Tunisia: technology regulation at a glance

Framework: Central Bank of Tunisia (BCT) January 2018 directive prohibiting unauthorized virtual-currency activities; Exchange Control Act (Law No. 76-18 of 21 January 1976, as amended); draft new Foreign Exchange Code in final parliamentary passage (expected Q1 2026)

Tunisia maintains an active state-level prohibition on cryptocurrency activities under the BCT's 2018 directive, making public trading, payments, exchange services, and mining illegal and subject to up to five years' imprisonment. A new Foreign Exchange Code in final parliamentary passage (expected Q1 2026) would, for the first time, legally recognize crypto-assets and require their declaration under BCT-defined rules, while a separate draft VASP licensing bill remains under parliamentary committee review with no enactment date confirmed.

Framework: National AI Strategy and Roadmap (2021-2025); Organic Law No. 2004-63 on Personal Data Protection administered by INPDP; draft Organic Law on Personal Data Protection (2025, under parliamentary review)

Tunisia has no dedicated AI law in force. Its primary AI governance instrument is a non-binding national AI strategy and roadmap (2021-2025) that sets objectives for infrastructure, skills, and ethics, aligned with OECD AI Principles and the UNESCO Recommendation on the Ethics of AI. Data-related AI governance falls under the 2004 personal data protection law (Law 2004-63) supervised by the INPDP, while a draft organic law to modernise that framework, introducing automated decision-making rules, profiling rights, and DPIAs, was approved by the Ministerial Council and was before parliament as of early 2026.

Framework: Organic Law No. 2004-63 of 27 July 2004 on the Protection of Personal Data; supervised by the Instance Nationale de Protection des Données Personnelles (INPDP)

Tunisia enacted a comprehensive personal data protection law in 2004, making it one of the first countries in Africa and the Arab world to do so. The law is enforced by the independent INPDP and is anchored in constitutional protections (Article 24, 2022 Constitution). A 2025 organic bill to replace and modernize the 2004 law, aligning it with GDPR and Convention 108+, was under parliamentary committee review as of early 2026 and had not yet been enacted.

Framework: Law No. 2016-48 of 11 July 2016 on Banks and Financial Institutions (Art. 20 delegates payment institution rules to BCT circulars); BCT Circular 2018-16 governing payment institution activity and operations; BCT as sole licensing authority

Tunisia operates a functioning licensing regime for payment institutions and electronic money under the Banque Centrale de Tunisie (BCT), anchored in Law 2016-48 and BCT Circular 2018-16. The BCT actively grants approvals, including new definitive licences in early 2026, and maintains a formal Regulatory Sandbox (since January 2020) and a dedicated Fintech portal. Open banking and dedicated BNPL regulation remain absent, and the instant-payment infrastructure is still being modernised toward ISO 20022.

Framework: Loi n°68-7 du 8 mars 1968 fixant la condition des étrangers en Tunisie (Law on the Condition of Foreigners in Tunisia), administered by the Ministry of Interior; work authorisations governed by the Labour Code and Ministry of Employment regulations

Tunisia has no dedicated digital-nomad or remote-work visa. Nationals of many countries may enter and remain visa-free for up to 90 days, with an informal extension possible, and longer-term residence requires a Long-Stay Visa (Visa Long Séjour) plus a Carte de Séjour (residence permit). Remote workers serving only foreign clients occupy a legal grey zone: the work-permit regime is designed for local employment, and an independent-professional residence pathway exists in principle but is administratively burdensome without a Tunisian sponsor.

Framework: Decree-Law No. 2022-54 on Combating Crimes Related to Information and Communication Systems; Agence Tunisienne d'Internet (ATI) for state-level filtering; Organic Law No. 2004-63 on personal data (under reform)

Tunisia's online environment is governed primarily through a repressive cybercrime decree (Decree Law 54, 2022) that criminalises broadly defined online speech rather than through a platform-safety or content-moderation framework. The Agence Tunisienne d'Internet (ATI) conducts state-directed website blocking. Since President Kaïs Saïed's 2021 consolidation of power, the legal and technical apparatus has been used systematically to silence journalists, activists, and critics online, earning Tunisia a 'Partly Free' rating (score: 40/100) in Freedom House's Freedom on the Net 2025 report.

Framework: Law No. 2018-5 of 23 January 2018 on Cybersecurity, as expanded by Decree-Law No. 2023-17 of 11 March 2023, enforced by the Agence Nationale de la Cybersécurité (ANCS, formerly ANSI)

Tunisia operates a comprehensive cybersecurity regime anchored by Law 2018-5 and reinforced by Decree-Law 2023-17, which expanded the national cybersecurity agency's powers, mandated annual IT audits for data-processing entities, and introduced cloud-computing rules. The Agence Nationale de la Cybersécurité (ANCS) is the central authority overseeing compliance, certification, and incident response across public and private sectors. Organizations handling personal data via telecommunications networks face binding 72-hour breach-notification duties and periodic mandatory audit requirements.

Framework: Investment Law No. 2016-71 of 30 September 2016 (promulgating the Investment Code); Companies Code (Code des sociétés commerciales); RNE (Registre National des Entreprises) for company registration; APII (Agency for Promotion of Industry and Innovation) one-stop shop

Tunisia permits foreign investors to form companies through a structured, largely digitised process anchored by APII one-stop shops and the national RNE portal, with the core legal-procedural cycle achievable in roughly 48-96 hours after capital deposit. However, foreign equity is capped at 49% in most non-industrial onshore sectors, full foreign ownership in non-industrial activities requires classification as an 'offshore' entity (≥66% foreign equity and ≥70% of output exported), and several sectors (banking, telecom, transport, natural resources) require prior government authorisation. The World Bank B-READY 2025 report placed Tunisia in the 4th (low-performing) quintile, with an operational efficiency score of 52.46 out of 100.