Tunisia

The cybersecurity decree-law of 11 March 2023 lists, in its Article 6, the bodies that must be audited regularly. Public bodies. Public telecoms network operators, and telecoms and internet service providers. Companies whose computer networks are linked through telecoms networks. Hosting and cloud service providers. Companies that automatically handle their users' personal data when delivering services over telecoms networks. And vital digital infrastructure. That list captures most online businesses with a Tunisian operation. We found no general duty under the privacy law to appoint a local representative. You do need a Tunisian company to become an approved cloud host, because both cloud labels are reserved to Tunisian hosting providers.

Industry by industry, as verified on 18 August 2026. GOVERNMENT: closed. The 2023 cybersecurity decree-law makes the bodies it covers host government electronic systems and services with an approved provider. That provider must hold a national or governmental cloud label. The ministerial order that sets the label conditions requires the provider to be Tunisian. It also requires the main and backup data centres to be on Tunisian territory. VITAL DIGITAL INFRASTRUCTURE: closed. Those operators must run their own main hosting centre plus a backup at a labelled provider. CREDIT REPORTING: no cloud allowed. Records must be archived for five years. BANKING AND PAYMENTS: we found no rule about where data must be stored. But outsourcing is regulated, and remote customer sign-up carries heavy conditions. TELECOMS, INSURANCE, SECURITIES, HEALTH, EDUCATION, GAMBLING, MAPPING: we found no storage-location rule on the regulators' own sites, checked 18 August 2026. Confidence is medium. Several Tunisian official sites were unreachable, including the privacy authority's own site and the national legal database.

The declaration and permission procedure sits in a government decree of 27 November 2007. The central bank cites that decree in its own rules. Professional sources report three things. The authority has one month to decide. Transfers to countries that do not protect data are forbidden. And a 2018 decision of the authority lists countries considered to offer sufficient protection. We could not open that decision on a Tunisian government site, so treat the list as reported rather than verified. The person concerned must also consent to a transfer. Transfers involving children are reported to need a family judge. Tunisia joined the Council of Europe's data protection convention in 2017. That is often cited as support for transfers. But it is a treaty duty, and it does not replace the permission you need.

Evidence that the privacy authority works. The central bank's credit reporting rules of October 2022 cite its opinion number 22/03-333 of 15 August 2022. The crowdfunding rules of November 2023 cite its opinion of 31 August 2023. And the February 2025 remote sign-up rules make banks produce its certificates for personal and biometric data. Evidence that the cybersecurity agency works. It publishes and versions a list of labelled cloud providers. Entries show labels renewed, applications pending, and two labels not renewed in November 2025. Its fines under the law run from 50,000 to 100,000 Tunisian dinars, roughly 16,000 to 32,000 United States dollars. The communications minister can also order an organisation's systems cut off temporarily, on a reasoned report from the agency. We found no public register of privacy fines or privacy court decisions.

Verified minimums. Ten years for data exchanged through the single electronic cheque platform, under central bank rules of 31 January 2025. Five years of compulsory archiving for credit reporting licence applicants, under central bank rules of 25 October 2022. At least five years for crowdfunding platforms, under central bank rules of 2 November 2023. General company and tax record-keeping periods are widely reported as ten years. We could not verify them on a Tunisian government site, so they are listed as unconfirmed. Where a keep-it rule and a delete-it rule collide, the industry rule is the one a Tunisian regulator will inspect. And the privacy law expressly allows keeping data where another law requires it.

The 2023 cybersecurity decree-law requires immediate notice to the national contact point for cyber emergencies. You may instead tell a public, sector or private emergency response centre. You must then follow the urgent measures those bodies set. The same law gives you a 30-day window to fix failings after a warning. Behind that sits a power to isolate the systems and networks concerned. That is done by ministerial decision on a reasoned report. Covered organisations must also either set up their own cyber emergency response centre or join one. Three things are grounds for both a downgrade and a fine. Failing to obey urgent measures. Failing to fix problems within the deadline. And having no emergency response centre. We found no general duty in the 2004 privacy law to report a personal data breach. That is true both for telling the privacy authority and for telling the people affected. Checked 18 August 2026, medium confidence.

On the first trap. The cybersecurity agency's list of labelled providers, version 5.2 of 23 July 2026, contains only national cloud labels. There is no governmental cloud label on it, and several national labels were pending renewal. On the third trap. The audit duty covers any company that automatically handles its users' personal data while delivering services over telecoms networks. The audit must happen at least once every twelve months. Only auditors certified by the agency may do it. On the fourth trap. The report goes to the agency within ten days, and all its security recommendations must be carried out. Doing only part of them within a year is itself a ground for a fine. That fine is 50,000 to 100,000 dinars for unclassified organisations. Two more to watch. Credit reporting firms are flatly banned from cloud hosting. And banks using an outside firm for remote sign-up must impose contract terms well beyond a normal supplier agreement. Those include a ban on that firm subcontracting, and a right for the central bank to inspect the firm's own premises.

The 1 January 2027 requirement appears in version 4.3 of the cybersecurity agency's labelled provider list, dated 8 July 2026. It is carried into the current version 5.2 of 23 July 2026. Powers already held, roughly in order of how fast they could change things. First, the decree fixing the list of vital digital infrastructure operators. That pulls named organisations into the Tunisian hosting and backup duty. Second, the ministerial order setting the classification procedure. Being left unclassified is what exposes an organisation to the 50,000 to 100,000 dinar fines. Third, the ministerial order on technical audit criteria. Fourth, the privacy authority's power to change which countries it treats as offering sufficient protection. A modernised, Europe-style privacy bill has been reported as pending since 2018. We found no evidence it has been adopted. Do not treat it as binding.