Personal Data Protection in Tunisia: INPDP Procedures and Overseas Transfers
A customer database, recruitment file or overseas software provider can raise data-protection questions for a Tunisian business. Start by identifying the information involved, how it is used and who can access it.
Which legal framework should you consult?
The INPDP publishes Organic Law No. 2004-63 of 27 July 2004 and Decree No. 2007-3004 on declaration and authorization procedures in its official legal resources. Its forms page explains the prior formalities and provides the relevant forms. The procedure to examine depends on the proposed processing; a website privacy notice alone does not demonstrate that those formalities have been completed.
Are transfers outside Tunisia already regulated?
Yes. The INPDP's international-transfer guidance describes the protection requirements and prior authorization under Articles 51 and 52 of the 2004 law. Its procedure manual includes a transfer-authorization form.
For example, before moving a customer file to an overseas service, ask the provider where it stores the data and who can access it. Bring that information and the service contract to the legal review.
Prepare a useful consultation
For a business in Kairouan, Tunis or elsewhere, a practical starting file would include:
- The purpose of each customer, employee or supplier database.
- Examples of collection forms and privacy notices, without unnecessary personal records.
- Hosting and software contracts, storage countries and known subcontractors.
- Existing INPDP declarations, authorizations and correspondence.
- The planned change: a new website, recruitment tool, cloud service or overseas recipient.
These are preparation suggestions, not a complete compliance checklist. They help distinguish the facts already documented from questions that need examination.
What about a 2026 reform?
An earlier version presented specific reform requirements without identifying an official supporting text. Those assertions have been removed. This article does not establish that a replacement law has been enacted or that a proposed reform cannot exist. Any reform assessment should identify its official text, status and effective date before attributing obligations to it.
To discuss your documents and the next steps, request a consultation. The firm is based in Kairouan and can arrange remote consultations or travel as needed.