MauritiusData Protection Act 2017, rights of data subjects
Data Protection Act 2017 (Act No. 20 of 2017), ss. 37, 39-41 (rights of data subjects)
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Respond to a data subject's request for access, rectification, erasure or restriction of processing, or an objection to processing.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Sections 37 and 39 to 41 give a data subject access, rectification, erasure, restriction and objection, and let the rights be exercised through a parent, guardian or authorized person. Section 37(5) and (6) have the controller tell the data subject in writing, within one month, whether action was taken or why it was refused, and section 37(7)(b) and section 40(1) put on the controller the burden of proving that a request is manifestly excessive or that it has compelling grounds to continue processing. Those are a notice to the data subject and a burden in a dispute, and none requires the controller to make, keep or produce a record. The record of processing operations is in section 33, which this row does not cite, so nothing is borrowed from it. The row cites no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Every data subject has a right of access to their personal data, and a right to rectification, erasure or restriction of processing and to object to processing.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .