Tunisia

The cybersecurity decree-law of 11 March 2023 lists, in its Article 6, the bodies subject to compulsory periodic audit: public bodies, public telecoms network operators and telecoms and internet service providers, companies whose computer networks are interconnected through telecoms networks, hosting and cloud service providers, companies that carry out automated processing of their users' personal data when delivering services over telecoms networks, and vital digital infrastructure. That list captures most online businesses with a Tunisian operation. No general obligation to appoint a local representative was found for the privacy law. In practice a local vehicle is needed to be an approved cloud host, because both cloud labels are reserved to Tunisian hosting providers.

Sector by sector, as verified on 18 August 2026. GOVERNMENT: closed. The 2023 cybersecurity decree-law requires the bodies it covers to host government electronic systems and services with providers holding a national or governmental cloud label, and the ministerial order that sets the label conditions requires the provider to be Tunisian and to use primary and backup data centres located on Tunisian territory. VITAL DIGITAL INFRASTRUCTURE: closed. Those operators must run their own main hosting centre plus a backup at a labelled provider. CREDIT REPORTING: no cloud permitted, and records must be archived for five years. BANKING AND PAYMENTS: no residency rule found, but outsourcing is regulated and remote customer onboarding carries heavy conditions. TELECOMS, INSURANCE, SECURITIES, HEALTH, EDUCATION, GAMBLING, MAPPING: no storage-location rule found on the regulators' own sites, checked 18 August 2026, medium confidence - several Tunisian official sites, including the privacy authority's own site and the national legal database, were unreachable during this research.

The declaration and authorisation procedure sits in a government decree of 27 November 2007, which the central bank cites in its own rules. Secondary legal sources report that the authority has one month to decide, that transfers to countries that do not protect data are forbidden, and that a 2018 decision of the authority lists countries considered to offer sufficient protection. We could not open that decision on a Tunisian government site during this research, so treat the list as reported rather than verified. Consent of the person concerned is also required for a transfer, and transfers involving children are reported to need a family judge. Tunisia joined the Council of Europe's data protection convention in 2017, which is often cited as support for transfers, but that is a treaty obligation and not a substitute for the authorisation.

Evidence of the privacy authority working: the central bank's credit reporting rules of October 2022 cite its opinion number 22/03-333 of 15 August 2022; the crowdfunding rules of November 2023 cite its opinion of 31 August 2023; and the February 2025 remote onboarding rules require banks to produce its certificates for personal and biometric data. Evidence of the cybersecurity agency working: it publishes and versions a list of labelled cloud providers, with entries showing labels renewed, applications pending and two labels not renewed in November 2025. Its statutory fines run from 50,000 to 100,000 Tunisian dinars, roughly 16,000 to 32,000 United States dollars. The communications minister can also order an organisation's systems to be temporarily cut off on a reasoned report from the agency. We found no public register of privacy fines or privacy court decisions.

Verified floors: ten years for data exchanged through the single electronic cheque platform, under central bank rules of 31 January 2025; five years of compulsory archiving for credit reporting licence applicants under central bank rules of 25 October 2022; at least five years for crowdfunding platforms under central bank rules of 2 November 2023. General company and tax record-keeping periods are widely reported as ten years but we could not verify them on a Tunisian government site during this research, so they are listed as unconfirmed. Where a keep-it rule and a delete-it rule collide, the sector rule is the one a Tunisian regulator will inspect, and the privacy law expressly allows keeping data where another law requires it.

The 2023 cybersecurity decree-law requires immediate notification to the national contact point for cyber emergencies or to a public, sector or private emergency response centre, and compliance with the urgent measures those bodies set. The same law gives a 30-day window to remove failings after a warning, backed by a power to isolate the systems and networks concerned by ministerial decision on a reasoned report. Covered organisations must also either create their own cyber emergency response centre or join one. Failure to obey urgent measures, to fix within the deadline or to have an emergency response centre is one of the grounds for both downgrading and fines. We found no general duty in the 2004 privacy law to report a personal data breach to the privacy authority or to affected people, checked 18 August 2026, medium confidence.

On the first trap: the cybersecurity agency's list of labelled providers, version 5.2 of 23 July 2026, contains only national cloud labels and no governmental cloud label, and several national labels were pending renewal. On the third: the audit duty covers any company doing automated processing of its users' personal data while delivering services over telecoms networks, must be done at least once every twelve months, and only auditors certified by the agency may do it. On the fourth: the report goes to the agency within ten days and all its security recommendations must be implemented; partial implementation within a year is itself a ground for a fine of 50,000 to 100,000 dinars for unclassified organisations. Two more to watch: credit reporting firms are flatly banned from cloud hosting, and banks using an outside firm for remote sign-up must impose contract terms that go well beyond a normal supplier agreement, including a ban on that firm subcontracting and a right for the central bank to inspect the firm's own premises.

The 1 January 2027 requirement appears in version 4.3 of the cybersecurity agency's labelled provider list, dated 8 July 2026, and is carried in the current version 5.2 of 23 July 2026. Dormant switches, in rough order of how fast they could change the picture: the decree fixing the list of vital digital infrastructure operators, which pulls named organisations into the in-country hosting and backup duty; the ministerial order setting the classification procedure, since being left unclassified is what exposes an organisation to the 50,000 to 100,000 dinar fines; the ministerial order on technical audit criteria; and the privacy authority's power to revise which countries it treats as offering sufficient protection. A modernised, Europe-style privacy bill has been reported as pending since 2018; we found no evidence it has been adopted, and it must not be treated as binding.