Eswatini

Section 17(1) requires a data controller, on reasonable grounds to believe a data subject's personal information has been accessed or acquired by an unauthorised person, to notify the Commission and the data subject unless the data subject's identity cannot be established.

Section 17(2) requires that notification to be made as soon as reasonably possible after discovery of the compromise, taking into account the legitimate needs of law enforcement and any measures reasonably necessary to determine the scope of the compromise and restore the integrity of the controller's information system.

Section 17(3) requires the controller to delay notification to the data subject where the Police or the Commission determines that notification would impede a criminal investigation.

Section 17(4) requires the notification to the data subject to be in writing, delivered by post, email, a prominent website posting, publication in the news media, or another method the Commission directs, and section 17(5) requires it to contain enough information for the data subject to take protective measures, including the identity of the unauthorised person if known.

Section 17(6) lets the Commission direct a data controller to publicise a compromise where the Commission has reasonable grounds to believe publicity would protect an affected data subject.

The Data Protection Act, 2022 (Act No. 5 of 2022) applies to a data controller or data processor, whether or not domiciled in Eswatini, that uses automated or non-automated means in Eswatini to process personal information, and to processing performed wholly or partly by automated means (s. 3), subject to exemptions for purely personal or household activity, de-identified information, and specified State functions such as national security, defence and public safety (s. 4).

The Eswatini Communications Commission administers the Act, promotes compliance, investigates complaints, audits data controllers, and issues codes of conduct and guidelines, and its employees are immune from civil or criminal liability for anything done in good faith in the exercise of the Commission's powers, subject to a duty to treat information they learn as confidential (ss. 5, 7-8).

Personal information may be processed only where the data subject gives explicit consent, the processing is necessary for a contract, a legal obligation, the data subject's legitimate interests, a public body's public law duty, or the legitimate interests of the controller or a third party, and personal information must be adequate, relevant and not excessive for the purpose for which it is processed (s. 9).

A data controller must collect personal information directly from the data subject except in listed circumstances, give the data subject notice of the collection's purpose and particulars, and collect it for a specified, explicit and legitimate purpose that further processing may not depart from (ss. 10-12).

Records of personal information may not be retained longer than a prescribed period absent a listed ground, and a data controller must destroy, delete or de-identify a record as soon as reasonably practicable once no longer authorised to retain it, in a manner that prevents its reconstruction (s. 13).

A data controller must take appropriate, reasonable technical and administrative measures to secure the integrity of personal information against loss, modification, damage, unauthorised destruction and unlawful access, and govern any data processor who processes information on its behalf by a written contract requiring the same confidentiality and security measures (ss. 14-16).

A data controller must take reasonably practicable steps to keep personal information complete, accurate, not misleading and up to date, and must ensure the Act's principles are complied with and demonstrable to data subjects and the Commission (ss. 18, 21).

The processing of personal information for historical, statistical or research purposes is exempt from every principle except security safeguards, information quality and de-identification for research purposes, provided the data controller establishes appropriate safeguards against other use (s. 31).

A data controller must notify the Commission of its processing of personal information before processing it and again whenever material particulars change, the Commission may issue, approve, amend or revoke codes of conduct, the head of a data controller may designate a Data Protection Officer to discharge the controller's duties under the Act, and the Minister may make regulations to give effect to the Act (ss. 46-48, 54).

A person already processing personal information when the Act commenced had two years, extendable to three by the Minister, to bring that processing into conformity with the Act and notify the Commission (s. 55).

Section 32 lets personal information be transferred to a recipient in a SADC Member State that has transposed the SADC data protection requirements only where the recipient establishes that the transfer is necessary for a task carried out in the public interest or the controller's lawful functions, or establishes the necessity of the transfer with no reason to assume the data subject's legitimate interests would be prejudiced, and requires the controller to make a provisional necessity evaluation and the recipient to be able to verify that necessity later.

Section 33(1) bars transferring personal information to a recipient outside a SADC Member State, or not subject to SADC derived national law, unless an adequate level of protection is ensured in the recipient's country and the data is transferred solely to permit processing the controller was otherwise authorised to undertake, with adequacy assessed against the nature of the data, the purpose and duration of the processing, and the recipient country's laws and security measures.

Section 33(4) lets a transfer to a country outside Eswatini or SADC that lacks adequate protection proceed anyway where the data subject has unambiguously consented, where the transfer is necessary for a contract with or in the interest of the data subject, where it is necessary or legally required on important public interest grounds or for legal claims, or where it is made from a public register open to consultation.

Section 33(5) lets the Commission authorise such a transfer even without the data subject's consent where the controller satisfies the Commission that adequate safeguards for privacy and fundamental rights will be ensured, including through contractual clauses.

Section 45(1) bars subjecting a person to a decision that has a legal effect on them, or significantly affects them, when the decision is based solely on the automated processing of their personal information to profile their personality or habits.

The bar does not apply where the decision is taken in connection with entering into or performing a contract and either the data subject's request under that contract has been met or appropriate measures let the data subject learn about the decision and make representations on it, or where the decision is governed by a law, code or body of scientific proof or facts specifying the same protective measures.

Section 19 gives a data subject who proves their identity the right to request free confirmation of whether a controller holds personal information about them and to request that information, including the identity of third parties who have had access to it, and gives a right to written reasons and a right to challenge those reasons where a request is denied.

Section 20 gives a data subject a free right to have inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained personal information corrected or deleted, requires the controller to answer the request within fourteen days, and requires the controller to tell every party the changed information had been disclosed to within seven working days where a correction affects a decision about the data subject.

Section 44 entitles a data subject to require a controller by notice to cease, or not begin, processing their personal data for direct marketing, and lets the Commission order compliance where the controller fails to observe that notice.

Section 51 requires a data controller that operates a whistleblowing system to preserve fairness, proportionality and openness about the scope, purpose and consequences of reporting, and requires a person implicated in a report to be informed as soon as possible of the report's existence and the facts alleged, with a right of access, rectification and deletion that does not extend to a third party's personal data without that person's express written consent.

Section 6 lets the Commission issue a warning or a formal compliance notice to a data controller. Section 34 lets a person complain to the Commission alleging a contravention of the Act, and sections 35 to 40 give the Commission power to investigate, conciliate, decline to act on specified grounds, and inform the parties of the outcome.

Section 38 lets the Commission summon witnesses, administer oaths, receive evidence, and enter and search premises it reasonably suspects are connected with activities it regulates. Section 41 lets the Commission serve a data controller found to have contravened the Act with an enforcement notice requiring it to take specified steps or stop processing personal information within a stated period, and sections 42 and 49 let the controller apply to cancel or vary the notice or appeal it to a court.

Section 43 lets a data subject bring a civil action for damages against a data controller in a Court having jurisdiction for breach of any provision of the Act. Section 50 requires the Commission to set up a class action system to assist data subjects in exercising their rights.

Section 52 lets the Commission impose a warning as a sanction and, in a case of serious and immediate violation of individual rights, rule in summary proceedings to limit or cease processing or restrict access to the data processed.

Section 53 makes it an offence, on conviction, to hinder, obstruct or unlawfully influence the Commission, breach confidentiality rules made under the Act, obstruct execution of a warrant, or violate the Act's obligations without reasonable cause, punishable by a fine of up to one hundred million Emalangeni or five percent of the data controller's annual turnover, or imprisonment of up to ten years, or both, with a juristic person's sentence served by the head of the data controller.

Section 22 bars a data controller from processing sensitive personal information unless the Act specifically permits it.

Section 2 defines sensitive personal information to include genetic data, data related to children, data related to offences, criminal sentences or security measures, biometric data, and, where processed for what it reveals, information about racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, trade union membership, gender, and health or sex life.

Sections 23 to 28 exempt specific processing of each listed category, including processing by a spiritual or religious organisation of its own members' beliefs, processing necessary to identify a data subject or comply with the law for race, processing by a trade union of its own members for the union's aims, processing by a political institution of its own members for the institution's aims, and processing by a medical professional, healthcare institution, insurer, school, or correctional or pension body for health or sexual life.

Personal information processed under the race, trade union or political exemptions may not be supplied to a third party without the data subject's consent. A data controller permitted to process health or sexual life information who is not otherwise bound by a confidentiality duty must treat it as confidential.

