Tunisia Organic Law No. 2004-63 on Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
| Short name | TN PDPL |
| Region | Middle East & Africa |
| Country or scope | Tunisia |
| Sector | Privacy |
| In your workspace | Off until you switch it on in Compliance › Manage. |
How Safeguard covers TN PDPL
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
TN-PDPL-18 Security Precautions for Processing | The controller and its agents must take all necessary precautions to preserve the security of personal data and prevent third parties from modifying or damaging it, implying integrity controls over the processing environment (Organic Act 2004-63, Arts. 18-19) | Scan |
TN-PDPL-19 Integrity During Communication and Transport | Precautions must prevent data from being read, copied, modified, erased or deleted during communication or transport, which requires verifiable integrity (hashes) for the software components that handle the data (Organic Act 2004-63, Art. 19) | Scan |
TN-PDPL-23 Confidentiality Including Agents and Subcontractors | The controller, any processor and their agents must guarantee data confidentiality even after processing ends, requiring the third parties and suppliers involved in processing systems to be identified (Organic Act 2004-63, Art. 23) | Scan |
TN-PDPL-DECL Prior Declaration to the INPDP | Processing operations require prior declaration to, or authorization from, the INPDP, which presupposes an inventory of the systems and software components that carry out the processing (Organic Act 2004-63, prior-declaration regime) | Scan |
TN-PDPL-DOC Documented and Auditable Processing | INPDP oversight and the declaration regime require dated, identifiable documentation of processing systems, satisfied by an SBOM bearing a document ID and creation timestamp (Organic Act 2004-63, accountability to the INPDP) | Scan |
Policy templates
All 22 from the standard set, adapted to TN PDPL.
Togo Law No. 2019-014 on Protection of Personal Data
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.
Turkey KVKK
Turkey Personal Data Protection Law - VERBIS registration, lawful processing, data subject rights.