A Tunisian company working with European clients, a French company established in Tunisia, an IT service provider operating on both sides of the Mediterranean: three sets of rules now overlap. The European GDPR, Tunisia’s personal data protection law, which is being overhauled, and the European regulation on artificial intelligence, known as the AI Act, often apply at the same time to the same activity. Here is what applies in practice and what to anticipate.
Key points
- The GDPR applies directly to a Tunisian company that targets individuals in the European Union; a Tunisian processor working for a European client bears its requirements through contract.
- Organic bill No. 095/2025, under review by Tunisia’s Assembly of the Representatives of the People, is intended to replace Law No. 2004-63 with a regime inspired by the GDPR.
- The AI Act may apply to a Tunisian provider as soon as it markets an AI system in the EU or the output of that system is used there.
The GDPR can apply to a Tunisian company
The General Data Protection Regulation (Regulation (EU) 2016/679) does not stop at the borders of the European Union. Article 3(2) applies it to a company established outside the EU whenever it offers goods or services to individuals located in the EU, or monitors their behaviour, for instance through online profiling. A Tunisian platform selling to French customers, or an app analysing the behaviour of European users, falls into this category: it must comply with the GDPR and, as a rule, appoint a representative in the EU (Article 27).
The position of a processor is different. A Tunisian company processing data on behalf of a European client, such as an offshore development or support centre, is not directly subject to the GDPR merely because of that relationship, according to Guidelines 3/2018 of the European Data Protection Board. It nevertheless bears the GDPR’s requirements indirectly: a processing agreement compliant with Article 28, standard contractual clauses governing the transfer of data to Tunisia, security measures, and a duty to alert its client without undue delay in the event of a personal data breach, so that the client can notify the supervisory authority within 72 hours. Many Tunisian companies discover these requirements during an audit by their European client, which is the worst possible moment to find out.
Tunisia is preparing an overhaul of its law, inspired by the GDPR
Since 2004, Tunisia has had Organic Law No. 2004-63 of 27 July 2004, one of the first data protection laws in the Arab world, enforced by the National Authority for the Protection of Personal Data (INPDP). The law now shows its limits in the digital economy: weak sanctions, limited investigative powers and an outdated regime for international transfers.
Organic bill No. 095/2025, tabled in July 2025 by seventeen members of parliament, is intended to replace it. It contains 132 articles in six chapters and adopts part of the GDPR’s architecture: a data protection officer function, an independent supervisory authority with sanctioning powers, a revised framework for international transfers, provisions dedicated to video surveillance and artificial intelligence, and tougher sanctions, its authors referring to fines of up to 200,000 dinars in addition to prison sentences.
The bill is being examined by the Rights and Freedoms Committee of the Assembly of the Representatives of the People. In February 2026 the committee heard the bill’s authors, the Ministry of Health, the Presidency of the Government and the data protection authority, and in May 2026 it decided to extend its consultations to experts and civil society organisations. No date has yet been set for its adoption. Our detailed analysis of the bill is available in the article Tunisia 2025: a new bill on personal data protection, towards an ambitious reform.
Artificial intelligence: regulation at two speeds
On the European side, Regulation (EU) 2024/1689 on artificial intelligence, known as the AI Act, follows the same extraterritorial logic as the GDPR. It applies to any provider placing an AI system on the EU market, wherever it is established, and to providers and deployers established outside the EU whenever the output produced by their system is used in the EU (Article 2).
A Tunisian software publisher selling a recruitment screening tool or a creditworthiness assessment tool to European clients is therefore a provider within the meaning of the regulation. Since both uses are classified as high-risk, a provider established outside the EU must appoint an authorised representative established in the EU (Article 22); a comparable obligation applies to providers of general-purpose AI models (Article 54). The timeline and the obligations in detail are set out in our article AI Act: obligations for non-EU companies.
On the Tunisian side, there is as yet no law dedicated to artificial intelligence. The broad outlines of a national AI strategy for 2026-2030 were presented in August 2026 at a ministerial council: it is a policy orientation, not a binding text. Bill No. 095/2025, however, contains provisions dedicated to artificial intelligence that will directly affect many uses. Businesses therefore have every interest in anticipating convergence towards European standards rather than waiting for a specific Tunisian law.
What to anticipate now
- Map your data processing activities and the AI systems you use, including those adopted without formal approval.
- Determine, for each activity, whether the GDPR applies directly (Article 3) or through the contracts concluded with your European clients.
- Update processing agreements and transfer clauses with partners on both sides of the Mediterranean.
- Classify your AI systems under the AI Act, in particular those that could be high-risk.
- Follow the progress of bill No. 095/2025, so that its entry into force does not take you by surprise.
- Document processing activities, legal bases and automated decisions, rather than relying on a privacy policy copied from the internet.
Support on both sides of the Mediterranean
A lawyer admitted to the Paris and Tunis Bars and a certified DPO, Maître Zied El Air advises French and Tunisian companies on all three frameworks: GDPR compliance assessments, Tunisian data protection law, classification under the AI Act and drafting contracts with European or Tunisian partners. For an initial discussion, contact the firm.
References
- Regulation (EU) 2016/679 of 27 April 2016 (GDPR), Articles 3, 27 and 28
- European Data Protection Board, Guidelines 3/2018 on the territorial scope of the GDPR (Article 3)
- Regulation (EU) 2024/1689 of 13 June 2024 (AI Act), Articles 2, 22 and 54
- Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data (Tunisia)
- Organic bill No. 095/2025 on the protection of personal data, Assembly of the Representatives of the People (Tunisia)