MauritiusData Protection Act 2017, special categories of personal data
Data Protection Act 2017 (Act No. 20 of 2017), s. 29 (special categories of personal data)
In force since .
A sensitive categories rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not process a special category of personal data (including biometric data uniquely identifying a person) unless one of the specific grounds in section 29(1) applies, in addition to the Act's general lawful-processing requirement.NIST Privacy FrameworkCT.PO-P1
- Handle special-category health data only by or under a person bound by professional secrecy where the processing is for preventive or occupational medicine, diagnosis, or healthcare.NIST Privacy FrameworkPR.AC-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Criminal exposure note
A person who contravenes the special-categories processing restriction commits an offence and is liable on conviction to a fine not exceeding 100,000 rupees and to imprisonment for a term not exceeding 5 years (s. 29(3)).
Penalty structure
Fine only under section 29(3); the same subsection also allows imprisonment of up to 5 years instead of or in addition to the fine.
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 100,000
What it makes you log
Logging duty
Section 29 allows special categories of personal data to be processed only where section 28 applies and one of the listed grounds is met, and limits health data processing to a person bound by professional secrecy; section 29(3) makes a contravention an offence. It states no duty to make, keep or produce a log or record. The record of processing operations is in section 33 and the accountability duty in section 22, which this row does not cite, and neither is borrowed here. The row cites no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Special categories of personal data, defined to include racial or ethnic origin, political opinion, religious or philosophical belief, trade union membership, physical or mental health, sexual orientation, and genetic or biometric data uniquely identifying a person, may be processed only on a specific ground: the general lawful-processing test plus a not-for-profit body's legitimate activity with appropriate safeguards, data manifestly made public by the data subject, or necessity for a legal claim, healthcare, carrying out an obligation or exercising a right of the controller or the data subject, or protecting vital interests.
Health data processed for preventive or occupational medicine or healthcare must be handled by or under a person bound by professional secrecy.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .