Processes personal data, in Eswatini

Data Protection Act, 2022 (Act No. 5 of 2022), ss. 1-5, 7-16, 18, 21, 31, 46-48, 54-55 (general processing principles) · Read the law's page

• Obtain a lawful basis, such as the data subject's explicit consent, contractual necessity, compliance with a legal obligation, or another listed ground, before processing personal information of an identifiable individual, whether by automated or non-automated means.
• Notify the Eswatini Communications Commission of your processing of personal information before you process it, and again whenever the particulars you notified change.
• Collect personal information only for a specified, explicit and legitimate purpose, and do not further process it in a way incompatible with that purpose.
• Take appropriate, reasonable technical and administrative measures to secure the integrity of personal information in your possession or under your control against loss, modification, damage, unauthorised destruction or unlawful access, and govern any data processor who processes information on your behalf by a written contract that requires the same measures.
• Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.

Data Protection Act, 2022, s. 17 (notification of security compromises) · Read the law's page

• Notify the Eswatini Communications Commission and the affected data subject as soon as reasonably possible after discovering that a data subject's personal information has been accessed or acquired by an unauthorised person, unless the data subject's identity cannot be established.
• Take into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise when timing your notification, but do not use that as a reason to delay beyond what is reasonably possible.
• Delay notification to the data subject only where the Police or the Commission determines that notification would impede a criminal investigation.
• Communicate the notification to the data subject in writing, by mail, email, a prominent website posting, publication in the news media, or as the Commission directs, and include enough information to let the data subject take protective measures, including the identity of the unauthorised person if known.
• Publicise the compromise in the manner the Commission specifies, where the Commission has reasonable grounds to believe publicity would protect an affected data subject.

Data Protection Act, 2022, ss. 19-20, 44, 51 (rights of data subjects) · Read the law's page

• Confirm free of charge, on request from a data subject who proves their identity, whether you hold personal information about them, and provide it in a reasonable manner, format and prescribed time.
• Give a data subject written reasons where you deny an access request, and let them challenge those reasons.
• Correct, destroy, or delete personal information on a data subject's request within fourteen days where it is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or unlawfully obtained, and tell anyone the changed information was disclosed to within seven working days of the correction where it affects a decision about the data subject.
• Stop processing a data subject's personal information for direct marketing as soon as they give you notice requiring you to cease or not begin such processing.
• If you operate a whistleblowing system, preserve fairness, proportionality and openness about its scope and purpose, and inform a person implicated in a report as soon as possible of the report's existence and the facts alleged.
• Let a person implicated in a whistleblowing report exercise their rights of access, rectification and deletion, but do not give them access to a third party's personal data without that third party's express written consent.

Data Protection Act, 2022, ss. 22-30 (sensitive personal information) · Read the law's page

• Do not process sensitive personal information, including genetic data, data related to children, data related to offences or criminal sentences, biometric data, or information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, gender, or health or sex life, unless a listed exemption applies.
• Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.
• Where you process a data subject's health or sexual life information under a listed exemption and are not otherwise bound by a confidentiality duty, treat the information as confidential unless required by law or your duties to disclose it.
• Do not supply personal information about a data subject's race, trade union membership, or political affiliation to a third party without the data subject's consent, even where a listed exemption lets you process it.
• Apply to the Eswatini Communications Commission for authorisation before processing sensitive personal information in the public interest, and comply with any conditions the Commission imposes on that authorisation.

Data Protection Act, 2022, ss. 32-33 (transfer outside Eswatini) · Read the law's page

• Before transferring personal information to a recipient in a SADC Member State, confirm the State has transposed the SADC data protection requirements and that the transfer is necessary for a public interest task or your lawful functions, or that no reason exists to think it would prejudice the data subject's legitimate interests.
• Before transferring personal information to a recipient outside a SADC Member State, confirm an adequate level of protection is ensured in the recipient's country, considering the nature of the data, the purpose and duration of the processing, and the recipient country's laws and security measures.
• Where the recipient country does not ensure adequate protection, transfer personal information there only with the data subject's unambiguous consent, under a listed contractual necessity, on important public interest or legal claims grounds, or from a public register open to consultation.
• Where none of the listed derogations applies, obtain the Commission's authorisation for the transfer and satisfy the Commission that adequate safeguards for privacy and fundamental rights, including contractual clauses, will be in place.
• Make a provisional evaluation of the necessity of a transfer to a SADC Member State before making it, and be ready to have that necessity verified later.

Data Protection Act, 2022, ss. 6, 34-43, 49-50, 52-53 (enforcement and offences) · Read the law's page

• Expect the Commission to be able to warn you or issue a formal compliance notice, and, if you fail to comply, to limit, suspend or terminate your authorisation to process personal information or impose an administrative fine of up to five million Emalangeni or two percent of your annual turnover.
• Expect a data subject to be able to complain to the Commission alleging a contravention of the Act, and expect the Commission to investigate, conciliate, or take enforcement action.
• Comply with an enforcement notice the Commission serves within the period it specifies, whether to take steps or to stop processing personal information, and know that you may apply to the Commission or a court to cancel, vary, or appeal it.
• Cooperate with a Commission investigation, including giving evidence on summons and not obstructing entry and search of premises it reasonably suspects are connected with regulated activities.
• Expect a data subject to be able to bring a civil action for damages against you in a court having jurisdiction, and expect the Commission's class action system to assist data subjects in exercising that right.
• Expect criminal liability, on conviction, of a fine of up to E100,000,000 or five percent of your annual turnover, or imprisonment of up to ten years, or both, for hindering the Commission, breaching confidentiality, obstructing a warrant, or violating the Act without reasonable cause, with a juristic person's sentence served by the head of the data controller.