MauritiusData Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026
An enforcement supervision rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Governance, Reporting
As of .
What it requires
- This binds every controller of personal data in Mauritius, and the data protection officer's tasks run to the controller's whole organisation (regulations 3 and 4).
- Designate a data protection officer from the organisation's staff; if you designate more than one, designate a lead data protection officer as the primary point of contact with the Data Protection Office and data subjects (regulation 3(1) to (3)).
- Communicate the particulars of the data protection officer or lead data protection officer to the Data Protection Office within 14 days of the designation, and notify any change in the officer's identity or particulars, with the updated particulars, within 14 days of the change (regulation 3(4)).
- Designate an officer with expert knowledge of data protection law and practice in Mauritius, the proven ability to perform the regulation 4 tasks, an understanding of your operations and sector, and evidence of certification issued by the Data Protection Office or by an accredited training institution it approves (regulation 5).
- Keep the officer's other duties free of conflict of interest, involve the officer in a timely manner in all issues of personal data protection, give the officer the resources and training needed, let the officer work independently without unlawful interference, and do not dismiss, suspend or otherwise penalise the officer for lawfully performing the duties (regulation 6).
- Publish the contact details of the data protection officer or lead data protection officer at a conspicuous place on your premises or, where applicable, on your website (regulation 8(1)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionNo
Criminal exposure note
A person who contravenes regulation 3(4) (notifying the officer's particulars and changes) or regulation 8(1) (publishing the officer's contact details) commits an offence and is liable on conviction to a fine not exceeding 100,000 rupees and to imprisonment for a term not exceeding 5 years (regulation 9).
Penalty structure
Regulation 9 caps the fine at 100,000 rupees and the imprisonment at 5 years for contravening regulation 3(4) or 8(1); no penalty is stated for the other duties in the regulations.
- Rule
- Fixed only
- As of
- Currency
- MUR
- Fixed cap
- 100,000
Who enforces it
Enforcement body
The Data Protection Office, to which the controller reports the officer's particulars and which issues the certification the officer must hold.
What this law does
Regulation 3(1) requires every controller to designate a data protection officer from a staff member of the organisation. Where a controller designates more than one data protection officer, regulation 3(3) requires it to designate a lead data protection officer, who is the primary point of contact with the Office and the data subjects.
Regulation 3(4) requires the controller to communicate the officer's particulars to the Office within 14 days of the designation, and any change in them within 14 days of the change. Regulation 4 gives the officer tasks that include the protection of data subject rights and data protection impact assessment. Regulation 4 also requires the officer to report to the highest management level of the organisation.
Regulation 5 requires the officer to be designated on the basis of professional qualifications that include evidence of certification issued by the Office or by an accredited training institution the Office approves. Regulation 6 requires the controller to ensure that the officer carries out the officer's functions independently without unlawful interference. Regulation 6 also bars the controller from dismissing, suspending or otherwise penalising the officer for lawfully performing the duties.
Regulation 8(1) requires the controller to publish the officer's contact details at a conspicuous place on its premises or on its website. Contravening regulation 3(4) or 8(1) is an offence liable on conviction to a fine not exceeding 100,000 rupees and imprisonment not exceeding 5 years. The Minister made the regulations on under section 55 of the Data Protection Act. The regulations come into operation on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot or sends automated outreach.