Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)
Tunisia's Organic Law 2004-63 on personal data protection, still in force: every processing declared to the INPDP in advance, authorisation for sensitive data, video surveillance and every transfer abroad, express written consent, a written notice a month before processing, one-month access, bailiff-recorded destruction, nationality and residence conditions for those running processing, and criminal sanctions for most breaches. A GDPR-style replacement (2025 draft) is before Parliament but not adopted. Built from the French text of the law, read in full.
Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) is a compliance framework from Tunisia with 6 domains and 25 controls. The largest domains are Chapter II section II: controller and processor obligations – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) (8 controls), Chapter II section III: consent, information, access and opposition – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) (5 controls), Chapter V: public bodies, health, research and video surveillance – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (6)
Chapter II section I: prior declaration and authorisation – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)
| Code | Title |
|---|---|
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art7 | art. 7; Decree 2007-3004 Declare every processing to the INPDP before starting it |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art8 | art. 8; Decree 2007-3004 Apply for INPDP authorisation where required, with the prescribed content, and again on any change |
Chapter II section II: controller and processor obligations – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)
| Code | Title |
|---|---|
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art12 | art. 12 Do not reuse data for other purposes except with consent, vital interest or scientific need |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art13 | arts 13 to 15 Do not process criminal data; process sensitive data only with express written consent or a listed ground and INPDP authorisation |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art17 | art. 17 Never make a service or benefit conditional on accepting processing |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art18 | arts 18, 19 Secure personal data against unauthorised access, change or disclosure |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art20 | arts 20, 21 Choose processors carefully, keep them within instructions, and correct data and notify recipients within two months |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art22 | arts 22, 23 Meet the eligibility conditions and keep data confidential, even after processing ends |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art24 | arts 24 to 26 Tell the INPDP three months before ceasing processing activity |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art9 | arts 9 to 11 Process lawfully, fairly and only for explicit purposes, keeping data accurate |
Chapter II section III: consent, information, access and opposition – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)
| Code | Title |
|---|---|
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art27 | arts 27, 29, 30 Obtain express written consent, specific to the form and purpose, and separate consent for advertising |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art28 | art. 28 For a child's data, obtain the guardian's consent and a family judge's authorisation |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art31 | art. 31 Inform data subjects in writing at least a month before processing |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art32 | arts 32 to 41 Give access, a clear copy and correction within one month, including electronic requests |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art42 | arts 42, 43 Stop processing immediately on a legitimate objection, and on objection to advertising disclosure |
Chapter III: collection, retention and destruction – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)
| Code | Title |
|---|---|
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art44 | art. 44 Collect directly from the data subject; collect from third parties only with consent or a listed ground |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art45 | arts 45, 46 Destroy data at the end of retention, with a bailiff's report and an INPDP expert |
Chapter IV: communication and transfer abroad – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)
| Code | Title |
|---|---|
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art47 | arts 47, 48 Disclose to third parties only with express written consent or INPDP authorisation |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art49 | art. 49 Reuse data for historical or scientific research only with consent and INPDP authorisation |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art50 | arts 50 to 52 Transfer abroad only to adequate countries, with INPDP authorisation in every case, and never if harmful to Tunisia |
Chapter V: public bodies, health, research and video surveillance – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)
| Code | Title |
|---|---|
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art55 | arts 53 to 61 Public bodies: correct data on request, do not disclose to private persons without consent, and destroy when no longer needed |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art62 | arts 62 to 65 Health data: process only on a listed ground, only by doctors or persons bound by secrecy, and disclose with INPDP authorisation |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art66 | arts 66 to 68 Research data: use only for research, separate identities, and publish only with consent or for results |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art69 | arts 69 to 74 Video surveillance: obtain INPDP authorisation, limit places and purposes, no sound, signs, restricted disclosure and destruction |
| tunisia-organic-law-on-personal-data-protection-law-no-2004-63::art77 | arts 77, 96 Cooperate with INPDP investigations and never give it false information |
What is Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) and who does it apply to?
Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) is a compliance framework from Tunisia with 6 domains and 25 controls. Tunisia's Organic Law 2004-63 on personal data protection, still in force: every processing declared to the INPDP in advance, authorisation for sensitive data, video surveillance and every transfer abroad, express written consent, a written notice a month before processing, one-month access, bailiff-recorded destruction, nationality and residence conditions for those running processing, and criminal sanctions for most breaches. A GDPR-style replacement (2025 draft) is before Parliament but not adopted. Built from the French text of the law, read in full. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) actually require?
Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) has 25 controls organised across 6 domains. The largest domains are Chapter II section II: controller and processor obligations – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) (8 controls), Chapter II section III: consent, information, access and opposition – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) (5 controls), Chapter V: public bodies, health, research and video surveillance – Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) do I already cover?
Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.
How do I implement Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)?
Start your Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 25 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required