Tunisia Recording Laws: All-Party Consent, Penalties & Decree-Law 54 (2026)

Quick Answer: Tunisia Is All-Party Consent

Tunisia is an all-party consent jurisdiction for recording. No individual, business, or organization may legally record a private conversation, telephone call, or electronic communication without the prior knowledge and agreement of every person involved. That rule derives from the 2022 Constitution, Organic Law 2004-63 on data protection, the Penal Code, and the Telecommunications Code, operating simultaneously as overlapping liability. A single unauthorized recording can give rise to criminal charges under more than one statute at the same time.

The consent standard has no participant exception. A person who is a party to the conversation still needs the permission of all other parties before recording. There is no defense analogous to a one-party consent rule.

Tunisia's framework carries a critical practical caveat: the state has carved out sweeping exceptions for itself. Counter-terrorism law from 2015 and Decree-Law 2022-54 from 2022 give the government broad interception authority with limited judicial oversight. Those same powers have been turned against journalists, lawyers, political critics, and ordinary citizens who recorded or shared content online. As of May 2026, the legal environment for recording in Tunisia is the most restrictive it has been since the 2011 revolution.

Jurisdiction scope: This article addresses recording consent rules under Tunisian law: the 2022 Constitution, Organic Law 2004-63, the Penal Code (enacted 1913, as amended), the Telecommunications Code (Law No. 2001-1), and Decree-Law No. 2022-54. It does not address recording rules in other North African jurisdictions. For French recording law, see our France recording laws article.

Constitutional Basis: Article 30 of the 2022 Constitution

The 2022 Constitution, adopted under President Kais Saied following a July 2021 referendum, places the privacy guarantee at Article 30. The provision states that the state is responsible for "protecting the privacy and inviolability of the home and confidentiality of correspondence, communications and personal data."

The 2022 text replaced the 2014 Constitution, which had addressed privacy at Article 24. The substance of the protection remained substantially similar across both instruments: private life, home, correspondence, and communications are inviolable and the state bears an affirmative duty to protect them.

Article 30 establishes privacy as a fundamental right with constitutional force. Courts interpreting recording-related offenses apply statutory provisions against this constitutional backdrop. Where a statute is ambiguous, the constitutional right to privacy of correspondence and communications informs the interpretive outcome.

The 2022 Constitution also contains broad emergency powers provisions. Tunisia maintained a declared state of emergency continuously from November 2015 through 2026. Under emergency conditions, executive authority can limit constitutional rights without the legislative constraints that ordinarily apply. That dynamic creates persistent tension between Article 30's privacy guarantee on paper and the surveillance capabilities the government exercises in practice.

Organic Law 2004-63: The Data Protection Framework

Scope and the All-Party Consent Standard

Organic Law No. 2004-63 of July 27, 2004 established Tunisia's comprehensive data protection regime. When enacted, it made Tunisia the first country on the African continent to adopt a comprehensive personal data protection law, predating many European peer frameworks by years.

The law applies to any processing of personal data, defined broadly to include any operation performed on data that identifies or could identify a natural person. Audio recordings, video recordings, photographs, biometric data, and any other medium capturing identifiable information about a person all constitute personal data under the law.

Article 1 establishes that every person has the right to protection of personal data relating to their private life as a fundamental right. That framing grounds the consent requirement directly in human rights doctrine rather than technical data governance.

Key requirements under Law 2004-63:

• Prior consent is required before collecting personal data from or about any individual
• Written consent is mandatory for processing sensitive categories of data (health information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, and criminal records)
• Prior declaration to the Instance Nationale de Protection des Donnees Personnelles (INPDP) is required before any data processing activity begins
• Purpose limitation applies: data collected for one stated purpose cannot be repurposed without fresh consent
• Data subjects hold the right to access, correct, and object to the processing of their personal information

The consent requirement is the mechanism that produces Tunisia's all-party consent standard for recording. Every person captured in a recording is a data subject whose personal data is being collected and processed. Each such person must consent before the recording begins.

Penalties Under Law 2004-63

The law provides criminal enforcement across several articles:

• Article 86: Two to five years imprisonment and a fine of 5,000 to 50,000 Tunisian dinars (approximately USD $1,600 to $16,000 at current exchange rates) for violations related to cross-border data transfers and processing restrictions
• Article 87: Two years imprisonment and a fine of 10,000 dinars for processing sensitive personal data without authorization from the INPDP
• Failure to file a prior declaration with the INPDP before beginning any data processing activity carries up to one year imprisonment and a fine of 5,000 dinars

Attempted violations are also punishable under the code's general attempt provisions. Courts have applied these penalties to unauthorized recording scenarios alongside corresponding Penal Code charges, meaning a single incident can generate criminal liability under multiple statutes simultaneously.

The INPDP: Enforcement Authority

Law 2004-63 established the INPDP as Tunisia's data protection supervisor. The authority receives mandatory prior declarations of processing activities, reviews requests for sensitive data handling and cross-border data transfers, investigates complaints from data subjects, and refers violations for criminal prosecution.

In 2018, the INPDP issued Decision No. 5, setting out specific conditions and procedures for the installation of cameras and video surveillance systems. Any business or individual operating surveillance cameras must register the system with the INPDP and comply with the decision's conditions or face the penalties in Law 2004-63.

The 2025 personal data protection bill before parliament proposes upgrading the INPDP from an advisory-and-declaration-based authority to a fully independent regulator with quasi-judicial powers, including the authority to impose administrative fines, conduct on-site inspections, and issue binding cessation orders. Those enhanced powers had not yet entered into force as of May 2026.

The Penal Code: Correspondence Secrecy and Privacy Offenses

Section VII: Protection of Private Communications

Tunisia's Penal Code, enacted by decree on July 9, 1913 and substantially amended through several legislative cycles, contains a cluster of provisions in its sections on offenses against persons that directly address the interception, diversion, and disclosure of private communications.

The relevant offenses in Chapter VII criminalize the interception or diversion of private correspondence and the disclosure of professional secrets. A person who intercepts, opens, reads, or redirects a private communication intended for another person commits an offense regardless of the technical means used. Audio recording of a private conversation without consent falls within this framework as an unauthorized interception of a private communication.

Penalties for Penal Code correspondence offenses range from six months to five years imprisonment and fines of 120 to 1,200 Tunisian dinars, depending on the specific article violated and the circumstances. Where the offense involves a professional relationship (an employer intercepting employee communications, a service provider accessing client data), courts apply heavier penalties at the top of the range.

The Penal Code provisions operate concurrently with Law 2004-63. A single unauthorized recording generates potential liability under both frameworks: the Penal Code charge addresses the interception itself, while the data protection charge addresses the unauthorized processing of the personal data captured. Prosecutors have charged individuals under both instruments simultaneously.

Overlapping Liability: The Practical Effect

The overlay of the Penal Code, Law 2004-63, the Telecommunications Code, and Decree-Law 2022-54 means that a person who secretly records a private conversation in Tunisia faces potential prosecution under four separate legal frameworks. The cumulative sentencing risk substantially exceeds what any single statute would produce. This multi-statute exposure distinguishes Tunisia's enforcement environment from many other all-party consent jurisdictions.

Telecommunications Code: Secrecy Rules and Encryption

The Telecommunications Code (Law No. 2001-1, as amended) governs the technical and legal framework for electronic communications in Tunisia. Article 85 of the code imposes penalties on anyone who unlawfully discloses the content of intercepted communications or electronic exchanges, whether by sharing recordings, publishing transcripts, or otherwise revealing intercepted information.

The code contains a significant additional restriction on privacy tools. Unauthorized use of cryptographic technology is punishable by up to five years imprisonment. Any use of encrypted communications requires prior authorization from the Agence Nationale de Certification Electronique (ANCE). Privacy advocates, including Access Now and Privacy International, have criticized this provision on the grounds that encryption is a fundamental tool for protecting communications privacy. The restriction creates a situation where using encrypted messaging applications without ANCE authorization may itself constitute a criminal offense.

