LesothoData Protection Act, 2011 (Act No. 5 of 2012)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Consent, Governance, Retention, Security
- Audit expectation
- none
What it requires
- Obtain a lawful basis, such as the data subject's explicit consent, contractual necessity, compliance with a legal obligation, or another listed ground, before processing personal information of an identifiable individual, whether by automated or non-automated means.NIST Privacy FrameworkCT.PO-P1
- Notify the Data Protection Commission of your processing of personal information before you process it, and again whenever the particulars you notified change.NIST Privacy FrameworkGV.PO-P5
- Collect personal information only for a specified, explicit and legitimate purpose, and do not further process it in a way incompatible with that purpose.NIST Privacy FrameworkGV.PO-P1
- Take appropriate, reasonable technical measures to secure the integrity of personal information in your possession or under your control against loss, damage, unauthorised destruction or unlawful access, and govern any agent who processes information on your behalf by a written contract that requires the same measures.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P3
- Destroy, delete or de-identify a record of personal information as soon as reasonably practicable after you are no longer authorised to retain it, in a manner that prevents its reconstruction.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- GV.SC-05Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Log retention
Processing that departs from what was notified must be recorded and kept for at least three years (section 53(5)). The period is a floor and the Act sets no ceiling.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
Section 53 makes a controller notify the Commission of its processing, and subsection (5) requires any processing that departs from the notified purposes, data subjects, information, recipients, transfers or security description to be recorded and kept for at least three years. The Commission keeps its own register of notified processing (subsection (7)), which is the Commission's record rather than the controller's. The section names the departure as the content, which the vocabulary has no value for, and names no one who audits the record. Section 8(1)(g) lets the Commission audit personal information a controller maintains, which reaches the data and not this record, so audit is left at none. Section 19 limits how long records of personal information are kept; that is storage limitation of the data and is not coded as a retention period for a log. Section 20 asks the controller to verify its safeguards regularly, a check on safeguards that names no record. For jurisdiction, section 3(a) applies the Act to a controller domiciled or with its principal place of business in Lesotho; the section 3(b) prong, which turns on a foreign controller using means in Lesotho, has no hook value and is left out.
- Kind
- Explicit
- As of
- Provision
- Section 53(5), within sections 1 to 22, 24, 28, 38 and 53 to 57
- Trigger
- personal_data_processing
What this law does
The Data Protection Act, 2011 (Act No. 5 of 2012) establishes the Data Protection Commission and applies to a data controller domiciled or having its principal place of business in Lesotho, and to a controller outside Lesotho that uses automated or non-automated means in Lesotho or uses such means only for forwarding personal information (s. 3), subject to exemptions for purely personal or household activity, de-identified information, specified State national security, defence or public safety functions, and journalistic, artistic or literary expression necessary to reconcile privacy with freedom of expression (s. 4).
Personal information may be processed only where the data subject gives explicit consent, the processing is necessary for a contract, a legal obligation, the data subject's legitimate interests, a public body's public law duty, or the legitimate interests of the controller or a third party, and personal information must be adequate, relevant and not excessive for the purpose for which it is processed (ss. 15-16).
A data controller must collect personal information directly from the data subject except in listed circumstances, and must collect it for a specified, explicit and legitimate purpose and not further process it in a way incompatible with that purpose (ss. 17-18).
Records of personal information may not be retained longer than a prescribed period absent a listed ground, and a data controller must destroy, delete or de-identify a record as soon as reasonably practicable once no longer authorised to retain it, in a manner that prevents its reconstruction (s. 19).
A data controller must take appropriate, reasonable technical measures to secure the integrity of personal information against loss, damage, unauthorised destruction and unlawful access, and govern any agent who processes information on its behalf by a written contract requiring the same confidentiality and security measures (ss. 20-22).
A data controller must take reasonably practicable steps to keep personal information complete, accurate, not misleading and up to date, and must ensure the Act's principles are complied with (ss. 24, 28). The further processing of personal information for historical, statistical or research purposes is exempt from every principle except security safeguards and information quality, provided the data controller establishes appropriate safeguards against other use (s. 38).
A data controller must notify the Commission of its processing of personal information before processing it and again whenever material particulars change, the Commission may issue, approve, amend or revoke codes of conduct, and the Minister may make regulations to give effect to the Act (ss. 53-54, 56).
A person already processing personal information when the Act commenced had two years, extendable to three by the Minister, to bring that processing into conformity with the Act and notify the Commission (s. 57).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .