My company works in Tunisia. What does the law ask of us when an AI agent reads our data?

The law that applies

Organic Law 63 of 27 July 2004 on the protection of personal data is the law in force. It says that everyone has the right to the protection of personal data relating to their private life. It created the National Authority for the Protection of Personal Data, the INPDP, which receives declarations and grants authorisations.

Tunisia joined the Council of Europe’s Convention 108 on data protection, with its additional protocol on supervisory authorities and transfers abroad. Both have been in force for Tunisia since 1 November 2017. Tunisia signed the protocol that modernises the convention, known as Convention 108+, on 24 May 2019. The Council of Europe’s treaty list shows no ratification by Tunisia as of October 2026.

A new law is before parliament

A proposal for a new organic law on personal data protection is before the Assembly of the Representatives of the People. Its Committee on Rights and Freedoms examined it in February 2026 and decided to hold further hearings on it. The committee’s minutes of 18 February 2026 also note that the INPDP currently has no members. I found no vote on the bill as of October 2026. Until a new law is passed, the 2004 law applies.

Can the agent read personal data at all?

Yes, if you meet the law’s conditions. Three rules come first:

• Declare before you start. Every processing of personal data must be declared to the INPDP in advance. If the INPDP does not object within one month, the declaration counts as accepted.
• Express and written consent. The default rule is that processing needs the person’s express and written consent. The law allows processing without consent only in a few cases: where the processing is clearly in the person’s interest and they cannot be contacted, where getting consent would need disproportionate effort, or where a law or a contract with the person provides for it.
• Sensitive data needs an authorisation. Processing data on racial or genetic origin, religious beliefs, political, philosophical or union opinions, or health is prohibited, with listed exceptions. Apart from health data, such processing also needs the INPDP’s authorisation. If the INPDP does not reply within 30 days, the request counts as refused.

The law does not contain a rule on decisions made only by automated processing.

The model provider, and data sent abroad

When the agent sends text to a model run by a provider, the provider processes the data on your behalf. The law calls it a subcontractor. You must choose it carefully. It must act only within the limits you set and have the technical means to do the work. The law sets three conditions for anyone who processes personal data, their legal representative and their agents: Tunisian nationality, residence in Tunisia, and no criminal record. The law says these conditions also apply to the subcontractor and its agents. You must also take all necessary precautions to keep the data secure.

Sending personal data abroad is strictly limited:

• It is prohibited where it could harm public security or Tunisia’s vital interests.
• It is allowed only if the destination country ensures an adequate level of protection.
• It always needs the INPDP’s prior authorisation. The INPDP must decide within one month of the request.

When something goes wrong

The law does not require you to notify the INPDP or the affected people of a data breach. The penalties are criminal:

• Transferring personal data abroad without the INPDP’s authorisation, or intentionally processing without the required declaration or authorisation, can bring 1 year in prison and a fine of 5,000 dinars.
• A transfer abroad that could harm public security or Tunisia’s vital interests can bring 2 to 5 years in prison and a fine of 5,000 to 50,000 dinars.
• Where the offender is a company, the penalties apply personally to its legal or actual manager whose responsibility for the acts is established.

What Tunisia says about AI itself

On 15 August 2026 the Minister of Communication Technologies presented the main lines of a national AI strategy for 2026 to 2030 at a ministerial council held by the Presidency of the Government. The government says the strategy is meant to guide AI in a way that respects private life and national sovereignty. I found no published text of the strategy, and no Tunisian law that regulates AI as such, as of October 2026.

What this means for you

• Declare the agent’s processing to the INPDP before the agent touches personal data.
• Keep written proof of consent, or record which exception in the law you rely on.
• If your model provider processes data outside Tunisia, ask for the INPDP’s authorisation before any personal data leaves the country.
• Check whether your provider can meet the law’s conditions for subcontractors, and take legal advice where it cannot.

I am not a lawyer. This page summarizes the official texts as I read them in October 2026. Ask a lawyer about your own case.

References

1. National Institute of Statistics, Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data (French)
2. Council of Europe Treaty Office, Chart of signatures and ratifications of Convention 108
3. Council of Europe, Welcome Tunisia: new party to Convention 108, July 2017
4. Council of Europe Treaty Office, Chart of signatures and ratifications of the protocol amending Convention 108
5. Assembly of the Representatives of the People, Committee on Rights and Freedoms, minutes of 17 February 2026
6. Assembly of the Representatives of the People, Committee on Rights and Freedoms, minutes of 18 February 2026
7. Presidency of the Government, Ministerial council on digital transformation, 15 August 2026

Hesham Elmahdy, Published 28 October 2026