Duty LXD-0982
Processes personal data, in Mauritius
Each law's tag says when it binds: since in force from , in 7 weeks not yet in force
Data Protection Act 2017, special categories of personal datasince 2 lines
Data Protection Act 2017 (Act No. 20 of 2017), s. 29 (special categories of personal data) · Read the law's page
- Do not process a special category of personal data (including biometric data uniquely identifying a person) unless one of the specific grounds in section 29(1) applies, in addition to the Act's general lawful-processing requirement.
- Handle special-category health data only by or under a person bound by professional secrecy where the processing is for preventive or occupational medicine, diagnosis, or healthcare.
Data Protection Act 2017, transfer of personal data outside Mauritiussince 2 lines
Data Protection Act 2017 (Act No. 20 of 2017), s. 36 (transfer of personal data outside Mauritius) · Read the law's page
- Give the Commissioner proof of appropriate safeguards, obtain the data subject's explicit informed consent, or otherwise satisfy a condition under section 36(1), before transferring personal data outside Mauritius.
- Be prepared to demonstrate the effectiveness of your transfer safeguards to the Commissioner on request.
Data Protection Act 2017, establishment and lawful processingsince 2 lines
Data Protection Act 2017 (Act No. 20 of 2017), ss. 1-28, 30 (establishment, principles, lawful processing, and personal data of a child) · Read the law's page
- Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose that fits one of the Act's listed lawful-processing grounds.
- Obtain the consent of a child's parent or guardian, verified with reasonable effort, before processing the personal data of a child below 16.
Data Protection Act 2017, personal data breach notificationsince 2 lines
Data Protection Act 2017 (Act No. 20 of 2017), ss. 25-26 (notification and communication of personal data breach) · Read the law's page
- Notify the Data Protection Commissioner without undue delay, and where feasible within 72 hours, of becoming aware of a personal data breach, giving reasons if notification is later.
- Communicate a personal data breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, unless an exception in section 26(3) applies.
Data Protection Act 2017, rights of data subjectssince 1 line
Data Protection Act 2017 (Act No. 20 of 2017), ss. 37, 39-41 (rights of data subjects) · Read the law's page
- Respond to a data subject's request for access, rectification, erasure or restriction of processing, or an objection to processing.
Data Protection Act 2017, enforcement, offences and penaltiessince 2 lines
Data Protection Act 2017 (Act No. 20 of 2017), ss. 9, 42-43, 51-54 (enforcement, offences and penalties) · Read the law's page
- Expect the Data Protection Office to be able to serve an enforcement notice requiring you to remedy a contravention within a specified period, appealable under section 51.
- Do not disclose personal data in a manner incompatible with the purpose for which it was collected, or without the prior authority of the controller or processor by whom it is kept.
Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026from , in 7 weeks6 lines
Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 (Government Notice No. 117 of 2026), regs. 3 to 9 · Read the law's page
- This binds every controller of personal data in Mauritius, and the data protection officer's tasks run to the controller's whole organisation (regulations 3 and 4).
- Designate a data protection officer from the organisation's staff; if you designate more than one, designate a lead data protection officer as the primary point of contact with the Data Protection Office and data subjects (regulation 3(1) to (3)).
- Communicate the particulars of the data protection officer or lead data protection officer to the Data Protection Office within 14 days of the designation, and notify any change in the officer's identity or particulars, with the updated particulars, within 14 days of the change (regulation 3(4)).
- Designate an officer with expert knowledge of data protection law and practice in Mauritius, the proven ability to perform the regulation 4 tasks, an understanding of your operations and sector, and evidence of certification issued by the Data Protection Office or by an accredited training institution it approves (regulation 5).
- Keep the officer's other duties free of conflict of interest, involve the officer in a timely manner in all issues of personal data protection, give the officer the resources and training needed, let the officer work independently without unlawful interference, and do not dismiss, suspend or otherwise penalise the officer for lawfully performing the duties (regulation 6).
- Publish the contact details of the data protection officer or lead data protection officer at a conspicuous place on your premises or, where applicable, on your website (regulation 8(1)).