Skip to content
World Watch

Cybersecurity law & regulation in Tunisia (2026)

Cybersecurity in Tunisia: comprehensive law.

Tunisia operates a comprehensive cybersecurity regime anchored by Law 2018-5 and reinforced by Decree-Law 2023-17, which expanded the national cybersecurity agency's powers, mandated annual IT audits for data-processing entities, and introduced cloud-computing rules. The Agence Nationale de la Cybersécurité (ANCS) is the central authority overseeing compliance, certification, and incident response across public and private sectors. Organizations handling personal data via telecommunications networks face binding 72-hour breach-notification duties and periodic mandatory audit requirements.

Last verified Official sources first · MethodologyCompare Tunisia with other countries

Legal framework

Law No. 2018-5 of 23 January 2018 on Cybersecurity, as expanded by Decree-Law No. 2023-17 of 11 March 2023, enforced by the Agence Nationale de la Cybersécurité (ANCS, formerly ANSI)

Key points: cybersecurity in Tunisia

  1. Primary legislation

    Law No. 2018-5 of 23 January 2018 is the cornerstone cybersecurity statute establishing ANCS and mandating protection of public and private information systems and critical infrastructure. It built upon and superseded the earlier Law No. 5/2004 framework.

    generisonline.com dlapiperdataprotection.com

  2. Decree-Law 2023-17 expansion

    Decree-Law 2023-17 of 11 March 2023 (in force September 2023) broadened ANCS authority, introduced cloud-computing regulation for the first time in Tunisian law, and required operators of 'vital digital infrastructure' to use ANCS-certified software and maintain primary and backup hosting centres with certified cloud providers.

    incyber.org generisonline.com

  3. Breach & incident notification

    Organizations detecting a cybersecurity breach must notify ANCS within 72 hours. Companies processing personal data via telecommunications networks must separately inform ANCS of any cyberattack. Monetary sanctions apply for non-compliance.

    dlapiperdataprotection.com generisonline.com

  4. Mandatory annual IT audits

    Under Decree-Law 2023-17, companies involved in automated processing of personal data when providing services via telecommunications networks must conduct annual IT system audits following ANCS-approved standards and risk-analysis methodologies.

    generisonline.com dlapiperdataprotection.com

  5. Cybercrime sanctions (Decree-Law 2022-54)

    Decree-Law 2022-54 of 13 September 2022 introduced criminal sanctions for cybercrimes including unauthorized system access, data interception, and online dissemination of false information. As of January 2025, CPJ reported it has been used to imprison a record number of journalists, drawing human-rights criticism.

    humena.org cpj.org

  6. National Cybersecurity Strategy 2020-2025

    Tunisia operates under a National Cyberspace Strategy 2020-2025, with ANCS responsible for developing governance policies, monitoring implementation of action plans, and coordinating cybersecurity across all sectors including critical infrastructure such as energy, water, and health.

    dig.watch ncsi.ega.ee

Sources

  1. dlapiperdataprotection.com/?t=security&c=TN
  2. dlapiperdataprotection.com/?t=breach-notification&c=TN
  3. generisonline.com/an-overview-of-cybersecurity-regulations-in-tunisia/
  4. incyber.org/en/article/tunisia-expands-scope-of-national-cybersecurity-agency/
  5. ncsi.ega.ee/country/tn/
  6. dig.watch/resource/tunisian-national-cyberspace-strategy-2020-2025
  7. humena.org/blogs/decree-54-tunisia/
  8. cpj.org/2025/01/tunisia-uses-new-cybercrime-law-to-jail-record-number-of-jour

Next for Tunisia: Starting a BusinessModerate

Next topic

Orientation, not legal advice: verify against the primary sources linked above. Last verified 24 May 2026. Methodology & how to cite · State of Technology Regulation 2026