The Organic Act No. 63-2004 on the Protection of Personal Data provides a comprehensive regime of data protection in Tunisia and sets up the National Authority of Data Protection (INPDP) in charge of its enforcement.

Art. 6 of Decree No. 54-2022 requires telecommunications service providers to keep data stored in their own information system for a period of no less than two years, including geolocation data, personal identification data, and traffic flow data. It is unclear if the information system has to be in the country or not.

Under Presidential Decree No. 2025-74 (29 January 2025), Tunisia extended the nationwide state of emergency until December 2025. The ongoing state of emergency has been in effect continuously since November 2015, and has been extended multiple times under the 1978 Emergency Decree (No. 78-50), which reportedly allows them to access electronic devices without a court order.

According to Art. 2 of Decree No. 4773-2014, ISPs must be authorised by the Minister responsible for telecommunications after consultation with the Minister of the Interior and the National Telecommunications Authority. Art. 3 stipulates that any person wishing to be authorised as an Internet Services Provider (ISP) must meet the following conditions:
- In the case of a natural person, be of Tunisian nationality and hold a university degree or equivalent;
- In the case of a legal person, be constituted in accordance with Tunisian law, with a share capital of at least TND 1,000,000 (approx. USD 322,000) held in name and by a majority of Tunisian nationals.
Art. 4 adds that granting of the ISP authorisation is subject to the payment of a fee of TND 150,000 (approx. USD 48,500), payable on the date of granting the authorisation.

Art. 31 ter of Law No. 1 of 2001 stipulates that operating a virtual telecommunications network requires prior authorisation from the Minister responsible for telecommunications, following consultation with the Instance Nationale des Télécommunications (INT). Decree No. 2014-412 outlines the conditions and procedures for obtaining this authorisation, with Art. 5 specifying that any legal entity applying for a licence must ensure majority ownership by Tunisian shareholders. Under Law No. 1 of 2001, a virtual telecommunications network operator is defined as a legal entity authorised to provide telecommunications services using a network and radio frequencies it does not own.

The government owns shares in certain telecom companies. In particular, the Tunisian State owns 65% of Tunisie Telecom's capital, and since 2011, it has owned 10% of the shares of Ooredoo Tunisia and 51% of the shares of Orange Tunisia.

It is reported that Tunisia mandates functional and accounting separation for operators with significant market power (SMP) in the telecom market. According to Art. 26-bis of Law No. 1-2001 promulgating the Telecommunications Code, operators of public telecommunications networks and access networks undertake to keep analytical accounts distinguishing between each network and each service and to refrain from any anti-competitive practices, in particular cross-subsidisation.

Art. 5 of Law No. 1 of 2001 states that the provision of telecommunication services is subject to prior authorisation by the Minister responsible for Telecommunications. Subject to the provisions of Art. 5 of the Code, Art. 8 establishes that the provider of telecommunications services must meet the following conditions:
- for natural persons, they must be of Tunisian nationality;
- in the case of a legal entity, it must be incorporated in accordance with Tunisian law.
A telecommunications service is defined as any service that provides telecommunications between two or more users.

Art. 31 ter of Law No. 1 of 2001 requires prior authorisation from the Minister responsible for telecommunications to operate a virtual telecommunications network. This authorisation is granted after consultation with the Instance Nationale des Télécommunications (INT). The conditions and procedures for obtaining the authorisation are detailed in Decree No. 2014-412.
Art. 5 of the Decree specifies the following requirements:
- The legal representative of the applicant must be a Tunisian citizen and hold either a higher education degree, an equivalent qualification, or certified training at the same level in information technology, telecommunications, or multimedia.
- The applicant must be a legal entity established under Tunisian law with a minimum share capital of TND 150,000 (approx. USD 48,500), which must be owned nominally and primarily by Tunisian nationals.

According to Art. 2 of Decree No. 4773-2014, Internet Service Providers (ISPs) must be authorised by the Minister responsible for telecommunications after consultation with the Minister of the Interior and the National Telecommunications Authority. Art. 3 stipulates that any person wishing to be authorised as an ISP must meet the following conditions:
- In the case of a natural person, be of Tunisian nationality and hold a university degree or equivalent;
- In the case of a legal person, be constituted in accordance with Tunisian law, with a share capital of at least TND 1,000,000 (approx. USD 322,000) held in name and by a majority of Tunisian nationals.
Art. 4 adds that granting of the ISP authorisation is subject to the payment of a fee of TND 150,000 (approx. USD 48,500), payable on the date of granting the authorisation.

Tunisia has appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of Commitments annexed to the Fourth Protocol on Basic Telecommunications.

It is reported that the Instance Nationale des Télécommunications (INT, National Telecommunications Authority), the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process. Art. 63 (bis) of Law No. 01-2001 provides that the INT shall have legal personality and financial autonomy.

Pursuant to Organic Act No. 2004-63, the transfer of personal data is generally prohibited or subject to strict measures. According to Art. 52, prior authorisation from the Tunisian Data Protection Authority (Instance Nationale de Protection des Données à caractère Personnel, INPDP) is required in all circumstances. In addition, according to Art. 50, it is forbidden to transfer personal data to a foreign country that is likely to harm the public security or vital interests of Tunisia. Lastly, according to Art. 51, the transfer of personal data is not permitted in countries which do not provide an adequate level of data protection. It should be noted that Art. 22 provides that the natural person or the legal representative of the legal entity wishing to carry out the processing of personal data and their agents must meet the following conditions: be of Tunisian nationality; be a resident of Tunisia; and have no criminal record. These conditions also apply to the subcontractor and its agents.

It is reported that the Ministry of Communication Technologies prohibits public companies and institutions from freely transmitting and storing personal data outside of the country.

According to Art. 21 of the Decree-Law No. 2-2022, it is forbidden for companies organising the activity of credit information to transfer their databases outside Tunisia and to host the data in the cloud.