Data Protection in Tunisia: What Fintechs Must Know

Data protection in Tunisia still rests on a law passed in 2004, before smartphones, cloud hosting or facial-recognition onboarding. For fintechs, that creates a strange situation: strict rules on paper, an oversight authority that has barely functioned in recent years, and a 132-article reform bill under study in parliament since 2025. Here is what applies today and what may change.

The 2004 law still governs

Tunisia's core text is Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data. Two decrees of 27 November 2007 complete it: No. 2007-3003 on how the national authority works, and No. 2007-3004 on how to declare processing or obtain authorisation. The constitution also protects personal data, and Tunisia ratified the Council of Europe's Convention 108 in 2017.

The supervisor is the Instance nationale de protection des données à caractère personnel (INPDP). Under the 2004 model, most processing must be declared to it in advance, and some processing needs its prior authorisation.

Key obligations for a fintech today

The law was not written for digital finance, but several of its rules hit fintech business models directly.

Prior declaration

Processing personal data without a prior declaration is an offence. According to a 2024 practical guide by the law firm Boussayen Knani & Associés, the INPDP referred about thirty cases to the public prosecutor in July 2023 for undeclared processing.

Transfers abroad

This is the rule most relevant to startups that host data on foreign cloud services or share it with foreign partners:

• Any transfer of personal data abroad requires INPDP authorisation (Article 52). The authority has one month to decide.
• Transfers are allowed only to countries offering an adequate level of protection (Article 51).
• Transfers that may harm Tunisia's public security or vital interests are prohibited (Article 50).
• An unauthorised transfer can bring one year in prison and a TND 5,000 fine (Article 90).

Consent and third parties

Personal data cannot be passed to third parties without the person's express written consent (Article 47), and confidentiality obligations continue after processing ends.

Sector rules add their own requirements

Financial regulators now reference data protection directly. To be approved, an equity crowdfunding platform needs an authorisation from the data protection authority. The BCT's September 2026 circular for payment institutions requires explicit consent to data processing when customers are onboarded remotely (see our guide to e-KYC and AML rules).

An authority that has stopped working

The weak point is enforcement. At a February 2026 parliamentary hearing reported by Webdo, citing the TAP news agency, the Ministry of Health said the data protection authority had not been operating since 2024, which it warned could delay research projects that need its authorisation. Sponsors of the reform bill describe the current INPDP as having no effective role, leaving an institutional gap.

For fintechs, this creates a practical problem: some obligations, such as authorisation for transfers abroad, depend on an authority that may not be able to process requests. Founders should document their filings and keep evidence of good faith.

The reform bill: what it proposes

In July 2025, a group of 17 MPs filed a draft organic law on personal data protection. The text has 132 articles in six chapters and would replace the 2004 law entirely. According to reports by APA, allAfrica and Tunisie Numérique, it would:

• create a new independent authority with legal personality and financial autonomy, whose members are appointed for a single five-year term;
• raise financial penalties for serious violations to as much as TND 200,000, in addition to possible prison terms;
• require a data protection officer (in public bodies, according to APA);
• introduce impact assessments for high-risk processing and a right not to be subject to decisions based solely on automated processing;
• add four articles on artificial intelligence, pending a separate law;
• rewrite the rules on transfers abroad, set a framework for health data, and end prior authorisation for most surveillance cameras.

The sponsors say the text aligns with international standards, including the EU's data protection rules.

Where the bill stands

The parliamentary Committee on Rights and Freedoms held hearings in February 2026, including with the bill's sponsors and the Ministry of Health. On 20 May 2026, the committee discussed widening the list of experts and associations to be heard. We found no report of a committee or plenary vote as of October 2026, so the final text may differ from the draft.

What fintech founders should do now

Waiting for the new law is not a strategy. The safest course is to comply with the 2004 law and prepare for a GDPR-style regime:

• Map your data: what you collect, why, where it is stored, and who you share it with.
• File declarations with the INPDP and keep proof of submission.
• Check cloud hosting: if data leaves Tunisia, you need an authorisation under the current law.
• Treat biometrics and credit scoring as high risk: document the logic of automated decisions and offer human review. This matters for AI in banking and lending.
• Secure systems: data protection and cybersecurity obligations increasingly overlap in BCT rules.

Partners and investors from Europe will expect GDPR-like practices anyway, and doing the work now will make the transition easier once the reform is adopted.