Phone Calls and In-Person Conversations

Telephone and VoIP Recording

Recording telephone conversations in Tunisia without the consent of all parties violates Law 2004-63, the Telecommunications Code, and potentially the Penal Code. The prohibition extends to all voice communications regardless of the technical medium:

• Personal calls between individuals on any carrier
• Business and commercial calls
• VoIP calls through WhatsApp, Zoom, Microsoft Teams, or any internet-based platform
• Automated call recording systems operated by businesses for quality monitoring

A business that records customer calls must obtain clear, informed, specific consent from the caller before the recording begins. Consent buried in general terms of service without explicit notice at the moment of the call does not satisfy the consent standard under Law 2004-63.

In-Person Conversations

The all-party consent requirement applies equally to face-to-face conversations. Recording a meeting, a negotiation, a counseling session, or any other private discussion without the knowledge and permission of every participant violates Tunisian law. The prohibition applies regardless of the recording device: a dedicated voice recorder, a concealed phone application, a hidden microphone, or any other means of capturing audio. The location of the conversation is not determinative. A private conversation taking place at a table in a public restaurant remains a private communication for purposes of the recording laws.

Public Spaces and Photography Restrictions

Tunisia imposes filming and photography restrictions in public spaces that extend well beyond the private conversation framework described above.

Photographing government buildings, military installations, police stations, customs facilities, and foreign embassies is prohibited on national security grounds. Photographing uniformed police officers, soldiers, border guards, or other state security personnel is also restricted. Violations can result in immediate arrest, confiscation of all recording equipment, and criminal prosecution.

For professional filmmakers and photographers, a general filming permit from the Tunisian Ministry of Culture is required before work begins. Professional equipment such as high-end cameras with large lenses, boom microphones, audio recorders, and lighting rigs may require additional permits from the Tunisian Agency for External Communication (ATCE) or the Tunisian Internet Agency (ATI). Filming of administrative offices, courthouses, or political institutions without specific authorization is prohibited and has resulted in arrests.

Tourists and casual visitors who photograph identifiable individuals in public spaces may also face liability under Law 2004-63, which treats the captured image as personal data requiring the subject's consent. In practice, enforcement against casual tourist photography is uncommon, but the legal framework provides grounds for prosecution when circumstances warrant.

Recording Police and Public Officials: Very High Risk

Recording police officers, soldiers, or other state officials in the performance of their duties carries extraordinary legal risk in Tunisia as of 2026. The risk stems from the intersection of Decree-Law 2022-54's public official aggravating provision with the general all-party consent framework.

Article 24 of Decree-Law 2022-54 sets the baseline penalty for producing, promoting, or transmitting "false news" or content that harms others' rights, public safety, or national defense at five years imprisonment and a 50,000-dinar fine. The penalty doubles to ten years if the target of the content is a public official. Courts have applied this provision broadly: publishing a video that depicts an official acting improperly has been treated as content "harming" public safety or national defense even when the video accurately shows the official's conduct.

A concrete illustration of the risk emerged in reporting on Decree-Law 54: a journalist was detained after publishing a video showing a local official taking municipal garbage bins. The public prosecutor told the journalist that he was fortunate his case was filed one day before Decree-Law 54 took effect, because the same conduct after September 13, 2022 could have resulted in years in prison. That case predated the decree; similar conduct today would fall within Article 24's reach.

The combined effect of the all-party consent rule and Article 24's aggravated penalties means that recording a police officer during an interaction, even to document alleged misconduct, exposes the recorder to prosecution under at least three separate statutes: Law 2004-63 (unauthorized processing of personal data), the Penal Code (interception of private communications), and Decree-Law 2022-54 Article 24 (aggravated penalty for content involving a public official).

Human rights organizations including Article 19, the International Commission of Jurists, Amnesty International, and Reporters Without Borders have documented numerous cases in which this legal framework has been used to silence citizen journalists and civil society observers. The National Syndicate of Tunisian Journalists documented at least 39 cases brought against journalists for their professional work between May 2023 and May 2026, with 10 prison sentences issued in the April 2024-April 2025 period alone.

Watch out: Under Decree-Law 2022-54 Article 24, sharing a recording of a public official online carries a potential ten-year prison sentence if authorities classify the content as harmful to public safety or national defense. The provision has been applied broadly; the threshold for what counts as "harmful" is undefined and has been applied to content that merely criticized official conduct.

Workplace Surveillance and Employee Monitoring

Workplace recording in Tunisia operates under the combined framework of Law 2004-63 and the INPDP's 2018 Decision No. 5 on video surveillance systems.

