Law / Eswatini

Data Protection Act, 2022, transfer of personal information outside Eswatini

Data Protection Act, 2022, ss. 32-33 (transfer outside Eswatini)

In force since 4 Mar 2022.

A cross border transfer rule binding public and private bodies.

Obligation class: Transfer
Audit expectation: none

What it requires

Before transferring personal information to a recipient in a SADC Member State, confirm the State has transposed the SADC data protection requirements and that the transfer is necessary for a public interest task or your lawful functions, or that no reason exists to think it would prejudice the data subject's legitimate interests.
Before transferring personal information to a recipient outside a SADC Member State, confirm an adequate level of protection is ensured in the recipient's country, considering the nature of the data, the purpose and duration of the processing, and the recipient country's laws and security measures.
Where the recipient country does not ensure adequate protection, transfer personal information there only with the data subject's unambiguous consent, under a listed contractual necessity, on important public interest or legal claims grounds, or from a public register open to consultation.
Where none of the listed derogations applies, obtain the Commission's authorisation for the transfer and satisfy the Commission that adequate safeguards for privacy and fundamental rights, including contractual clauses, will be in place.
Make a provisional evaluation of the necessity of a transfer to a SADC Member State before making it, and be ready to have that necessity verified later.

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).

FINOS AIGF

AIR-PREV-007Legal and Contractual Frameworks for AI Systems

Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law

What it makes you log

Logging duty

For a transfer to a SADC member state, the controller must make a provisional evaluation of the necessity for the transfer (section 32(2)) and the recipient must ensure that the necessity can be subsequently verified (section 32(3)). Verifying a past transfer later is possible only from a record of why it was needed, so the clause carries an implied duty to keep one. The text names no field list, retention period or person who verifies, so those keys are empty. Section 33 on transfers to non-SADC countries asks for an adequacy assessment and Commission authorisation and states no record. The sections cited here name a recipient country rather than a territorial test for the Act, so the hook is empty.

Kind: Implicit
As of: 28 October 2026
Provision: Section 32(2) and (3) (a provisional evaluation of necessity by the controller, and necessity that the recipient can show was verifiable afterwards)
Trigger: personal_data_processing

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Section 32 lets personal information be transferred to a recipient in a SADC Member State that has transposed the SADC data protection requirements only where the recipient establishes that the transfer is necessary for a task carried out in the public interest or the controller's lawful functions, or establishes the necessity of the transfer with no reason to assume the data subject's legitimate interests would be prejudiced, and requires the controller to make a provisional necessity evaluation and the recipient to be able to verify that necessity later.

Section 33(1) bars transferring personal information to a recipient outside a SADC Member State, or not subject to SADC derived national law, unless an adequate level of protection is ensured in the recipient's country and the data is transferred solely to permit processing the controller was otherwise authorised to undertake, with adequacy assessed against the nature of the data, the purpose and duration of the processing, and the recipient country's laws and security measures.

Section 33(4) lets a transfer to a country outside Eswatini or SADC that lacks adequate protection proceed anyway where the data subject has unambiguously consented, where the transfer is necessary for a contract with or in the interest of the data subject, where it is necessary or legally required on important public interest grounds or for legal claims, or where it is made from a public register open to consultation.

Section 33(5) lets the Commission authorise such a transfer even without the data subject's consent where the controller satisfies the Commission that adequate safeguards for privacy and fundamental rights will be ensured, including through contractual clauses.

When LexLint raises it

When your app profile says your app processes personal data.

Back to the example · Lint your app

Page updated 19 September 2026.