LesothoData Protection Act, 2011, enforcement and offences
Data Protection Act, 2011, ss. 39-49, 55 (enforcement and offences)
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2024. Publisher's page: https://lesotholii.org/akn/ls/act/2012/5/eng@2012-02-22In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect a data subject to be able to complain to the Data Protection Commission alleging a contravention of the Act, and expect the Commission to investigate, conciliate, or take enforcement action.
- Comply with an enforcement notice the Commission serves within the period it specifies, whether to take steps or to stop processing personal information, and know that you may apply to the Commission or a court to cancel, vary, or appeal it.
- Cooperate with a Commission investigation, including giving evidence on summons and not obstructing execution of a warrant issued to enter and search premises.
- Expect a data subject to be able to bring a civil action for damages against you in a court having jurisdiction for breach of any provision of the Act.
- Expect criminal liability, on conviction, of a fine of up to M50,000 or imprisonment of up to five years, or both, for hindering the Commission, breaching confidentiality, obstructing a warrant, or violating the Act without reasonable cause, with a juristic person's sentence served by its Chief Executive Officer.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 55 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate any provision of the Act or its regulations without reasonable cause, punishable by a fine not exceeding M50,000 or imprisonment not exceeding five years, or both; where the offender is a juristic person, the sentence is served by the Chief Executive Officer.
Penalty structure
Section 55's closing clause sets a fine not exceeding M50,000 or imprisonment not exceeding five years, or both, for any of the offences the section lists; the text does not distinguish a different cap by offence.
- Rule
- Fixed only
- As of
- Currency
- LSL
- Fixed cap
- 50,000
Who enforces it
Enforcement body
Data Protection Commission
Settledness
- As of
- Open questions
- Does "violates any provisions of this Act" in section 55(e) of the Data Protection Act, 2011 make every breach of the Act an offence without proof of intention, when paragraphs (c) and (d) of the same section name intention and the absence of reasonable cause and paragraph (e) names neither?
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 39 to 49 and 55 let the Commission take complaints, investigate, conciliate, serve an enforcement notice and apply for a search warrant, with appeals to the courts and offences in section 55. Section 43(1)(a) lets the Commission compel a person to produce records during an investigation, which is a power to demand what exists and not a duty to keep or log anything. No section in the row requires a record to be made or kept. The row has no scope clause among its cited provisions.
- Kind
- None
- As of
What this law does
Section 39 lets a person submit a complaint to the Commission alleging a contravention of the Act or, where an approved code of conduct applies, a grievance about a determination under that code, and sections 40 to 45 give the Commission power to investigate, conciliate, decline to act on specified grounds, and inform the parties of the outcome.
Section 43 lets the Commission summon witnesses, administer oaths, receive evidence, and apply to the Magistrate Court for a warrant to enter and search premises where there are reasonable grounds to suspect a contravention or offence.
Section 46 lets the Commission serve a data controller found to have contravened the Act with an enforcement notice requiring it to take specified steps or stop processing personal information within a stated period, and sections 47 to 48 let the controller apply to cancel or vary the notice or appeal it to a court. Section 49 lets a data subject bring a civil action for damages against a data controller in a court having jurisdiction for breach of any provision of the Act.
Section 55 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate the Act's provisions without reasonable cause, punishable by a fine not exceeding M50,000 or imprisonment not exceeding five years, or both, with a juristic person's sentence served by its Chief Executive Officer.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .