MauritiusData Protection Act 2017, automated individual decision making
Data Protection Act 2017 (Act No. 20 of 2017), s. 38 (automated individual decision making)
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Do not base a decision producing a legal or similarly significant effect on a data subject solely on automated processing, including profiling, unless a listed exception (contractual necessity, a safeguarded legal authorisation, or the data subject's explicit consent) applies.
- Do not base automated processing intended to evaluate personal aspects of an individual on special categories of personal data.
These lines are LexLint's reading of the law's text. Also read by: FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services (guidance from the Financial Services Commission of Mauritius).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What record it asks for
Logging duty
Section 38 gives the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effect, lists the exceptions (contract, authorizing law, explicit consent), bars basing evaluation on special categories, and requires suitable safeguards where the contract or consent exception applies (section 38(5)). The safeguards are measures to protect the person and the clause does not require the controller to log, record or document the decisions or their basis. The record of processing operations is in section 33, which this row does not cite. The row cites no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 38 gives every data subject a right not to be subject to a decision based solely on automated processing, including profiling, that produces a legal effect or significantly affects them, unless the decision is necessary for a contract with them, is authorized by a law with safeguards, or rests on their explicit consent. Any automated processing intended to evaluate personal aspects of an individual must not be based on special categories of personal data.
Where one of the three exceptions applies, the controller's information notice under section 23 must disclose that this kind of decision-making exists and what effects it is expected to have. Where the exception is the contract or the consent ground specifically, the controller must also implement suitable measures to safeguard the data subject's rights, freedoms and legitimate interests.
Guidance on this law
How the bodies that enforce this law read it. Guidance binds nobody by itself, so LexLint never raises a finding from it; the duty is this law's.
- FSC Fintech Series Guidance Notes 4, responsible use of artificial intelligence in financial services, the Financial Services Commission of Mauritius
When LexLint raises it
When your app profile says your app makes high-risk automated decisions.
Back to the example · Lint your app
Page updated .