For Canadian and Belgian firms
What stops a firm from sending accounting work to Tunisia is neither price nor competence. It is the question its privacy officer asks, for which nobody has prepared a documented answer. Here it is: the Tunisian regime, text by text, and the twelve questions to put to any provider.
MGI BFC, a firm of chartered accountants and auditors registered with the Ordre des Experts-Comptables de Tunisie and a member of MGI Worldwide, sets out here the Tunisian data protection regime that applies when accounting work is delegated to Tunisia: professional secrecy carrying a criminal penalty, Organic Law no. 2004-63 of 27 July 2004 and its supervisory authority, and Convention 108 of the Council of Europe, in force in respect of Tunisia since 1 November 2017.
Before data protection law even comes into play, the Tunisian accountancy profession is bound by a duty of secrecy whose breach is a matter for the criminal courts, not merely for the contract.
Members of the Ordre entered on the roll and their employees are bound by professional secrecy, save where the law provides otherwise, and that obligation extends to information of which they become aware in the course of carrying out their engagements.
Section 8 of Law no. 88-108 of 18 August 1988 reforming the legislation governing the profession of chartered accountant
A penalty of six months' imprisonment and a fine applies to any person who, by virtue of their position or profession, is entrusted with secrets and has disclosed them, except where the law requires or permits them to report. The text expressly covers persons bound by secrecy through their profession.
Section 254 of the Criminal Code, as enacted by the decree of 25 March 1940
For the sake of accuracy: the fine in section 254 was set by a 1940 decree and has never been revalued. It is negligible today. What matters in that text is not the amount but the criminal nature of the offence and the custodial sentence attached to it.
Organic Law no. 2004-63 of 27 July 2004 governs the protection of personal data and establishes the National Authority for the Protection of Personal Data. The sections that bear directly on delegated accounting work are these.
| Section | What the text says |
|---|---|
| s. 10 | Collection may be carried out only for lawful, specified and explicit purposes. |
| s. 11 | Data must be processed fairly and within the limits necessary for the purposes for which it was collected. The controller must ensure that it is accurate, precise and kept up to date. |
| s. 12 | Processing for purposes other than those of collection is prohibited, save with consent, to safeguard a vital interest of the data subject, or for established scientific purposes. |
| s. 13 | Processing of data relating to offences, their establishment, criminal proceedings, penalties, preventive measures or criminal records is prohibited. |
| s. 14 | Processing of data relating to racial or genetic origin, religious beliefs, political, philosophical or trade union opinions, or health is prohibited, save with express consent leaving a written trace, and in a few limited cases. |
| s. 47 | Disclosure of personal data to third parties is prohibited without the express consent of the data subject, given by a means leaving a written trace, apart from the limited exceptions the text lists. |
Transfers into Tunisia are always examined. What may leave almost never is. Yet that is where the real risk sits: onward sub-processing to countries nobody assessed. Tunisian law locks it with a prior administrative authorisation.
Section 50
It is prohibited, in all cases, to communicate or transfer personal data to a foreign country where doing so is liable to harm public security or the vital interests of Tunisia.
Section 51
A transfer to another country may take place only if that country ensures an adequate level of protection, assessed in the light of the nature of the data, the purposes of the processing, its intended duration, the country of destination and the security precautions implemented.
Section 52
In all cases, obtaining the authorisation of the National Authority for the Protection of Personal Data in order to transfer data abroad is mandatory. The Authority rules within a maximum of one month from the date the application is submitted.
For a privacy officer, this is the opposite of what they fear. The question is no longer where the data will end up: it cannot leave without the written approval of a public authority, which has one month to decide.
This is the least known part of the file, and the most useful to a compliance officer: Tunisia is bound by the Council of Europe convention for the protection of individuals with regard to automatic processing of personal data.
Source: Council of Europe. We do not repeat the claim, sometimes seen, that Tunisia was the first African country to become a Party to Convention 108: we were unable to establish it, and other African States are Parties.
We describe the Tunisian regime because it is verifiable and because we answer for it. We stop where your own national law begins. Here are those laws, named, so that you know what to open.
Under clause 4.1.3 of Schedule 1 to the Personal Information Protection and Electronic Documents Act, an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing, and shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party. Deciding what amounts to a comparable level of protection, and documenting it, is yours to do. The phrase requires documented facts about the law of the destination country, and that is precisely what this page supplies. We state the Tunisian position; we express no view on your own.
