Demande d’accès

Request to Exercise the Right of Access

Organic Law No. 63 dated 27 July 2004 on the protection of personal data (GDPR equivalent):

Art. 37. “The controller of automated processing of personal data and the processor must implement the necessary technical means to enable the data subject, their heirs, or their guardian to send, electronically, their request for rectification, modification, correction, or erasure of personal data.”
Art. 32. “For the purposes of this law, the right of access means the right of the data subject, their heirs, or their guardian to consult all personal data concerning them, as well as the right to correct, complete, rectify, update, modify, clarify or deletewhen it is found to be inaccurate, ambiguous, or its processing is prohibited. The right of access also includes the right to obtain a copy of the data in clear language and in a form consistent with the content of the records, and in an intelligible format when processed by automated means.”
Art. 40. “The data subject, their heirs, or their guardian may request to rectify lpersonal data concerning themcomplete it, modify it, clarify it, update it, or delete itwhen it is inaccurate, incomplete, or ambiguous, or request its destruction when its collection or use has been carried out in violation of this law. They may also request, free of charge and after completing the required procedures, the provision of a copy of the personal data and indicate what has not been achieved regarding such data. In this case, the controller or processor must provide a copy of the requested data within a period not exceeding one month from the date the request is submitted. In the event of an explicit or implicit refusal of the request, the Authority may be seized within a period not exceeding one month from the expiry of the aforementioned deadline.”
Art. 11. “The controller must also ensure that such data is accurate, precise, and up-to-date.”
Art. 34. « “The right of access is exercised by the data subject, their heirs, or their guardian at reasonable intervals and in a non-excessive manner.”
Art. 36. “When there are several controllers of the personal data or when the processing is carried out by a processor, the right of access is exercised with each of them.”

The right of rectification allows you to correct inaccurate data concerning you (incorrect age or address) or to complete data (address without the apartment number) in relation to the purpose of the processing.

The right of access allows you to obtain a copy of the data in clear language, consistent with the content of the records, and in an intelligible form when processed by automated means.

The The law obliges the controller to communicate any corrections to other recipients of the data, unless such communication would require disproportionate effort.

Processing your personal data despite your opposition is punishable by one year’s imprisonment and a fine of 5,000 dinars.

What You Can Do

Send a letter or email to the data controller of the company. You must prove your identity, for example by:

Providing your customer or subscription number along with your name and address.

Exercising your rights via an online account in which you have previously logged in (username and password).

Only if the company has doubts about your identity may it request additional information, including a copy of an identity document. Keep a copy of your request (letter, screenshot, etc.). Request an acknowledgment of receipt to prove the date it was made. You should receive a response within one month. This period may be extended by one additional month (to a total of two months) if the request is complex, but the company must justify the extension. Silence for more than the allowed period is considered a refusal, unless an extension is justified. If you receive no response within the allotted time, an incomplete response, or a refusal, you may lodge a complaint with the INPDP in accordance with Art. 38: “If the controller or processor refuses to allow the data subject, their heirs, or their guardian to consult the requested personal data, delays access to such data, or refuses to provide them with a copy of the data, the data subject, their heirs, or their guardian may submit a request to the Authority within a maximum period of one month from the date of refusal.” »

Emailed to: inpdp@inpdp.nat.tn

Faxed to: 71 799 823

Mailed to: 1, Rue Mohamed Moalla, 1002, Mutuelleville, Tunis B.P. 525.

The Authority must issue its decision within one month from the date it is seized.

“The Authority, after hearing both parties and carrying out the necessary investigations, may order the consultation of the requested information or the provision of a copy of such information, or uphold the refusal, within a period not exceeding one month from the date it is seized. The data subject, their heirs, or their guardian may also request the Authority to take all necessary measures to prevent the destruction or concealment of personal data. The Authority must rule on the request within seven days from the date it is filed. Destruction or concealment of this data is prohibited from the moment the request is filed.”

Note:

Le modèle de demande d’exercice du droit d’accès que nous mettons à votre disposition a été rédigé à titre d’exemple.

Limiting the right of accessof the data subject, their heirs, or their guardian is only possible in the following cases:

When data processing is carried out for scientific purposes and affects the data subject’s privacy only in a limited way.
When the limitation of the right of access is intended to protect the data subject or third parties.

Attention : Le modèle de demande d’exercice du droit d’accès n’a pas vocation à se substituer à des conseils personnalisés qui pourraient vous être fournis. Il a pour objet de vous proposer une argumentation que vous jugez pertinente au regard de votre situation.

Request to Exercise the Right of Access

What You Can Do

Quick links

Contacts