MauritiusData Protection Act 2017, transfer of personal data outside Mauritius
Data Protection Act 2017 (Act No. 20 of 2017), s. 36 (transfer of personal data outside Mauritius)
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Give the Commissioner proof of appropriate safeguards, obtain the data subject's explicit informed consent, or otherwise satisfy a condition under section 36(1), before transferring personal data outside Mauritius.NIST Privacy FrameworkCT.PO-P2
- Be prepared to demonstrate the effectiveness of your transfer safeguards to the Commissioner on request.NIST Privacy FrameworkGV.MT-P3
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P3Policies, processes, and procedures for assessing compliance with legal requirements and privacy policies are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 36 lets a controller or processor transfer personal data abroad only on a listed ground, which includes having provided the Commissioner with proof of appropriate safeguards (section 36(1)(a) and (c)(vi)(B)), and section 36(4) lets the Commissioner request a person who transfers data to demonstrate the effectiveness of the safeguards or the existence of compelling legitimate interests and prohibit, suspend or condition the transfer. The proof supplied to the Commissioner is a filing and the section 36(4) power is a power to demand a demonstration, with no record named, so no logging duty is stated; the Commissioner acts when it chooses to. Section 33(2)(e), which requires the record of processing operations to list transfers and their safeguards, is not cited by this row and is not borrowed. The row cites no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
A controller or processor may transfer personal data to another country only where it has given the Commissioner proof of appropriate safeguards, the data subject has given explicit informed consent, the transfer is necessary for a contract or legal claim, or another listed condition applies. The Commissioner may require a person transferring data to demonstrate the effectiveness of its safeguards and may prohibit, suspend or condition a transfer to protect data subjects' rights.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .