On 14 July 2025, 17 members of parliament tabled Private Member’s Organic Bill No. 095/2025, made up of 132 articles divided into six chapters, with the aim of replacing Organic Law No. 2004-63, now considered unsuited to the digital age. As of early 2026, the bill was still under review by the Rights and Freedoms Committee of the Assembly of the Representatives of the People and had not yet been adopted.
Main innovations of the bill
The bill provides for the creation of an independent public authority dedicated to data protection, with strengthened powers of regulation, audit and sanction. It introduces an obligation to appoint a data protection officer (DPO) for public or private actors processing special categories of data or operating on a large scale, along the lines of the European GDPR DPO. It imposes mandatory notification of personal data breaches within 72 hours, both to the supervisory authority and to the individuals concerned, depending on the risk. Finally, it provides for dissuasive sanctions: administrative fines ranging from 3,000 to 200,000 Tunisian dinars, with prison sentences abolished except in cases of serious breach or repeat offending.
Why this text is essential
| Organic Law 2004 (No. 63-2004) | 2025 bill | |
|---|---|---|
| Individuals’ rights | Access, rectification, objection (partly limited) | Strengthened rights including erasure, portability, broader objection |
| Consent | Implicit, loosely regulated | Explicit, revocable and traceable |
| Data breach | No obligation to report | Mandatory notification to the authority and to individuals (72 h) |
| DPO | No mandatory DPO | DPO required depending on threshold and nature of processing |
| Supervisory authority | Limited powers | Extended powers of control and fines |
| Sanctions | Mainly criminal, low fines | Mainly financial and high, little imprisonment |
This bill aims to modernise the Tunisian legal framework by making it consistent with international standards, in particular those of the GDPR, as regards individuals’ rights, consent, transparency and sanctions.
Why talk about it now
This reform brings Tunisia closer to European data protection standards and facilitates exchanges with the European Union. It increases the accountability of organisations: legal classification of processing, data mapping, transparency, mandatory documentation, notification obligations and the appointment of a DPO. All organisations operating in Tunisia, subcontractors, SMEs, multinationals and public institutions, will need to anticipate these new rules.
The firm supports French, Tunisian and international companies in anticipating this reform and in bringing their data processing in Tunisia into compliance. For any question, contact the firm.
References
- Organic Bill No. 095/2025 on the protection of personal data, tabled with the Assembly of the Representatives of the People on 14 July 2025
- Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data (Tunisia)
- Regulation (EU) 2016/679 (GDPR)