Personal Information Protection and Electronic Documents Act, Schedule 1, clause 4.1.3, read on laws-lois.justice.gc.ca
A separate statute applies to private-sector enterprises in Quebec, which requires a privacy impact assessment before personal information is communicated outside Quebec, and a written agreement thereafter. Its wording is summarised on the French version of this page. We name it so that you open it; we do not interpret it for you.
Act respecting the protection of personal information in the private sector (Quebec), section 17
Tunisia is not among the countries covered by an adequacy decision of the European Commission. A transfer to Tunisia therefore falls under the appropriate safeguards of Article 46 of the General Data Protection Regulation, in practice the standard contractual clauses, together with a transfer impact assessment. It is for the controller established in Belgium to carry out that assessment and draw its conclusions. We supply the factual elements on the Tunisian regime; we take no position on your situation.
Article 46 GDPR; list of European Commission adequacy decisions
Put them to us as you would to anyone else. Whatever you cannot get answered in writing, and verified, is what will be missing from your file.
1. Is the professional on the roll of a regulated professional body?
The duty of secrecy in section 8 binds only members entered on the roll of the Ordre and their employees. Someone who is not on the roll falls outside that text.
Section 8, Law no. 88-108
2. Does the duty of secrecy extend, by name, to the staff who will handle your files?
The text covers members on the roll and their employees. Ask how that is reflected in employment contracts and in signed individual undertakings.
Section 8, Law no. 88-108
3. Where is the data hosted, physically?
This is the first question of any serious assessment, and the answer must be a place, not a vendor name. Hosting outside Tunisia changes the analysis entirely.
Assessment criterion, not a statutory requirement
4. Are there sub-processors, and in which countries?
The sub-processing chain is the usual blind spot. Require a named list with each one's country, and a clause obliging prior notice of any change.
Assessment criterion, not a statutory requirement
5. If data has to leave Tunisia, has the Authority's authorisation been obtained?
Tunisian law makes that authorisation mandatory in all cases. A provider who does not know this is telling you something about how well it knows its own obligations.
Section 52, Organic Law no. 2004-63
6. Who, by name, has access to your data?
A list of people, not a list of departments. And the procedure that applies when someone leaves the team or the firm.
Assessment criterion, not a statutory requirement
7. What technical measures protect the data: encryption, segregation, access logging?
Tunisian law requires the security precautions actually implemented to be assessed. Ask to see them, not merely to hear about them.
Section 51, Organic Law no. 2004-63
8. Is the use of the data contractually limited to the engagement?
Tunisian law prohibits processing for purposes other than those of collection, subject to narrow exceptions. Put it in the contract rather than relying on the statute.
Sections 10 and 12, Organic Law no. 2004-63
9. Will the provider sign the contractual instrument your own law requires?
That instrument is how your obligations travel. A refusal, or hesitation, on this point settles the question.
Clause 4.1.3 of Schedule 1 to PIPEDA; Article 46 GDPR
10. In the event of a data breach, within what time will you be told, and by whom?
Your own notification clock starts when you become aware. A provider that will not commit to a deadline exposes you to being late without knowing it.
Assessment criterion, not a statutory requirement
11. Will the provider accept an audit, on documents and on site?
A written audit right is worth more than a displayed certification. And exercising it is worth more than holding it.
Assessment criterion, not a statutory requirement
12. What happens to the data at the end of the engagement?
Return in a usable format, then deletion, with a certificate. It is the question everyone forgets at the start and regrets at the end.
Assessment criterion, not a statutory requirement
See also: outsourcing to Tunisia · our accounting practice · our independence and ethics commitments · la version francaise de ce dossier.
Texts cited: Law no. 88-108 of 18 August 1988, section 8; Criminal Code, section 254; Organic Law no. 2004-63 of 27 July 2004, sections 10 to 14, 47 and 50 to 52; Convention 108 of the Council of Europe and its Additional Protocol no. 181; European Commission adequacy decisions; Personal Information Protection and Electronic Documents Act, Schedule 1, clause 4.1.3; Act respecting the protection of personal information in the private sector (Quebec), section 17. General information page. It is neither legal advice nor an opinion on your right to delegate work.