Employers who install surveillance cameras must comply with the following requirements:

• Notify employees about the existence, location, and stated purpose of every recording device before installation
• File a prior declaration with the INPDP and receive acknowledgment before any surveillance system goes live
• Limit recording to areas where a legitimate security or operational justification exists
• Exclude private areas including restrooms, changing rooms, break rooms, and medical facilities from all surveillance
• Document retention periods and delete recordings automatically when the stated purpose no longer applies

Audio recording of employees in the workplace faces stricter requirements than video surveillance. Continuously recording employee conversations is not authorized under Law 2004-63. Any audio monitoring requires specific operational justification, express consent from employees, and a separate INPDP declaration describing the scope of the monitoring.

The 2025 personal data protection bill before parliament would impose additional obligations. Under the proposed bill, all organizations processing personal data would be required to maintain a written Record of Processing Activities documenting the purposes, categories of data subjects, categories of data, recipients, and retention periods for every processing activity, including workplace surveillance recordings. Organizations above a size threshold would also be required to designate a Data Protection Officer responsible for INPDP liaison and internal compliance.

State Surveillance: Law 2015-26 on Counter-Terrorism

Broad Interception Authority

Basic Law 2015-26 of August 7, 2015 on combating terrorism and money laundering grants security and intelligence services exceptional investigative powers including:

• Surveillance and physical monitoring of suspected individuals
• Interception of any form of electronic or telephonic communication
• Recording of telephone conversations
• Physical infiltration of suspected groups by undercover agents
• Access to metadata and traffic data from communications providers

These measures require advance judicial authorization and are limited to a period of four months per authorization. Article 56 of the law addresses the confidentiality of content collected through interception. Article 61 addresses audio-visual recordings obtained in the course of surveillance operations.

Safeguards and Their Limits

The 2019 amendments to Law 2015-26 (Basic Law 2019-09) increased penalties for unauthorized state surveillance to between one and five years imprisonment and fines of 1,000 to 5,000 dinars. Parliament added a criminal liability provision for state agents who conduct surveillance or infiltrate groups without judicial authorization.

Critics including Human Rights Watch and Amnesty International have documented material gaps in these safeguards. Article 54 of the amended law does not require investigators who seek judicial approval to specify the type of communication being intercepted or the duration of the surveillance period. That vagueness leaves security services wide latitude to define the scope of authorized surveillance operations.

The State of Emergency Factor

Tunisia maintained a declared state of emergency continuously from November 2015 through at least May 2026. Under emergency conditions, the surveillance powers of Law 2015-26 operate with fewer procedural constraints than they would in normal circumstances. The emergency effectively normalized exceptional surveillance capabilities that the 2015 legislature designed as temporary measures for acute counter-terrorism need.

Decree-Law 2022-54: Cybercrime Law and Its Documented Abuses

Provisions and Official Scope

President Kais Saied issued Decree-Law No. 2022-54 on September 13, 2022 with the stated purpose of combating crimes related to information and communication systems. The decree establishes several categories of offense and grants authorities the following powers:

• Monitoring internet use and collecting personal data related to digital activities
• Intercepting communications subject to a written and reasoned decision from a public prosecutor or investigating judge
• Requiring telecommunications providers and internet service providers to provide access to stored data and traffic data upon a written judicial police request under Article 9

Article 24 targets the production, promotion, publication, transmission, or preparation of "false news, statements, rumours or forged documents" communicated through information networks where such content harms others' rights, public safety, or national defense. The baseline penalty is five years imprisonment and a 50,000-dinar fine. Where the target is a public official, the penalty doubles to ten years.

Article 10 creates a separate offense for breach of professional secrecy by agents who handle intercepted data: six months imprisonment and a 20,000-dinar fine for ordinary agents, five years and 30,000 dinars for senior officials, and ten years and 50,000 dinars if the breach harms national security or public order.

Documented Use Against Journalists and Critics

The documented enforcement record of Decree-Law 2022-54 from 2022 through May 2026 diverges sharply from the stated anti-cybercrime purpose. Human Rights Watch documented the detention, charge, or placement under investigation of at least 20 journalists, lawyers, students, and political critics for public statements made online or in media interviews within the first year of the decree's operation.

