Tunisia Law 2004-63 and AI: the challenge for offshore developers

In Tunis, Sousse or Sfax, many developers spend their days working on code for European banks, insurers and software vendors. Over the past two years their workstation has changed: an AI coding assistant completes functions, a command line agent runs the tests, a chatbot explains a production error. The productivity gains are real, and clients expect them.

But a code repository holds far more than code. It contains API keys, connection strings and test datasets copied from production. When these reach an AI model, they leave the scope set out in the contract. In Tunisia, the question sits where two texts meet: Organic Law No. 2004-63 and the GDPR that binds European clients.

An offshore model built on trust

Tunisia has become a nearshore destination for French speaking Europe. Many French companies have teams or subsidiaries there, often in software development, application maintenance, testing or cybersecurity. Close time zones, shared language and well trained local engineers are the country's strengths. For an IT services firm, losing a major client's trust after an incident costs far more than any tool.

The model rests on one promise: the client's data stays under control. Yet AI development tools have spread faster than security policies. A developer can connect an agent to an entire repository in minutes, without the client's security officer ever knowing.

What Organic Law 2004-63 says

Tunisia adopted a personal data law very early. Organic Law No. 2004-63 of 27 July 2004 gives oversight to the National Authority for the Protection of Personal Data (INPDP). Several obligations apply directly to AI use:

• prior declaration of any processing of personal data to the INPDP;

• authorization for certain sensitive data, such as health data;

• a ban on disclosing data to third parties without consent;

• transfers abroad, which require the Authority's authorization and are prohibited if they could harm public security.

The penalties are not theoretical. The law provides for prison terms and fines, and the Tunisian press reported that in July 2023 the Authority referred around thirty files to the public prosecutor for failure to declare.

A reform under debate in Parliament

The 2004 law is showing its age, especially when it comes to AI. A 132 article organic bill is being examined by the Assembly of the Representatives of the People. On 17 February 2026, the rights and freedoms committee heard its sponsors. The text covers the use of AI, the right not to be subject to a fully automated decision, impact assessments for high risk processing, a data protection officer and tougher financial penalties.

The bill has not been adopted and its content may change. The direction, however, is clear: companies that document their AI use now will be ahead. Tunisia also acceded in 2017 to the Council of Europe's Convention 108 on data protection.

The GDPR arrives through contracts

Tunisia does not have an adequacy decision from the European Commission. European clients therefore bind their Tunisian providers through standard contractual clauses and processing agreements. These contracts list the approved tools and sub-processors. An unapproved AI assistant plugged into a repository containing personal data creates a gap the client's auditor will find sooner or later. Our EU AI Act and GDPR compliance checklist sums up what those audits check.

Where data leaks in a development team

The risks are specific to the job. The most common ones:

1. a configuration file with API keys or passwords read by a command line agent;

2. an extract of a production database, with names and account numbers, pasted to debug a query;

3. application logs containing email addresses sent to a chatbot to analyze an error;

4. an MCP server that gives the agent broad access to the client's internal tools.

We cover these scenarios in how CLI AI tools leak your secrets and in why MCP needs its own DLP. Classic network tools do not see these flows, as we explain in why traditional DLP fails on ChatGPT.

What Tunisian IT services firms can do

• list the AI assistants and agents actually used on each project;

• agree on these uses with every client and write them into contracts;

• declare the relevant processing to the INPDP and check the rules that apply to transfers;

• detect and mask secrets and personal data before they reach a model;

• keep an incident log, useful for clients and for the Authority alike.

None of this slows teams down. It lets them answer client security questionnaires, which ask more and more about AI, with confidence, and it turns compliance into a selling point against other offshore destinations.

In summary

Tunisia's offshore sector lives on the trust of its clients. Law 2004-63 and the INPDP already govern processing and transfers, a stricter reform is under debate, and the GDPR applies through contracts. AI coding assistants are here to stay. They simply need to see only what they are meant to see.

ZeusLock detects and anonymizes secrets and personal data in prompts, files and AI tools, directly on the developer's machine, and keeps a record of every incident. Book a demo to protect your development teams.