What Is Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data?
Tunisia's operative general privacy statute remains Organic Law No. 2004-63 of 27 July 2004. The INPDP's current legal-framework page confirms the law, and no officially published replacement or amending law was located. The law covers automated and non-automated processing, subject to statutory exclusions and public-authority exceptions. A real replacement effort is underway. Parliament's Proposal Organic Law No. 095/2025 was deposited in July 2025 and remained classified as a proposal before committees, with hearings and review continuing through 2026. The INPDP has described the 2004 framework as outdated, but neither the 2025 proposal nor the earlier 2018 government draft is current law. The 2004 law provides detailed access, correction, deletion, objection, complaint, and transfer rules, including unusually specific seven-day and ten-day procedures. No express rights equivalent to data portability, general processing restriction, or a general right against automated decision-making were located in the 2004 law.
At a glance
- Full name
- Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data
- Short code
- Organic Law No. 2004-63
- Jurisdiction
- Tunisia
- Enacted
- 2004
- Last major update
- No officially published replacement or amending law was located; Proposal Organic Law No. 095/2025 was deposited in July 2025 and remains before parliamentary committees
- Regulator
- National Authority for the Protection of Personal Data (INPDP)
- Private right of action
- Limited
- Statutory citation
- Organic Law No. 2004-63 of 27 July 2004
Scope, who Organic Law No. 2004-63 covers
Protected data
Data subject rights
Right to prior information about the data, purposes, mandatory fields, consequences, recipients, controller identity, rights, retention, security, and foreign transfers
Right to consent and withdraw consent, subject to legal-obligation, contractual, manifest-interest, and disproportionate-effort exceptions
Right of access and an intelligible copy, with a controller response period of up to one month
Right to correction, completion, modification, clarification, updating, deletion, or destruction of unlawful data
Right to mark disputed data
Right to object for valid, legitimate, and serious reasons
Right to immediate suspension of promotional disclosure after objection
Protection against non-consensual third-party collection, subject to statutory exceptions
Right to destruction after retention expires, the purpose is achieved, or data is no longer necessary
Right to complain to the INPDP; its current forms page says affected persons may submit a complaint on free-form paper or use available model forms, including for access-right violations, unwanted SMS, and illegal video-surveillance installation
Right to appeal an INPDP decision to the Court of Appeal of Tunis, generally within one month of notification
No express portability, general processing-restriction, or general automated-decision right was located
Notable features
Tunisia’s current framework is an older statute undergoing a real replacement effort. Its distinctive procedural details include a seven-day preservation request, a ten-day cessation-of-processing request after a controller or processor stops operating, one-month access and appeal periods, and prior INPDP authorization for every international transfer.
Enforcement & penalties
Regulator: National Authority for the Protection of Personal Data (INPDP)
Penalties: Article 86 provides 2-5 years’ imprisonment and a TND 5,000-50,000 fine for violating the Article 50 prohibition. Article 87 provides 2 years and a TND 10,000 fine for specified unlawful processing. Articles 89-91 provide 1 year and a TND 5,000 fine for specified unlawful disclosure, processing, or continued processing despite objection. Article 92 provides 8 months and a TND 3,000 fine for intentional access obstruction. Article 93 provides 3 months and a TND 3,000 fine for intentional harmful dissemination, or 1 month and a TND 1,000 fine without harmful intent. Article 96 provides a TND 5,000 fine for obstructing INPDP investigations or withholding documents.
Private right of action: Complaint proceedings before the INPDP and an appeal to the Court of Appeal of Tunis, generally within one month of notification, are the identified mechanisms. A general private damages route was not located in the report.
Relevance to data brokers
No Tunisia-specific data-broker registration/complaint/deletion route, nor a public-record-specific removal procedure, was located in official INPDP forms, procedure materials, or the 2004 law. INPDP’s current forms page confirms that persons affected by privacy-law violations may complain on free-form paper or use model forms, including for access-right violations, unwanted SMS, and illegal video-surveillance installation. "Not located," not "confirmed nonexistent" — general access, correction, deletion, objection, and complaint mechanisms may still apply depending on whether information qualifies as personal data and whether a public-authority exemption applies.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Tunisia’s 2004 privacy law still current?+
Yes. Organic Law No. 2004-63 remains the operative general statute. Proposal Organic Law No. 095/2025 remains before parliamentary committees and has not replaced the 2004 framework.
What privacy rights does Tunisia’s 2004 law provide?+
The law provides prior information, access, correction, deletion or destruction of unlawful data, objection, promotional-disclosure suspension, complaints to the INPDP, and appeal to the Court of Appeal of Tunis. No express portability, general processing-restriction, or general automated-decision right was located.
Is there a dedicated Tunisian data-broker removal procedure?+
No Tunisia-specific data-broker registration/complaint/deletion route, nor a public-record-specific removal procedure, was located. General access, correction, deletion, objection, and complaint mechanisms may still apply depending on the facts.
How can a person submit a privacy complaint in Tunisia?+
INPDP’s current forms page says affected persons may complain on free-form paper or use model forms made available by the authority, including forms concerning access-right violations, unwanted SMS, and illegal video-surveillance installation. This is a general INPDP route, not a broker-specific deletion procedure.
Official sources & citations
Other international privacy regimes
Organic Law No. 2004-63 sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: