🇹🇳Organic Law No. 2004-63 on Personal Data Protection
Organic Law No. 2004-63 on Personal Data Protection
The official bilingual collection contains the Organic Law and implementing texts used for this operational summary.
Core operational duties
Declarations and authorisations: Articles 7-8 require a declaration for each processing purpose. Sensitive processing, video surveillance and transfers abroad can require prior INPDP authorisation under the Law and Decree No. 2007-3004.
Principles, notice and consent: Articles 9-14 and 27-31 govern legitimate purposes, proportionality, data accuracy, special categories, information and consent.
Rights and lifecycle: Articles 32-47 establish access, rectification and objection rights and rules for collection, retention, updating and deletion.
Security and transfers: Articles 18-23 require confidentiality and security controls; Articles 50-52 control communication or transfer abroad.
Use the INPDP's prescribed declaration or authorisation route for each purpose and retain the filing, decision and supporting safeguards as compliance evidence.