AI Regulation Tracker  /  Draft legislation

Tunisia's Data Protection Bill Would Put AI in Statute for the First Time

This is a signal, not a rule. Proposal for an Organic Law No. 095/2025 is a deputies' initiative that has been before the Committee on Rights and Freedoms since July 2025 and has now had eight sessions. Nothing in it binds anyone yet. Organic Law No. 2004-63 remains the law in force.

By Anthony Guerriero  ·  Reviewed by Anthony Guerriero  ·  Published August 3, 2026  ·  Updated August 3, 2026  ·  Draft legislation

Key facts

Regulatory briefing

Instrument

Proposal for an Organic Law No. 095/2025 on the Protection of Personal Data, a 132-article text in 6 chapters

Authority

Assemblee des Representants du Peuple, Committee on Rights and Freedoms, chaired by Thabet El Abed, rapporteur Hala Jaballah; initiative of 17 deputies of the Al-Ahrar bloc

Jurisdiction

Tunisia

Status

Pending in committee, first reading. Tabled July 14, 2025, referred July 16, 2025. Eight committee sessions between February 17 and June 3, 2026. Not enacted

Bindingness

Draft. It imposes no obligation on anyone in its current form

Effective date

None. Organic Law No. 2004-63 of 2004 remains the statute in force

Primary source

ARP committee readout, February 17, 2026

Start with what this is not

Tunisia has not passed an AI law. It has not passed a new data protection law either. What exists is a proposal, filed by deputies rather than by the government, that has been sitting with a parliamentary committee since July 2025 and that the committee began reading properly in February 2026.

I lead with that because the reporting around bills of this kind tends to collapse the distinction between a text being debated and a text being law, and the collapse always runs in the same direction. A committee readout gets summarised as a country regulating AI, and six months later someone on a compliance team is trying to work out which article they breached. There is no article. The ARP's own bill record, checked again on August 3, 2026, still places Proposal No. 095/2025 in the category of bills and proposals before committees. That is the first stage of a process that ends, if it ends at all, with a plenary vote that has not happened.

The instrument type is worth noting too. The text is a proposal for an organic law, the same instrument class as the statute it would sit alongside: Tunisia's operative data protection law is Organic Law No. 2004-63 of July 27, 2004. I am not going to characterise Tunisian constitutional procedure beyond what the parliamentary record shows, and the record here shows one thing plainly. This proposal was tabled on July 14, 2025 and referred to the Committee on Rights and Freedoms on July 16, 2025, and the first substantive committee hearing on it came on February 17, 2026. Seven months passed between referral and the opening hearing. Whatever the reason, that is the tempo you should be forecasting against, not the tempo of the eight sessions that followed.

It is also not a government bill. The ARP record lists the initiative as coming from a group of deputies, seventeen of them, all from the Al-Ahrar bloc, with Saber Mesmoudi listed first. The record assigns him no lead-sponsor title and I am not going to invent one. The practical point is that a private members' text without declared executive backing has a different survival curve than a ministry draft, and anyone forecasting timing should weight it accordingly.

What the committee chair said is in it

The most useful document in this file is the ARP's own readout of the February 17, 2026 session, a full-day hearing of the sponsors' representatives. The committee chair, Thabet El Abed, set out what he understood the text to contain. The ARP published it as follows, in this tracker's English rendering of the Arabic original:

The Committee on Rights and Freedoms held a full-day session on Tuesday 17 February 2026 devoted to hearing representatives of the legislative initiative on the proposal for an organic law on the protection of personal data ... He highlighted the law's important role in protecting privacy and personal data, particularly given the expanding influence of algorithms, surveillance technologies and artificial intelligence systems on administrative and economic decision-making. He noted that the proposal contains advanced elements to the sponsors' credit, among them regulation of the use of artificial intelligence, enshrinement of the right not to be subject to a solely automated decision, provision for impact assessment of high-risk processing, regulation of health data processing, and a framework for video surveillance.Assemblee des Representants du Peuple, Committee on Rights and Freedoms news item, February 17, 2026, translated from the Arabic

Read that carefully, because it is a description of a draft by the person chairing its examination, not a summary of enacted text. It tells you the shape the sponsors were aiming at. It does not tell you what survives markup.

Four of the five named elements will look familiar to anyone who has done GDPR work: a right not to be subject to a solely automated decision, impact assessments for high-risk processing, health data rules, and a video surveillance framework. The fifth, regulation of the use of artificial intelligence, is the one that puts this on an AI tracker at all. If the bill passes with that content intact, it would be the first time AI appears in Tunisian statute.

The same readout records the chair pushing back on the design. He questioned the bill's reliance on a broad prior-authorisation regime as against a risk-based accountability model, and raised digital sovereignty and cross-border transfer trade-offs. That is a substantive architectural argument, not a drafting quibble. Prior authorisation means a regulator says yes before you process; accountability means you decide, document and answer for it afterwards. Those two models produce completely different operating costs for a foreign firm, and the committee has not settled which one it wants.

Beyond the chair's list, a set of companion features has circulated in Tunisian media on the strength of sponsor statements: a data protection officer function, expanded sensitive-data categories covering health, genetic and biometric data, a breach notification deadline, a structured transfer regime, an internal sanctioning chamber with administrative fines, and lighter formalities for CCTV. I am flagging those as reported, not verified. The bill PDF on the ARP site could not be reliably text-extracted, so no article of the text has been read here verbatim, and I will not repeat a specific deadline or fine figure that came from an interview rather than the instrument.

The supervisor gap sitting underneath all of this

The most revealing moment in the committee record is not about AI at all. In the February 24, 2026 session, a representative of the Ministry of Health told the committee that research projects requiring authorisation from the INPDP, Tunisia's national personal data protection authority, are sometimes delayed, in the readout's words, given the absence of the authority since 2024.

That is a ministry official's statement recorded in a parliamentary readout, not a declaration by the authority itself, and I would not stretch it further than it goes. But it explains a great deal about why a prior-authorisation model is being challenged in the room. A regime built on a regulator granting permissions only functions if the regulator is functioning. When a health ministry tells parliament that research is stalled waiting on authorisations, the argument for accountability-based supervision stops being theoretical.

For a foreign operator this is the detail worth carrying forward. Whatever the final text says about AI, the thing that will determine your day-to-day experience in Tunisia is whether the supervisory function is staffed and answering. A bill can create a duty in an afternoon. Building an authority that can process a request takes years, and Tunisia would be starting that work from a position the ministry itself described as an absence.

On the AI supervision question specifically, I can tell you what was not found rather than what does not exist. No instrument designating a Tunisian AI authority was identified in the national sources reviewed as of August 3, 2026, and no adopting instrument for a national AI strategy was located either. Those are statements about the search, not proofs of a negative.

Why a US company should be reading this now

The population this bill would reach is not confined to Tunisian companies. It runs to US and European firms using Tunisia as an offshoring or BPO location, an IT outsourcing location, a clinical research location or a shared services location, and to the hospitals, laboratories and genomics researchers those firms work with. If your organisation has a delivery centre, a vendor or a research site there, personal data of your customers, your patients or your own employees is being processed in Tunisia today under a 2004 statute.

That is the exposure the bill would change. The people most affected by a new Tunisian framework are not only Tunisian companies; they are the foreign principals whose processing happens on Tunisian soil through a subsidiary or a supplier. If a right not to be subject to a solely automated decision and an impact assessment duty for high-risk processing make it into the final text, your Tunisian operations would need the same artefacts your European ones already produce.

Two categories deserve particular attention. The first is health and genomics. The chair named health data processing as one of the areas the bill addresses, and the February 24 session had a health ministry representative in the room discussing research authorisations. Sponsors of clinical research with Tunisian sites should assume this file is moving toward them. The second is surveillance and biometrics. A video surveillance framework and expanded biometric categories were both raised. If you operate cameras, access control or facial recognition at a Tunisian facility, that is a live design question, not a footnote.

What I would not do is start drafting Tunisia-specific policies against a text nobody can read in final form. There is a real cost to compliance work done against a moving draft, and it is usually paid twice.

What to actually do between now and a vote

Three things, in order of how much they cost.

First, find out whether you are in scope at all. Most organisations discover their Tunisian footprint is larger than the org chart suggests, because it arrives through vendors rather than through entities. Map which processing activities touch personal data of individuals in Tunisia, including data your BPO partner handles on your behalf. That inventory is useful whether or not this bill passes, since Organic Law No. 2004-63 already applies.

Second, check whether the controls you already own would satisfy the duties the chair described. If you maintain records of automated decision-making and run impact assessments for higher-risk processing because of European obligations, you have most of the substance. The sensible move is extending the existing artefact to cover Tunisian processing rather than commissioning a parallel programme. That costs a mapping exercise, not a project.

Third, watch the right page. The bill's legislative track on the ARP site lists every committee session, and it is the only place I would trust for stage changes. The signals that would move this from a signal to a duty are a completed article-by-article reading, a committee report, and a plenary vote. Until the stage field on that record changes, nothing has happened that you owe a response to.

One last note on timing discipline. The committee last met on this bill on June 3, 2026, and the eight sessions between February and June show sustained attention rather than a single hearing. Sustained attention is a genuine indicator. It is still not a law, and organic laws in particular have a habit of taking longer than their first reading suggests.

Last verified: August 3, 2026 against the primary sources listed above.