Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)

Tunisia

v2004

10 domains

23 controls

Tunisia's Organic Law No. 2004-63 on the Protection of Personal Data (2004) was the first comprehensive data protection law in Africa and the Arab world. The National Authority for the Protection of Personal Data (INPDP) oversees compliance. The law establishes processing principles, individual rights, registration requirements, and cross-border transfer restrictions. A reform aligning with GDPR has been under consideration.

Verified

Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) is a compliance framework from Tunisia with 10 domains and 23 controls. The largest domains are Data Quality, Retention and Security (4 controls), Governance, Records and Assurance (4 controls), Specific Processing Contexts (4 controls). Every control below carries what it requires and what an assessor expects to see.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.

Framework Domains (10)

Data Quality, Retention and Security

4 controls

Controls in the Data Quality, Retention and Security domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 4 controls
Code	Title	Description
TN-DPL-06	Data Quality and Accuracy	Maintain personal data that is accurate, complete and kept up to date, with mechanisms to allow data subjects to verify...
TN-DPL-07	Retention and Destruction	Personal data must be retained no longer than necessary for the purpose for which it was collected, with destruction or...
TN-DPL-08	Security of Processing	Implement appropriate technical and organisational measures to protect personal data against unauthorised access, altera...
TN-DPL-09	Data Breach Notification	Notify the INPDP and affected data subjects of personal data breaches in line with applicable timelines and document the...

Data Subject Rights and Transparency

2 controls

Controls in the Data Subject Rights and Transparency domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 2 controls
Code	Title	Description
TN-DPL-03	Data Subject Rights Handling	Operate procedures to handle access, rectification, opposition and erasure requests from data subjects within statutory...
TN-DPL-11	Privacy Notice and Transparency	Inform data subjects at the point of collection about the controller identity, purposes, recipients, rights and the exis...

Governance

1 controls

Controls in the Governance domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 1 controls
Code	Title	Description
TUNISIA-4	Registration, Governance, Breach	Per Tunisia Law: INPDP registration + governance + breach + enforcement.

Governance, Records and Assurance

4 controls

Controls in the Governance, Records and Assurance domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 4 controls
Code	Title	Description
TN-DPL-16	Records of Processing Activities	Maintain an internal register of all processing activities including purpose, categories of data and recipients, availab...
TN-DPL-17	Privacy Governance and Accountability	Designate accountable management for personal data protection, allocate resources and report to senior leadership on pri...
TN-DPL-18	Training and Awareness	Train staff handling personal data on Tunisian data protection obligations, with role specific content for DPO, IT, HR a...
TN-DPL-19	Internal Audit and Compliance Monitoring	Operate a programme of internal audit and compliance monitoring to detect deviations from privacy obligations and drive...

Notification, Authorisation and Lawful Basis

3 controls

Controls in the Notification, Authorisation and Lawful Basis domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 3 controls
Code	Title	Description
TN-DPL-01	INPDP Notification and Authorisation	Notify the Instance Nationale de Protection des Donnees a Caractere Personnel (INPDP) before processing personal data an...
TN-DPL-02	Lawful Basis and Consent	Establish a lawful basis for each processing operation, with explicit, written consent of the data subject as the defaul...
TN-DPL-05	Sensitive Data Processing	Processing of sensitive data including health, racial, religious, political and trade union information requires explici...

Rights

1 controls

Controls in the Rights domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 1 controls
Code	Title	Description
TUNISIA-2	Consent, Rights	Per Tunisia Law: consent + data subject rights.

Scope

1 controls

Controls in the Scope domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 1 controls
Code	Title	Description
TUNISIA-1	Scope, Lawful Basis (Tunisia)	Per Tunisia Organic Law 2004-63 on Protection of Personal Data: scope. Align with INPDP (Instance Nationale de Protectio...

Security

1 controls

Controls in the Security domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 1 controls
Code	Title	Description
TUNISIA-3	Security and Cross-Border	Per Tunisia Law: security + cross-border with INPDP authorization.

Specific Processing Contexts

4 controls

Controls in the Specific Processing Contexts domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 4 controls
Code	Title	Description
TN-DPL-12	Direct Marketing and Cookies	Use of personal data for direct marketing and tracking technologies requires prior consent of the data subject with a si...
TN-DPL-13	Employee and HR Data	Processing of employee personal data including monitoring, performance and health information must respect proportionali...
TN-DPL-14	Video Surveillance	Video surveillance systems require INPDP notification, signage informing data subjects, purpose limitation and retention...
TN-DPL-15	Children and Minors	Collect personal data of minors only with consent of the holder of parental authority, with enhanced safeguards on profi...

Transfers and Processors

2 controls

Controls in the Transfers and Processors domain of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) — 2 controls
Code	Title	Description
TN-DPL-04	International Data Transfers	Transfers of personal data outside Tunisia require prior INPDP authorisation and adequate protection in the recipient co...
TN-DPL-10	Processor Oversight	Engage processors only under written contracts that bind them to the same protection level required of the controller, w...

What is Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) and who does it apply to?

Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) is a compliance framework from Tunisia with 10 domains and 23 controls. Tunisia's Organic Law No. 2004-63 on the Protection of Personal Data (2004) was the first comprehensive data protection law in Africa and the Arab world. The National Authority for the Protection of Personal Data (INPDP) oversees compliance. The law establishes processing principles, individual rights, registration requirements, and cross-border transfer restrictions. A reform aligning with GDPR has been under consideration. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.

What does Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) actually require?

Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) has 23 controls organised across 10 domains. The largest domains are Data Quality, Retention and Security (4 controls), Governance, Records and Assurance (4 controls), Specific Processing Contexts (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.

If I already comply with another framework, how much of Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) do I already cover?

Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) does not currently have cross-framework mappings in our system. Check back as we continuously expand our mapping database.

How do I implement Tunisia Organic Law on Personal Data Protection (Law No. 2004-63)?

Start your Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Tunisia Organic Law on Personal Data Protection (Law No. 2004-63) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 23 controls and track your progress.

Start Your Compliance Journey

Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 686 frameworks.

Get Started Free →

Free forever — no credit card required