EswatiniData Protection Act, 2022, sensitive personal information
Data Protection Act, 2022, ss. 22-30 (sensitive personal information)
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Prohibition, Consent, Biometric
- Audit expectation
- none
What it requires
- Do not process sensitive personal information, including genetic data, data related to children, data related to offences or criminal sentences, biometric data, or information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, gender, or health or sex life, unless a listed exemption applies.NIST Privacy FrameworkCT.PO-P1
- Obtain prior parental consent before processing personal information under the parental control exemption, and rely on consent, legal necessity, or Commission authorisation for another listed exemption to the prohibition.NIST Privacy FrameworkCT.PO-P1
- Where you process a data subject's health or sexual life information under a listed exemption and are not otherwise bound by a confidentiality duty, treat the information as confidential unless required by law or your duties to disclose it.NIST Privacy FrameworkPR.DS-P5
- Do not supply personal information about a data subject's race, trade union membership, or political affiliation to a third party without the data subject's consent, even where a listed exemption lets you process it.NIST Privacy FrameworkCT.PO-P1
- Apply to the Eswatini Communications Commission for authorisation before processing sensitive personal information in the public interest, and comply with any conditions the Commission imposes on that authorisation.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
What it makes you log
Logging duty
Section 22 prohibits processing sensitive personal information unless the Act permits it, sections 23 to 29 set the exemptions, and section 30 lets the Commission authorise processing on public-interest or clear-benefit grounds and attach conditions. None of these sections requires a controller to make, keep or produce a log or record, names an audit, or sets a period for one. The sections cited here carry no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 22 bars a data controller from processing sensitive personal information unless the Act specifically permits it.
Section 2 defines sensitive personal information to include genetic data, data related to children, data related to offences, criminal sentences or security measures, biometric data, and, where processed for what it reveals, information about racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, trade union membership, gender, and health or sex life.
Sections 23 to 28 exempt specific processing of each listed category, including processing by a spiritual or religious organisation of its own members' beliefs, processing necessary to identify a data subject or comply with the law for race, processing by a trade union of its own members for the union's aims, processing by a political institution of its own members for the institution's aims, and processing by a medical professional, healthcare institution, insurer, school, or correctional or pension body for health or sexual life.
Personal information processed under the race, trade union or political exemptions may not be supplied to a third party without the data subject's consent. A data controller permitted to process health or sexual life information who is not otherwise bound by a confidentiality duty must treat it as confidential.
Section 29 lifts the prohibition more generally where processing is carried out with prior parental consent for a child subject to parental control, where it is necessary to establish, exercise or defend a legal right, to comply with an obligation of international public law, where the Commission has authorised it in the public interest under section 30, where the data subject consents, or where the data subject has deliberately made the information public.
Section 30 lets the Commission authorise a data controller to process personal information where the public interest in the processing substantially outweighs the interference with the data subject's privacy, or where the processing carries a clear benefit to the data subject or a third party that substantially outweighs that interference, subject to any conditions the Commission imposes.
When LexLint raises it
When your app profile says your app processes biometric data, serves under-18s, handles health records or processes personal data.
Back to the example · Lint your app
Page updated .