EswatiniData Protection Act, 2022, enforcement and offences
Data Protection Act, 2022, ss. 6, 34-43, 49-50, 52-53 (enforcement and offences)
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance, Reporting
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect the Commission to be able to warn you or issue a formal compliance notice, and, if you fail to comply, to limit, suspend or terminate your authorisation to process personal information or impose an administrative fine of up to five million Emalangeni or two percent of your annual turnover.
- Expect a data subject to be able to complain to the Commission alleging a contravention of the Act, and expect the Commission to investigate, conciliate, or take enforcement action.
- Comply with an enforcement notice the Commission serves within the period it specifies, whether to take steps or to stop processing personal information, and know that you may apply to the Commission or a court to cancel, vary, or appeal it.
- Cooperate with a Commission investigation, including giving evidence on summons and not obstructing entry and search of premises it reasonably suspects are connected with regulated activities.
- Expect a data subject to be able to bring a civil action for damages against you in a court having jurisdiction, and expect the Commission's class action system to assist data subjects in exercising that right.
- Expect criminal liability, on conviction, of a fine of up to E100,000,000 or five percent of your annual turnover, or imprisonment of up to ten years, or both, for hindering the Commission, breaching confidentiality, obstructing a warrant, or violating the Act without reasonable cause, with a juristic person's sentence served by the head of the data controller.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 53 makes it an offence to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, intentionally and unlawfully obstruct a person executing a warrant, fail without reasonable cause to assist a person executing a warrant, or violate, without reasonable cause, its obligations under the Act, subject to the determination of the Commission; it is punishable on conviction by a fine not exceeding E100,000,000 or five percent of the data controller's annual turnover, or imprisonment not exceeding ten years, or both, and where the offender is a juristic person the sentence is served by the head of the data controller.
Penalty structure
Section 53's text lists the fine, the turnover percentage, and imprisonment as alternative penalties on conviction (a fine not exceeding E100,000,000, or five percent of the data controller's annual turnover, or imprisonment not exceeding ten years, or both) without itself stating a comparison rule between the fixed and percentage figures; the higher of the two is the worst-case exposure a court could impose under either cap, not a rule the text states in those words. Separately, section 6(3)(b) lets the Commission impose a narrower administrative fine, not exceeding E5,000,000 or two percent of annual turnover, where a data controller fails to comply with a compliance notice; neither track exceeds the E100,000,000 fixed cap.
- Rule
- Higher of
- As of
- Currency
- SZL
- Fixed cap
- 100,000,000
- Turnover percentage cap
- 5
Who enforces it
Enforcement body
Eswatini Communications Commission (ESCCOM)
Settledness
- As of
- Open questions
- Does section 49(1) of the Data Protection Act, 2022, which makes a data subject's legal appeals subject to 'the exhaustion of the appeal offered through the Commission', require a data subject to complain to the Commission before bringing the civil action for damages that section 43 allows?
What it makes you log
Who may demand the log
Regulator
Logging duty
Sections 6 and 34 to 43, 49, 50, 52 and 53 cover the Commission's sanctions, complaints, investigation, enforcement notices, appeals and offences. In an investigation the Commission may compel records, enter and search premises, inspect and extract from books, documents and records, retain them, and direct a person to maintain them for a reasonable period (section 38(a) to (g)). That is a power to demand and inspect, and a direction to keep records is something the Commission may order after the fact, so the Act itself imposes no standing duty to make or keep a log here. Nothing in these sections sets a schedule or a report owed by the controller. The sections cited here carry no territorial clause, so the hook is empty.
- Kind
- None
- As of
What this law does
Section 6 lets the Commission issue a warning or a formal compliance notice to a data controller. Section 34 lets a person complain to the Commission alleging a contravention of the Act, and sections 35 to 40 give the Commission power to investigate, conciliate, decline to act on specified grounds, and inform the parties of the outcome.
Section 38 lets the Commission summon witnesses, administer oaths, receive evidence, and enter and search premises it reasonably suspects are connected with activities it regulates. Section 41 lets the Commission serve a data controller found to have contravened the Act with an enforcement notice requiring it to take specified steps or stop processing personal information within a stated period, and sections 42 and 49 let the controller apply to cancel or vary the notice or appeal it to a court.
Section 43 lets a data subject bring a civil action for damages against a data controller in a Court having jurisdiction for breach of any provision of the Act. Section 50 requires the Commission to set up a class action system to assist data subjects in exercising their rights.
Section 52 lets the Commission impose a warning as a sanction and, in a case of serious and immediate violation of individual rights, rule in summary proceedings to limit or cease processing or restrict access to the data processed.
Section 53 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate the Act's obligations without reasonable cause, punishable by a fine of up to one hundred million Emalangeni or five percent of the data controller's annual turnover, or imprisonment of up to ten years, or both, with a juristic person's sentence served by the head of the data controller.
When LexLint raises it
When your app profile says your app is a listed company or processes personal data.
Back to the example · Lint your app
Page updated .