The National Authority for the Protection of Personal Data is responsible for ensuring compliance with the legal framework on personal data. However, there is limited publicly available information regarding the application of sanctions for personal data violations.

In addition to Law No. 2004-63 of 27 July 2004, which formally established the right to personal data protection in Tunisia, enforcement in the digital sphere has recently been reinforced by Decree-Law No. 2022-54 of 13 September 2022, which addresses offenses related to information and communication systems. Article 24 criminalizes the use of communication networks to spread false information, rumors, or falsified documents if such dissemination is likely to harm others, damage their reputation, incite violence, or threaten public security or national defense. It also prohibits the dissemination of personal data for purposes of defamation or causing harm. Penalties can reach up to five years of imprisonment and a fine of 50,000 dinars, doubled when the victim is a public official.

While this decree strengthens measures against cybercrime and digital misuse, it grants public authorities very broad powers of investigation and surveillance, which can potentially conflict with the principles of personal data protection. Article 6 obliges telecommunications providers to retain connection data – including identification, traffic, and geolocation information – for a minimum of two years. Articles 8 to 13 allow authorities, with judicial approval, to seize or copy IT systems, demand access to stored or in-transit data, and intercept communications in real time. The combination of vague offense definitions and expansive surveillance powers has raised concerns that enforcement may prioritize state security over individual privacy, departing from the original spirit of Law No. 2004-63.

Jurisprudence further illustrates how these laws are applied in practice. In September 2018, the Tunis First Instance Court held a data controller liable for installing a video surveillance system without authorization from the National Authority for the Protection of Personal Data. More recently, under the framework of Decree-Law 54, in December 2023 the Jendouba Court sentenced Sofiane Zneidi to eight months in prison for spreading false news on Facebook, highlighting the law’s use in criminalizing online speech, including against political opponents.