MauritiusData Protection Act 2017, personal data breach notification
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify the Data Protection Commissioner without undue delay, and where feasible within 72 hours, of becoming aware of a personal data breach, giving reasons if notification is later.
- Communicate a personal data breach to the affected data subject without undue delay where it is likely to result in a high risk to their rights and freedoms, unless an exception in section 26(3) applies.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 25(1) to (3) require the controller to notify the Commissioner of a breach within 72 hours and set what the notification describes, and section 25(4) requires the controller to specify the facts of the breach, its effects and the remedial action taken so that the Commissioner can verify compliance; those facts can be specified only from a record kept of each breach, but the clause names no register or log and no contents from the log vocabulary, so the contents are left empty. The Commissioner's verification is a power exercised on its own decision, so the expectation is on request, and no period for keeping the facts is stated. Section 26 requires communication of a high-risk breach to the data subject and records nothing. The record of processing operations in section 33 is not cited by this row and is not borrowed. The row cites no territorial clause, so the hook is empty.
- Kind
- Implicit
- As of
- Provision
- Section 25(4) (facts of the breach, its effects and the remedial action, specified so the Commissioner can verify compliance)
- Trigger
- security_incident
What this law does
A controller must notify the Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, giving reasons for any later notification, and a processor must notify the controller without undue delay.
Where a breach is likely to result in a high risk to a data subject's rights and freedoms, the controller must also communicate it to the data subject without undue delay, unless the affected data was rendered unintelligible (for example by encryption), the risk has been neutralised by later measures, or individual communication would involve disproportionate effort and a public communication is made instead.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .