MauritiusData Protection Act 2017, enforcement, offences and penalties
In force since .
An enforcement supervision rule binding public and private bodies.
- Enforcement body
- Data Protection Office, headed by the Data Protection Commissioner
- Audit expectation
- none
What it requires
- Expect the Data Protection Office to be able to serve an enforcement notice requiring you to remedy a contravention within a specified period, appealable under section 51.
- Do not disclose personal data in a manner incompatible with the purpose for which it was collected, or without the prior authority of the controller or processor by whom it is kept.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
Unlawful disclosure of personal data under section 42 states no specific penalty of its own, so it falls to the Act's general penalty at section 43(1): a fine not exceeding 200,000 rupees and imprisonment for a term not exceeding 5 years, or both, for an offence under the Act with no specific penalty or any other contravention of the Act.
Penalty structure
General penalty under section 43(1) for an offence under the Act for which no specific penalty is provided, or any other contravention of the Act; imprisonment of up to 5 years may also be imposed instead of or in addition to the fine. Contravening a regulation made under section 55 carries a separate, lower general penalty of a fine not exceeding 100,000 rupees and imprisonment not exceeding 5 years.
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 200,000
What it makes you log
Logging duty
Section 9 lets the Commissioner serve an enforcement notice requiring specified steps within at least 21 days, with an appeal under section 51, and requires the controller to notify the data subject within 21 days of complying; sections 42 and 43 create the offences of unlawful disclosure and the general penalty, and sections 51 to 54 deal with appeals, the Tribunal, prosecution and the Commissioner's certificate. None of them requires a person to make, keep or produce a log or record, and the row names no audit. The Commissioner's power to require information (section 7), his power to carry out periodical audits of controllers' and processors' systems (section 46) and the record of processing operations (section 33) are outside the sections this row cites, so no audit, access party or retention value is borrowed from them. The row cites no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Where the Commissioner considers that a controller or processor has contravened, is contravening, or is about to contravene the Act, the Commissioner may serve an enforcement notice requiring specified steps within a specified period, with a right of appeal.
Unlawfully disclosing personal data outside the purpose for which it was collected, or without the controller's or processor's prior authority, is a separate offence, and any offence for which no specific penalty is provided, or any other contravention of the Act, carries a general penalty.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .