MauritiusData Protection Act 2017, establishment and lawful processing
In force since .
A comprehensive regime rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- none
What it requires
- Process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose that fits one of the Act's listed lawful-processing grounds.
- Obtain the consent of a child's parent or guardian, verified with reasonable effort, before processing the personal data of a child below 16.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A person who processes personal data without a lawful ground under section 28(1) commits an offence and is liable on conviction to a fine not exceeding 100,000 rupees and to imprisonment for a term not exceeding 5 years (s. 28(2)).
Penalty structure
Fine only under section 28(2); the same subsection also allows imprisonment of up to 5 years instead of or in addition to the fine, for processing personal data without a lawful ground under section 28(1).
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 100,000
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Section 22(2)(b) lists keeping a record of all processing operations among the measures a controller must take to ensure and be able to demonstrate lawful processing, and section 24(1) puts the burden of proving a data subject's consent on the controller, which can be met only from a record of the consent. The record's contents, its availability to the Data Protection Office on request and the time limits for erasure are in section 33, which the row does not cite, so no access party, audit or retention value is stated here; section 22(3) asks the controller for policies and mechanisms to verify the effectiveness of its measures, with no schedule or outside checker. Sections 27 and 21(e) limit how long the personal data are kept, which concerns the data and not a log. Section 3(5)(a) applies the Act to a controller or processor established in Mauritius and processing in the context of that establishment; the second limb, section 3(5)(b), turns on where the equipment used is located and has no hook value, so it is left out.
- Kind
- Explicit
- As of
- Provision
- Section 22(2)(b) (keeping a record of all processing operations), with section 24(1) (burden of proving consent)
- Trigger
- personal_data_processing
- consent_or_optout
What this law does
The Data Protection Act 2017 establishes the Data Protection Office, headed by the Data Protection Commissioner, and requires every controller or processor to process personal data lawfully, fairly and transparently, only for an explicit and legitimate purpose.
Processing must rest on one of a listed set of grounds, including the data subject's consent, contractual necessity, a legal obligation, or the controller's legitimate interests, and a contravention of this lawful-processing duty is itself an offence. No person may process the personal data of a child below 16 unless the child's parent or guardian has consented, and the controller must make a reasonable effort to verify that consent, taking into account available technology.
When LexLint raises it
When your app profile says your app serves under-18s or processes personal data.
Back to the example · Lint your app
Page updated .