MauritiusCybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to an owner or operator of a system designated as critical information infrastructure by the National Cybersecurity Committee, in consultation with the regulatory body, under the criteria in section 33(2) of the Cybersecurity and Cybercrime Act 2021 (regulation 4(1)); the regulations apply to the financial services (banking and non-banking), public service, information and communication technology and broadcasting, and energy and water supply sectors (regulation 3), and the Committee gives public notice of each designation in the Gazette (regulation 4(2)).
- Comply with the directions that the regulatory body gives you under section 34 of the Act (regulation 5).
- Do not allow anyone other than a person authorised in writing by the regulatory authority to have access to information about the infrastructure, including its architecture, vulnerability and security aspects (regulation 6).
- Comply with these regulations within 12 months of their coming into operation on (regulation 9).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A critical information infrastructure owner who fails to comply with the regulations commits an offence and is liable on conviction to a fine not exceeding 100,000 rupees and to imprisonment for a term not exceeding 5 years (regulation 8).
Penalty structure
Regulation 8 caps the fine at 100,000 rupees and the imprisonment at 5 years for an owner who fails to comply with the regulations.
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The National Cybersecurity Committee, which designates a system as critical information infrastructure and reviews each designation every 3 years, and the regulatory body, whose directions under section 34 of the Act the owner must follow.
What this law does
Regulation 4(1) lets the National Cybersecurity Committee, in consultation with the regulatory body, designate a system as a critical information infrastructure in accordance with the criteria in section 33(2) of the Cybersecurity and Cybercrime Act 2021. The Committee must give public notice of a designation by notice published in the Gazette.
Regulation 5 requires every owner of a designated critical information infrastructure to comply with the directions of the regulatory body under section 34 of the Act. Regulation 6 bars anyone other than a person authorised in writing by the regulatory authority from access to information about a critical information infrastructure, including its architecture, vulnerability and security aspects. The Committee must review each designation every 3 years and may then maintain or revoke it.
An owner who fails to comply with the regulations commits an offence liable on conviction to a fine not exceeding 100,000 rupees and imprisonment not exceeding 5 years. Regulation 9 gives every owner of a critical information infrastructure 12 months from the coming into operation of the regulations to comply. The regulations were published in Government Gazette of Mauritius No. 45 of . They come into operation on .
When LexLint raises it
When your app profile says your app runs an essential service.