The framework
Tunisia's framework rests on the Organic Law 2004-63 on Personal Data Protection, with the INPDP as the supervisory authority.
That puts Tunisia in the global opt-in majority, where permission comes before processing and marketing waits for consent.
Key instruments
Organic Law 2004-63 on Personal Data Protection
One of Africa's earliest laws (2004) with an active authority, the INPDP, but an aging framework; the long-pending GDPR-style replacement would modernize consent, rights and transfers.
Marketing and advertising
Consent-first with authorization and declaration duties; a GDPR-aligned replacement bill has been pending for years. That single sentence decides most channel plans here.
Cross-border transfers
Transfers abroad require authorization from the INPDP. Whatever the local mechanism, EU-origin data carries the GDPR's transfer chapter with it into this market.
Enforcement and penalties
The law provides for fines and criminal penalties. Read the ceiling together with the authority's track record, which prices the risk.