDP authorisation decisions — INPDP decisions on authorisation requests are reported to take up to one month; no statutory subject-access-request deadline located. Tunisia's 2004 law is generally understood to include a subject-access and correction framework consistent with first-generation omnibus statutes, but the specific access, rectification/erasure, restriction/objection, portability, and statutory response-window provisions could not be confirmed against primary or accessible authoritative secondary text in this research pass. Sources and claims (1) - [DPO Consulting](https://www.dpo-consulting.com/fr-fr/blog/loi-tunisienne-sur-la-protection-des-donnees) — INPDP authorisation decisions — INPDP decisions on authorisation requests are reported to take up to one month; no statutory subject-access-request deadline located. ### Tunisia: D4 Controller/Processor Duties7 sub-modulesRedEnacted in forceModule confidence: Probable▾ No sub-module claim could be raised above Speculative confidence without primary-text access; flagged for primary-source escalation given downstream consumer dependency. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red No sub-module claim could be raised above Speculative confidence without primary-text access; flagged for primary-source escalation given downstream consumer dependency. Periodic update · new data 2026-10-11 #### Controller/Processor Duties Tunisia's current law imposes no codified controller-accountability package of the kind familiar from GDPR-aligned regimes: there is no existing requirement to appoint a data protection officer, no mandatory register of processing activities, no data protection impact assessment obligation, and no breach-notification duty to the INPDP. This absence is a function of the 2004 statute's age and design, which predates the accountability-by-design model that has become the international baseline over the past decade. The pending GDPR-aligned reform bill, under committee hearing as of 24-25 February 2026, would introduce all four of these elements. It would require data controllers to appoint a DPO for large-scale or sensitive processing, maintain a mandatory register of processing activities, conduct a DPIA before engaging in high-risk processing, and notify personal-data breaches to the INPDP within 72 hours. This cluster of provisions would bring Tunisia's controller-obligation architecture substantially into alignment with the GDPR model, replacing an currently accountability-light regime with one built around documented, auditable compliance processes. None of these obligations are current law, and no commencement date is available because the bill itself has not been enacted. This is an important distinction for any organisation currently assessing its Tunisia compliance posture: there is no present legal requirement to build DPO, ROPA, DPIA or 72-hour-breach-notification capability, even though such capability would likely become necessary if and when the bill passes. Organisations operating in or targeting the Tunisian market should treat the bill's eventual provisions as a forward planning consideration rather than a current obligation. The practical significance of a future 72-hour breach-notification duty in particular should be read alongside the broader institutional picture: Tunisia's data-protection authority, the INPDP, is currently operating with a council whose mandate expired in April 2024. A breach-notification regime is only as effective as the capacity of the body receiving those notifications to act on them, so the eventual operational effectiveness of a 72-hour duty, if enacted, would depend in part on resolution of the INPDP's own institutional standing. #### Outlook The controller/processor duties module's trajectory depends entirely on the fate of the pending reform bill. No sourced update on the bill's status beyond late-February 2026 committee hearings is available, so the timeline for when -- or whether -- DPO, ROPA, DPIA and breach-notification obligations become binding Tunisian law remains unknown. This is a module to revisit once further legislative movement is confirmed; in the interim, the absence of these obligations under current law is itself the operative fact for any compliance assessment. This content is analytical orientation only and does not constitute legal advice. D4 · Controller & Processor — Full Module Record 7 sub-modules · 43 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Tunisia: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ International-instrument status (Convention 108) is Confirmed via independent secondary sources; domestic transfer-mechanism mechanics and EU adequacy status require primary-source confirmation. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data; Council of Europe Convention 108 (1981) Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Amber International-instrument status (Convention 108) is Confirmed via independent secondary sources; domestic transfer-mechanism mechanics and EU adequacy status require primary-source confirmation. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 117 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Tunisia: D6 Sectoral Watch7 sub-modulesRedEnacted in forceModule confidence: Probable▾ Absent finding is explicit, not a silent omission; sectoral texts (e.g., Tunisian telecommunications code, banking secrecy rules) were not accessible for cross-reference against Organic Law 2004-63 in this pass. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red Absent finding is explicit, not a silent omission; sectoral texts (e.g., Tunisian telecommunications code, banking secrecy rules) were not accessible for cross-reference against Organic Law 2004-63 in this pass. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 24 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Tunisia: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Explicit absent finding — no comprehensive adtech-specific regime identified distinct from the general Organic Law 2004-63 framework. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red Explicit absent finding — no comprehensive adtech-specific regime identified distinct from the general Organic Law 2004-63 framework. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 24 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Tunisia: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only contextual/political-economy evidence located; no direct statutory provision on ADM, biometric regime, or surveillance carveouts was confirmed. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red Only contextual/political-economy evidence located; no direct statutory provision on ADM, biometric regime, or surveillance carveouts was confirmed. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The INPDP is reported to have been designated the central regulator for AI systems that process personal information under Tunisia's National AI Strategy 2026-2030. This designation is reported as institutional only: no substantive assessment duty, registration requirement, or enforcement mechanism attached to the designation was located this cycle, and the primary strategy document or designation instrument itself was not directly retrieved, so the practical scope of the INPDP's AI-oversight role remains to be confirmed. In the interim, the existing sensitive-data regime under Organic Law 2004-63 continues to govern biometric and genetic data as it does other sensitive categories: processing of biometric, genetic, health, racial, religious, political, and criminal data is reported to require explicit written consent from the data subject together with prior INPDP authorisation before processing may begin. No dedicated profiling, automated-decision-making, or algorithmic-risk-assessment rule exists under the currently-operative 2004 law; a secondary source reports that the pending, disputed-enactment-status reform bill would introduce provisions addressing profiling, algorithmic risk, and a right to contest automated decisions, but this is not confirmed against the bill's primary text and depends on the broader enactment-status dispute affecting the reform bill as a whole. #### Outlook The practical content of the INPDP's AI-regulator designation, and whether the reform bill's reported profiling and automated-decision provisions are in force, both turn on confirmation of underlying primary documents not retrieved this cycle: the National AI Strategy designation instrument and the reform bill's Journal Officiel text respectively. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Tunisia's current data-protection law already treats biometric data as a category of sensitive data under the 2004 statute, meaning biometric processing is not wholly unregulated today even in the absence of a dedicated algorithmic-governance framework. What does not currently exist is any codified regime addressing automated decision-making transparency, AI-specific data-use rules, or CCTV surveillance governance as distinct categories, beyond whatever general obligations the 2004 law's written-consent and prior-declaration model imposes on any processing activity, including one that happens to involve algorithmic, biometric or surveillance elements. The pending GDPR-aligned reform bill, under committee review as of late February 2026, would introduce transparency rights specifically tied to automated decision-making, a framework addressing AI-related data use, and rules governing CCTV surveillance. This would represent a meaningful expansion of Tunisia's data-protection law into territory that the current 2004 statute does not address in any targeted way, reflecting the kind of modernisation that has occurred in comparable reform processes elsewhere as automated-decision and surveillance technologies have become more pervasive since the original law's drafting two decades ago. The practical significance of introducing automated-decision-making transparency rights would be to give data subjects a mechanism to understand and potentially contest decisions made about them by algorithmic systems -- a right that does not exist in any form under current Tunisian law. Similarly, a dedicated AI-related data-use framework would be the first Tunisia-specific regulatory engagement with AI as a distinct category of data processing, separate from the general processing rules that currently apply to any form of data handling regardless of whether automated or algorithmic systems are involved. CCTV surveillance governance, meanwhile, would address a widely deployed technology that currently sits outside any dedicated statutory framework beyond general data-protection principles. As with the other provisions of the pending bill, none of these algorithmic, biometric or surveillance-governance elements have legal effect as of the current reporting; they remain proposals under committee review, and no commencement date is available even in the event of eventual enactment. The existing treatment of biometric data as sensitive data is the one element of this module that is current law rather than a future prospect, and that treatment is not reported to be changing under the pending bill -- rather, the bill would add new categories (automated decision-making, AI, CCTV) around and beyond the existing biometric-sensitive-data baseline. #### Outlook The algorithmic, biometric and surveillance-governance provisions of the pending reform bill are among its more forward-looking elements, addressing technology categories that have expanded significantly in deployment since Tunisia's 2004 law was drafted. Their eventual enactment would be a significant modernisation step, but the bill's status beyond late-February 2026 committee hearings is not confirmed in available sourcing, so no timeline can currently be given. In the interim, biometric data retains its existing sensitive-data classification under the 2004 law, while automated-decision-making, AI-specific, and CCTV-specific governance remain unaddressed by any dedicated current rule. This content is analytical orientation only and does not constitute legal advice. Periodic update · new data 2026-10-05 #### Algorithmic, Biometric & Surveillance Governance The development in this module for Tunisia this cycle is adjacent to the core data-protection perimeter rather than inside it. A text dated 30 September 2026 amended Article 24 of Decree-Law 54 of 13 September 2022, the statute governing information-system offences in Tunisia, revising its sanctions schedule: a repeat offence now carries six months' imprisonment and a fine of TND 50,000. Decree-Law 54 is a criminal-law instrument addressing online-content and information-system conduct; it is not a personal-data-processing law, and this amendment does not touch Tunisia's data-protection statute, which remains Organic Law No. 2004-63. The amendment is reported at a probable tier, resting on a single Tunisian press source describing the 30 September 2026 text. The reason this sits in the algorithmic, biometric and surveillance governance module at all is architectural rather than substantive: Decree-Law 54 forms part of the broader digital-governance and online-conduct legal environment that surrounds, and will eventually interact with, any enacted data-protection reform. Tunisia's pending data-protection reform bill (tracked separately in the regulator-and-framework module and withheld from this cycle's write-list as stable) would, if enacted, introduce automated-decision-making and profiling provisions. Those provisions, were they to be enacted, would sit in an information-governance landscape that already includes Decree-Law 54's criminal sanctions for information-system offences -- meaning the two instruments are structurally adjacent even though neither currently cross-references the other in available reporting. No sourced provision in Decree-Law 54, as amended, itself addresses automated decision-making, profiling, biometric processing, or state-surveillance carve-outs in data-protection terms; the amendment is confined to sanction severity for repeat offences. No other algorithmic, biometric or surveillance-governance development for Tunisia was sourced this cycle. In particular, no provision establishing or amending facial-recognition, biometric-identification or automated-decision-making rules specific to data protection has been located; the facial-recognition requirement reported elsewhere this cycle for Tunisia's payment sector is a payments-regulatory development outside this monitor's module and is not analysed here. #### Outlook The amendment's practical effect for this cycle is confined to the criminal-sanctions schedule attaching to repeat information-system offences; it does not change Tunisia's data-protection statute or introduce any new algorithmic-governance rule. The item to watch is whether Tunisia's pending data-protection reform bill, if and when it advances past committee review, introduces automated-decision-making or profiling provisions that would populate this module substantively. As at the most recent corroborated reporting, that bill remained under ARP committee review with no floor vote reported, so no near-term change to this module's substantive content is confirmed. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 82 words · 7 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Tunisia: D9 Children & Vulnerable Groups5 sub-modulesRedEnacted in forceModule confidence: Probable▾ Explicit absent finding on all five declared sub-modules. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red Explicit absent finding on all five declared sub-modules. D9 · Children's Privacy — Full Module Record 5 sub-modules · 21 words · 1 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Tunisia: D10 Enforcement & Redress6 sub-modulesRedEnacted in forceModule confidence: Probable▾ No claim in this module could be raised above Uncertain confidence; core enforcement metrics (powers, penalties, fines, funding, redress mechanisms) require primary-source escalation. Primary framework Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data Supervisory authority Instance Nationale de Protection des Données à Caractère Personnel (INPDP) Traffic-light rationale — Red No claim in this module could be raised above Uncertain confidence; core enforcement metrics (powers, penalties, fines, funding, redress mechanisms) require primary-source escalation. Periodic update · new data 2026-10-26 #### Enforcement & Redress Tunisia's data-protection enforcement capacity sits within the same institutionally constrained regulator described in the framework assessment above: a governing council reduced to one permanent and two non-permanent members, against a founding design of fifteen, with an administrative-magistrate seat vacant. That thinness in permanent membership is reported as a probable constraint on the regulator's practical capacity to pursue enforcement and redress matters, independent of whatever formal powers it holds on paper. The pending GDPR-aligned reform bill would, if enacted, materially expand those formal powers. Reports suggest it would grant the regulator the ability to issue warnings, order cessation of unlawful processing, and impose administrative fines reportedly calculated as a percentage of global annual turnover, a structure mirroring the European General Data Protection Regulation's penalty architecture. None of this has legal effect under the law currently in force; the regulator today holds no comparable turnover-based fining power, and this entire power set remains prospective and attributed to law-firm commentary rather than to primary legislative text, warranting a hedged reading of its eventual shape and timing. #### Outlook Whether Hafsia Ardhaoui's interim presidency resolves or merely continues to sit atop the lapsed council mandate is directly relevant to enforcement capacity: a fuller council, if restored, would plausibly strengthen the regulator's practical ability to pursue cases, independent of any change in its formal legal powers. The enactment of the pending reform bill, which remains stalled since its February 2026 committee hearings with no further progress confirmed, would be the more significant structural shift, introducing for the first time a turnover-based fining power and expanded cessation and warning powers; until enactment, Tunisia's enforcement and redress regime remains bounded by the weaker 2004-law powers and a thin permanent membership. Periodic update · new data 2026-10-18 #### Enforcement & Redress Tunisia's enforcement and redress picture this cycle centres on a public capacity-and-governance intervention rather than a specific enforcement action. On 5 October 2026 the digital-rights organisation Forum Chawki Gaddes publicly called for urgent reactivation of the INPDP and for the regulator to be given the autonomy and means necessary to carry out its missions, a call made in the context of a reported proliferation of social-media disclosures of sensitive personal data. Independently of that call, data subjects retain a judicial route: INPDP decisions of a jurisdictional nature on complaints are reported to be appealable before the Tunis Court of Appeal. On penalties, the currently-operative regime under Organic Law 2004-63 is reported to carry fixed fines, reported in a range between 1,000 and 50,000 Tunisian dinars depending on the violation, together with imprisonment of up to five years for the more serious categories of breach; the exact figures have not been independently verified against primary statutory text this cycle. A reform bill with disputed enactment status is reported to propose introducing turnover-based fines in place of, or alongside, the current fixed-fine structure, but whether this provision is in force depends on the same contested enactment question affecting the reform bill generally. #### Outlook Whether the Forum Chawki Gaddes's public call generates a dated institutional response from the INPDP or the Tunisian government is the next concrete development to watch in this module, together with any resolution of the reform bill's enactment status that would clarify whether the reported turnover-based fine structure is currently enforceable. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 108 words · 10 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) deadlines and response windows Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties