Tunisia's New Data Law: 2026 Deadline Looms for GDPR-Like Rules

The clock is ticking for businesses and public sector entities operating in Tunisia. On July 11, 2026, the nation's new data protection framework, the Fundamental Bill on the Protection of Personal Data (2025), will fully enter into force. This isn't just an update; it's a comprehensive overhaul designed to align Tunisia with global privacy standards, most notably the European Union's stringent General Data Protection Regulation (GDPR). Organizations that fail to prepare for this deadline face not only reputational damage but also potentially crippling financial penalties.

What's changing

The Projet de loi organique relatif à la protection des données à caractère personnel (2025) represents a seismic shift in how personal data is managed across Tunisia. Its core objective is to safeguard the fundamental right to privacy for all individuals by modernizing existing regulations and introducing robust new requirements.

One of the most significant changes is the expansion of individual data rights. Individuals will gain greater control over their personal information, including the "right to erasure" (often called the "right to be forgotten"), allowing them to demand the deletion of their data under certain conditions. They will also have the "right to portability," enabling them to easily obtain and transfer their data to another service provider. These rights empower individuals and place a greater burden of responsibility on organizations to manage data transparently and responsively.

The law mandates a proactive approach to privacy through principles like "data protection by design and by default." This means that privacy safeguards must be integrated into the development of products, services, and systems from their earliest stages, rather than being an afterthought. For processing activities deemed high-risk, organizations will be required to conduct Data Protection Impact Assessments (DPIAs) to identify and mitigate potential privacy risks before processing begins.

Accountability is a cornerstone of the new framework. All organizations must maintain a "Record of Processing Activities," a detailed inventory of how personal data is collected, used, stored, and shared. Furthermore, many organizations, particularly those involved in large-scale or high-risk processing, will need to appoint a Data Protection Officer (DPO). The DPO will be responsible for overseeing compliance, advising on data protection matters, and acting as a liaison with the supervisory authority.

A critical new obligation is the mandatory notification of data breaches. Should a personal data breach occur, organizations must notify the National Authority for the Protection of Personal Data (INPDP) within 72 hours of becoming aware of it. If the breach poses a high risk to the rights and freedoms of individuals, affected individuals must also be informed without undue delay.

International data transfers are also subject to stricter rules. Organizations transferring personal data outside Tunisia must ensure that the receiving country provides an "adequate level of protection" or implement specific safeguards, such as approved contractual clauses, to guarantee data security and privacy.

Perhaps the most impactful change for businesses is the dramatic increase in potential penalties for non-compliance. The INPDP, now an independent regulatory body with significantly enhanced powers, can issue warnings, order processing to cease, and impose substantial administrative fines. These fines are no longer nominal; they can be a percentage of a company's global annual turnover, mirroring the GDPR's strict penalty structure. Intentional violations can also lead to criminal penalties, and individuals who suffer damages due to non-compliance can seek compensation. This shift transforms data governance from a secondary concern into a critical business imperative with severe financial implications for non-adherence.

Who is affected

The scope of Tunisia's Fundamental Bill on the Protection of Personal Data (2025) is remarkably broad, ensuring comprehensive coverage across the nation's economy and public sector. It applies to all organizations, regardless of their size or sector, that process personal data within Tunisia. This includes both data controllers, who determine the purposes and means of processing personal data, and data processors, who handle data on behalf of controllers.

Whether you are a large multinational corporation, a small local business, a government agency, or a non-profit organization, if you collect, store, or use personal data of individuals in Tunisia, this law applies to you. The requirement for all organizations to maintain a "Record of Processing Activities," for instance, underscores the universal applicability of the law, meaning even small entities cannot afford to overlook its provisions. This broad reach ensures that the fundamental right to privacy is protected consistently across all facets of Tunisian society.

Three things to do this week

With the July 11, 2026, deadline rapidly approaching, organizations should not delay in taking concrete steps towards compliance. Here are three critical actions to prioritize:

1. Initiate Data Protection Impact Assessments (DPIAs) for high-risk processing: Identify any current or planned processing operations that involve sensitive data, large-scale processing, or new technologies that could pose a high risk to individuals' rights and freedoms. Begin conducting DPIAs for these activities to systematically assess and mitigate potential privacy risks. This proactive step is crucial for embedding privacy considerations from the outset.
2. Review and integrate "privacy by design and by default": Evaluate your existing products, services, and IT systems. Are privacy safeguards built into their core architecture, or are they add-ons? Start planning how to embed privacy-enhancing features and default privacy settings into all new developments and significant updates. This involves training development teams and establishing clear guidelines for privacy integration.
3. Strengthen technical and organizational security measures: Conduct a thorough audit of your current data security practices. Ensure you have robust technical measures (e.g., encryption, pseudonymization, access controls) and organizational measures (e.g., data protection policies, staff training, incident response plans) in place to protect personal data against unauthorized access, disclosure, alteration, or destruction. Document these measures comprehensively.

Related context

Tunisia's new data protection law does not exist in a vacuum; it complements and updates other significant regulatory efforts. It effectively replaces and modernizes the Organic Act No. 2004-63 on the Protection of Personal Data, which previously governed data privacy but lacked the teeth and scope of the new bill.

Furthermore, it interacts with the Decree-Law No. 2022-54 on Combating Offences Relating to Information and Communication Systems. While the Decree-Law focuses on cybercrime and digital offenses, the new data protection bill provides the overarching framework for lawful data processing and individual rights, ensuring that data handling practices are both secure and compliant with privacy principles.

Looking ahead, the principles established in this data protection law will undoubtedly influence and potentially intersect with emerging regulations, such as the proposed Tunisia AI Regulation Overview. As artificial intelligence technologies become more prevalent, the ethical and privacy implications of AI systems will need to be carefully considered within the robust data protection framework now being established.

The full entry into force of Tunisia's Fundamental Bill on the Protection of Personal Data in July 2026 marks a pivotal moment for data privacy in the country. Organizations must view this not as a burden, but as an opportunity to build trust with their customers and stakeholders through responsible data stewardship. Proactive compliance is the only path forward.

Note: this article was drafted by AI - Google Gemini