By January 2026, Tunis courts had sentenced radio journalists Mourad Zghidi and Borhen Bsaies to three and a half years in prison with fines and asset seizures, following earlier convictions and appeals under Decree-Law 54. Veteran broadcaster Mohamed Boughaleb was released in February 2025 only to receive a new two-year sentence in July 2025 under Article 24 for a Facebook post his lawyers stated he did not write. Ghassen Ben Khelifa, editor-in-chief of the independent newspaper Inhiyez, received a two-year sentence in March 2026.

Political commentator Sonia Dahmani was arrested in May 2024 after sarcastically calling Tunisia "an extraordinary country" attracting migrants on a television program. She received the Committee to Protect Journalists' 2025 International Press Freedom Award. An appeals court upheld her conviction in April 2026 while reducing her sentence to 18 months; she remained free as of May 2026 but subject to arrest at any moment. The Committee to Protect Journalists' May 2026 report, "Beyond Decree 54: Tunisia's Latest Measures to Silence the Press," documented new prosecution mechanisms being layered on top of the decree.

According to the National Syndicate of Tunisian Journalists, at least 39 cases were brought against journalists for their professional work between May 2023 and May 2026.

International Criticism

The decree has drawn condemnation from major international institutions:

• Article 19 characterized Decree-Law 2022-54 as a "grave threat to freedom of expression" in its January 2023 legal analysis
• The International Commission of Jurists demanded repeal of what it described as a "draconian" instrument
• Amnesty International documented cases where cybercrime investigations exposed journalists and activists to years of pre-trial detention
• Access Now called on President Saied to scrap the decree
• Reporters Without Borders reported Tunisia's press freedom ranking fell from 72nd globally in 2019 to 118th in 2024 and continued declining in 2025

Voyeurism and Non-Consensual Recording

Tunisia lacks dedicated legislation specifically targeting voyeurism, upskirting, or the non-consensual creation and distribution of intimate images. No single statute in force as of May 2026 addresses these categories of offense under a unified framework comparable to voyeurism statutes in European jurisdictions.

The operative legal framework for non-consensual intimate recording relies on several partial overlapping instruments:

Law 2004-63 treats any recording of an identifiable person as personal data processing. An intimate recording made without consent is unauthorized data processing subject to the criminal penalties in Articles 86 and 87. This provides a legal avenue for prosecution but requires framing the harm in data protection rather than sexual dignity terms.

Law 58/2017 on the elimination of violence against women addresses all forms of violence against women including physical, psychological, economic, sexual, and political violence. The law introduced criminal liability for psychological violence including harassment but does not specifically address image-based sexual abuse or the creation of non-consensual intimate recordings.

Decree-Law 2022-54 has been applied in some cases involving non-consensual distribution of intimate images where the authorities have characterized the distribution as harmful content under Article 24. That application provides a prosecution tool but carries the same over-breadth concerns as the decree's application to journalism, because Article 24's scope depends on prosecutorial characterization of the harm.

The Centre for International Governance Innovation documented in 2023 that the non-consensual dissemination of intimate images is a documented reality in Tunisia, but the issue remains largely absent from mainstream legislative reform discourse. The 2025 personal data protection bill before parliament does not include a specific provision addressing image-based sexual abuse.

Deepfake and AI-Generated Content

Tunisia has no dedicated legislation governing deepfake content or artificial intelligence-generated media as of May 2026. No AI-specific law is in force in Tunisia, placing it alongside most other African nations where the pace of AI development has outstripped dedicated regulatory response.

The absence of specific legislation does not mean deepfake content is legally unregulated. Existing instruments apply to AI-generated content under their general terms:

Decree-Law 2022-54 Article 24 addresses "forged documents" and false content distributed through information networks. An AI-generated deepfake video depicting a real person making statements they never made would fall within Article 24's definition of fabricated content if it harms the depicted person's rights, public safety, or national defense. The five-year baseline penalty (ten years if the depicted person is a public official) applies.

Law 2004-63 treats images and audio recordings of identifiable persons as personal data. Using a person's likeness to train an AI model or to generate synthetic media depicting them without consent constitutes unauthorized data processing subject to the law's criminal penalties.

The 2025 personal data protection bill before parliament specifically addresses biometric identification, facial recognition, and algorithmic profiling as categories of processing requiring heightened protection, including explicit consent. If enacted, those provisions would create a stricter regulatory framework for AI systems that process facial data or voice data to generate synthetic media.

Tunisia ratified Council of Europe Convention 108 on automated data processing, which provides a baseline standard for the processing of personal data. Convention 108+ (the modernized version) addresses automated decision-making and profiling, and Tunisia's ratification creates an interpretive obligation to read domestic law in light of those international standards, even in advance of specific AI legislation.

Cross-Border Data Transfers: Tunisia Is Not EU Adequate

Tunisia is not on the European Commission's list of third countries that provide an adequate level of personal data protection under the GDPR. This means that transferring personal data from the European Union to Tunisia requires a separate legal mechanism beyond simple adequacy reliance.

EU-based organizations sending personal data to Tunisian processors or affiliates must use one of the following mechanisms:

• Standard Contractual Clauses approved by the European Commission, incorporated into data transfer agreements
• Binding Corporate Rules for multinational corporate groups, subject to lead supervisory authority approval
• Explicit consent from data subjects for specific transfers
• Performance of a contract with the data subject

From the Tunisian domestic law side, Law 2004-63 also regulates outbound transfers from Tunisia. Cross-border transfers require a prior authorization from the INPDP unless the destination country's data protection framework meets the standard the INPDP considers adequate. Transfers to EU member states generally satisfy this requirement given the GDPR's robustness. Transfers to countries without comprehensive data protection law face more scrutiny.

The 2025 personal data protection bill expressly targets EU GDPR adequacy as a policy objective. The bill aligns its structure with the GDPR's data subject rights, lawful bases for processing, accountability principles, and penalty structure, including fines calculated as a percentage of global annual turnover for the most serious violations. The bill also aligns with Council of Europe Convention 108+, which Tunisia ratified in an earlier step. Obtaining an EU adequacy decision would facilitate seamless data transfers to and from Tunisia, a significant economic consideration given Tunisia's information technology and business process outsourcing sectors.

As of May 2026, the bill remained in parliamentary committee review. No adequacy decision has been issued by the European Commission for Tunisia.

Penalties Summary

The table below consolidates the criminal penalties for recording-related offenses under Tunisian law across all applicable statutes:

Business Compliance: Practical Steps

Organizations operating in Tunisia should take the following steps to comply with recording, surveillance, and data protection obligations:

For call recording:

• Obtain explicit, specific verbal or written consent before recording any call
• Provide a clear statement at the start of the call that the call is being recorded
• File a prior declaration with the INPDP before implementing any call recording system
• Store recordings securely with defined, documented retention periods
• Delete recordings automatically when the retention period expires

For workplace surveillance:

• Register all surveillance systems with the INPDP before installation
• Post visible, legible notices at each camera location informing employees and visitors of recording
• Exclude all private areas including restrooms, changing areas, and medical facilities
• Conduct a data protection impact assessment for large-scale monitoring systems
• Prepare for the 2025 bill's Record of Processing Activities and DPO requirements

For data transfers to and from the EU:

• Use Standard Contractual Clauses for transfers to Tunisian processors from EU affiliates
• Obtain INPDP authorization for transfers of sensitive data categories
• Monitor parliamentary progress on the 2025 GDPR-aligned bill for adequacy implications

For AI and synthetic media:

• Treat any AI model trained on images, voices, or biometric data of Tunisian residents as personal data processing requiring consent under Law 2004-63
• Avoid generating synthetic media depicting identifiable Tunisian individuals without express written consent
• Monitor the 2025 bill's biometric and algorithmic profiling provisions for new compliance obligations

Disclaimer

This article presents general legal information about recording laws in Tunisia. It is not legal advice. The information covers the laws of the Republic of Tunisia as they were understood to be in force as of May 15, 2026, including the 2022 Constitution, Organic Law 2004-63, the Penal Code, the Telecommunications Code, and Decree-Law 2022-54. Laws change, enforcement practice evolves, and individual situations involve facts that general information cannot address. Anyone with a specific legal question about recording in Tunisia should consult a lawyer licensed to practice in Tunisia.