Personal data on your website: complying with Tunisian law and the GDPR

Website data protection in Tunisia starts with Organic Law No. 2004-63, which applies to any site or app that collects names, email addresses or browsing data, under the supervision of the INPDP. If you target people in the European Union or monitor their behaviour online, the GDPR also applies. In practice: INPDP filings, lean forms, an honest cookie banner and solid security.

Which rules apply to a website in Tunisia?

Organic Law No. 2004-63 of 27 July 2004 protects any information that can identify a person. The INPDP, Tunisia’s data protection authority, receives declarations, grants authorisations and can prohibit processing.

Tunisia has been a party to Council of Europe Convention 108 since 1 November 2017 and signed its modernising protocol, Convention 108+, in 2019. A bill to replace the 2004 law is before a parliamentary committee; as far as we know, it has not yet been adopted. This article is general information, not legal advice.

When does the GDPR apply to a Tunisian company?

Under Article 3(2) of the GDPR, the regulation also covers companies outside the EU in two cases:

• Offering goods or services: being accessible from Europe is not enough, but prices in euros, delivery to the EU or campaigns aimed at a European country are indicators.
• Monitoring behaviour: behavioural advertising, cookie tracking or profiling of visitors in the EU.

The company must then appoint an EU representative (Article 27), unless the processing is occasional, low-risk and excludes large-scale sensitive data. Processing data for a European client? They will have you sign a contract (Article 28) and safeguard the transfer, usually with standard contractual clauses, as Tunisia has no EU adequacy decision.

Tunisian law vs GDPR: what are the differences?

Where both apply, follow the stricter rule on each point.

Obligation	Law 2004-63	GDPR
Formalities	Declaration to the INPDP (Art. 7); authorisation for certain sensitive data, CCTV and transfers	No declaration; record of processing, depending on the case
Legal basis	Express written consent, with exceptions (Arts. 27 and 29)	Six bases, including contract and legitimate interests (Art. 6)
Rights	Access, rectification, objection (Arts. 32 and 42)	Access, rectification, erasure, portability, objection (Arts. 15 to 22)
Data breaches	No notification procedure; security obligation (Arts. 18 and 19)	Notify the authority within 72 hours where feasible, if there is a risk (Art. 33)
Transfers	INPDP authorisation (Art. 52)	Adequacy decision or safeguards such as standard clauses (Art. 46)
Penalties	Criminal, e.g. one year’s imprisonment and a 5,000 dinar fine for undeclared processing (Art. 90)	Up to €20 million or 4% of worldwide annual turnover, whichever is higher (Art. 83)

What data does your website actually collect?

List every collection point (forms, newsletter, analytics, CRM, chat, customer area) with its purpose, legal basis and retention period, and drop unnecessary fields. For marketing, Tunisian law requires express, specific consent (Article 30): an unticked box and stored proof. All of this feeds your privacy policy.

Cookie banners: which rules apply?

The 2004 law does not mention cookies. For European visitors, the reference is the ePrivacy Directive, and France’s CNIL states that rejecting cookies should be just as easy as accepting them.

• Prior consent: no non-essential cookies before the visitor chooses.
• Equal choice: Accept all and Reject all buttons at the same level and in the same format.
• Exemptions: shopping basket, authentication, some analytics tools.
• Duration and withdrawal: keeping the choice for six months is good practice; withdrawing consent must be as easy as giving it.

An EU reform, the Digital Omnibus, is under negotiation; the current rules still apply. Above all, check that your banner actually blocks scripts.

Security, providers and transfers: what should you plan for?

Tunisian law requires you to prevent unauthorised access, trace access and keep secure backups (Articles 18 and 19): HTTPS, two-factor authentication, updates, tested backups. Hosting, email, CRM or chat providers must be chosen carefully (Article 20) and bound by a processing agreement, required by the GDPR (Article 28). Any transfer abroad requires INPDP authorisation (Article 52), so hosting or an online tool outside Tunisia falls, in principle, under this rule.

Your compliance checklist

1. Map your data and the tools that receive it.
2. Set a purpose, legal basis and retention period.
3. Trim your forms and publish a privacy policy.
4. Declare your processing to the INPDP.
5. Block non-essential trackers until consent.
6. Secure the site and sign provider contracts.
7. Safeguard transfers outside Tunisia and the EU.
8. Plan for rights requests and data breaches.

FAQ

Does a brochure website without forms need to comply?

Often, yes: analytics, advertising cookies, embedded videos and server logs process data such as IP addresses. The leaner the site, the simpler compliance becomes.

Do you need to declare your website to the INPDP?

Yes, if it processes personal data: a prior declaration is required (Article 7), deemed accepted if the INPDP does not object within one month. Transfers abroad and certain sensitive data also need an authorisation.

Do you need a cookie banner if your site only targets Tunisia?

The 2004 law does not mention cookies, but it makes consent the general rule. For European visitors, a banner that meets EU rules remains the safest option.

What should you do after a data breach?

Contain the incident and document it. If the GDPR applies, notify the supervisory authority within 72 hours where feasible, and those affected if the risk is high. Tunisian law sets no notification procedure, but warning those affected often limits the harm.

Build a compliant website with Uteek

At Uteek, a digital agency based in Les Berges du Lac 2, Tunis, we build these requirements into your websites and apps from the design stage: consent banner, lean forms, HTTPS, access management and backups. Explore our web development services or tell us about your project.