Processes personal data, in Lesotho

Data Protection Act, 2011 (Act No. 5 of 2012), ss. 1-22, 24, 28, 38, 53-54, 56-57 (general processing principles) · Read the law's page

• Obtain a lawful basis, such as the data subject's explicit consent, contractual necessity, compliance with a legal obligation, or another listed ground, before processing personal information of an identifiable individual, whether by automated or non-automated means.
• Notify the Data Protection Commission of your processing of personal information before you process it, and again whenever the particulars you notified change.
• Collect personal information only for a specified, explicit and legitimate purpose, and do not further process it in a way incompatible with that purpose.
• Take appropriate, reasonable technical measures to secure the integrity of personal information in your possession or under your control against loss, damage, unauthorised destruction or unlawful access, and govern any agent who processes information on your behalf by a written contract that requires the same measures.
• Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

Data Protection Act, 2011, s. 23 (notification of security compromises) · Read the law's page

• Notify the Data Protection Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established.
• Take into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise when timing your notification, but do not use that as a reason to delay beyond what is reasonably possible.
• Delay notification to the data subject only where the Lesotho Mounted Police Service, the National Security Service, or the Commission determines that notification would impede a criminal investigation.
• Communicate the notification to the data subject in writing, by mail, email, a prominent website posting, publication in the news media, or as the Commission directs, and include enough information to let the data subject take protective measures, including the identity of the unauthorised person if known.
• Publicise the compromise in the manner the Commission specifies, where the Commission has reasonable grounds to believe publicity would protect an affected data subject.

Data Protection Act, 2011, s. 52 (transfer outside Lesotho) · Read the law's page

• Before transferring personal information about a data subject to a third party in a foreign country, confirm the recipient is subject to a law, code of conduct, or contract that effectively upholds processing principles substantially similar to this Act's, including onward-transfer protections, or rely on another listed condition.
• Obtain the data subject's consent to the transfer where you do not rely on the recipient's equivalent legal protection.
• Where the transfer is necessary for performance of a contract between you and the data subject, or a contract concluded in the data subject's interest with a third party, you may transfer without separately meeting the equivalent-protection condition.
• Where the transfer is for the data subject's benefit and it is not reasonably practicable to obtain consent, confirm the data subject would likely consent if asked before proceeding.

Data Protection Act, 2011, ss. 25-27, 50 (rights of data subjects) · Read the law's page

• Give a data subject notice, before or as soon as practicable after collecting personal information about them, of your name and address, the purpose of the collection, whether supply is mandatory, and the consequences of not providing it.
• Confirm free of charge, on request from a data subject who proves their identity, whether you hold personal information about them, and provide it in a reasonable manner, format and prescribed time.
• Give a data subject written reasons where you deny an access request, and let them challenge those reasons.
• Correct, destroy, or delete personal information on a data subject's request within 14 days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within 7 working days of the correction where it affects a decision about the data subject.
• Stop processing a data subject's personal information for direct marketing as soon as they give you notice requiring you to cease or not begin such processing.

Data Protection Act, 2011, ss. 29-37 (sensitive personal information) · Read the law's page

• Do not process personal information concerning a child who is subject to parental control, or a data subject's spiritual, religious or philosophical beliefs, race or ethnic origin, trade union membership, political affiliation, health, sexual life, or criminal behaviour, unless a listed exemption applies.
• Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.
• Where you process a data subject's health or sexual life information under a listed exemption and are not otherwise bound by a confidentiality duty, treat the information as confidential unless required by law or your duties to disclose it.
• Do not supply personal information about a data subject's spiritual, religious or philosophical beliefs, race, trade union membership, or political affiliation to a third party without the data subject's consent, even where a listed exemption lets you process it.
• Apply to the Data Protection Commission for authorisation before processing sensitive personal information in the public interest, and comply with any conditions the Commission imposes on that authorisation.

Data Protection Act, 2011, ss. 39-49, 55 (enforcement and offences) · Read the law's page

• Expect a data subject to be able to complain to the Data Protection Commission alleging a contravention of the Act, and expect the Commission to investigate, conciliate, or take enforcement action.
• Comply with an enforcement notice the Commission serves within the period it specifies, whether to take steps or to stop processing personal information, and know that you may apply to the Commission or a court to cancel, vary, or appeal it.
• Cooperate with a Commission investigation, including giving evidence on summons and not obstructing execution of a warrant issued to enter and search premises.
• Expect a data subject to be able to bring a civil action for damages against you in a court having jurisdiction for breach of any provision of the Act.
• Expect criminal liability, on conviction, of a fine of up to M50,000 or imprisonment of up to five years, or both, for hindering the Commission, breaching confidentiality, obstructing a warrant, or violating the Act without reasonable cause, with a juristic person's sentence served by its Chief Executive Officer.