Section 29 lifts the prohibition more generally where processing is carried out with prior parental consent for a child subject to parental control, where it is necessary to establish, exercise or defend a legal right, to comply with an obligation of international public law, where the Commission has authorised it in the public interest under section 30, where the data subject consents, or where the data subject has deliberately made the information public.

Section 30 lets the Commission authorise a data controller to process personal information where the public interest in the processing substantially outweighs the interference with the data subject's privacy, or where the processing carries a clear benefit to the data subject or a third party that substantially outweighs that interference, subject to any conditions the Commission imposes.

Section 3(1) makes it an offence, without needing to defeat any security measure, for a person to intentionally access the whole or any part of a computer system "without lawful excuse or justification," carrying a fine of up to E300,000 or imprisonment of up to three years, or both; "access" is defined at s. 2, in relation to this section only, as "logging into a computer system," so a plain reading does not reach merely retrieving a public, unauthenticated page without logging in.

Section 3(2) raises the penalty to a fine of up to E500,000 or imprisonment of up to five years, or both, where the person accessing under subsection (1) also infringes a security measure with intent to obtain computer data.

The Guidelines came into force on 1 March 2021. Paragraph 1.1.2 says the Guidelines were issued by the Central Bank in exercise of powers conferred by sections 4(f), 4(g) and 42(b) of the Central Bank of Swaziland Order, 1974. Paragraph 1.3.1 says all financial institutions regulated and licensed by the Central Bank under the Acts it names are expected to implement the Guidelines within 12 months of their publication.

Section 11 says that where a financial institution fails to comply in a flagrant manner that results or threatens to result in an unsafe or unsound operating condition, the Central Bank will pursue corrective actions and penalties provided under the Acts it names.

Paragraph 1.4 of the Minimum Standards for Electronic Payment Schemes says that all financial institutions and non-financial institutions, including payment system operators and payment service providers, that have introduced or intend to introduce electronic payment schemes or products are required to adhere to them.

Paragraph 9.2 says the management of an electronic payment scheme service provider is responsible for ensuring that appropriate security control processes are in place for the scheme. Paragraph 11.4 says the institution shall at minimum ensure that it has developed appropriate incident response plans. Paragraph 5.1 says that failure to comply with the Minimum Standards shall attract penalties and sanctions as determined by the Bank.

Paragraph 7.5.1 says that in the event of a successful cyber attack, a financial institution should notify the Central Bank within two hours of verifying the incident. Paragraph 7.5.2 says that once a financial institution is satisfied that it has contained and recovered from an incident, it shall submit a report to the Central Bank.

Section 11 says that where a financial institution fails to comply in a flagrant manner that results or threatens to result in an unsafe or unsound operating condition, the Central Bank will pursue corrective actions and penalties provided under the Acts it names.

Paragraph 4.3 of the Minimum Standards for Electronic Payment Schemes says that financial institutions and non-financial institutions shall promptly report any suspected or confirmed cases of fraud relating to electronic payment schemes, major security breaches, any material service interruption or other significant issues.

Paragraph 4.4 says they shall ensure regular and timely submission of all reports requested by the Bank related to the provision of electronic payment scheme services or products. Paragraph 5.1 says that failure to comply with the Minimum Standards shall attract penalties and sanctions as determined by the Bank.

Section 15(1) makes it an offence for a person to distribute, publish, advertise, or expose pornographic material to a child or to an adult without that adult's consent; to publish or exhibit pornographic material without printing the publisher's name and prescribed address particulars, or without indicating the material's age restriction or consumer advice; or to broadcast a pornographic film, publicly or privately, to children or non-consenting adults.

Each of these is punishable, on conviction, by a fine of up to E100,000 or imprisonment of up to one year, or both; section 15(2) applies the same penalty where the offender has parental power or control over the child concerned. "Child" is defined, for the whole Act, as a person under the age of eighteen years (s. 2).

Section 22(1)-(2) provides that the copyright in a lecture, address, speech, or other similar public work is not infringed by its reproduction in the press or a broadcast for the purpose of information, and, separately, that copyright in an article published in a newspaper or periodical, or a broadcast, on a current economic, political, or religious topic is not infringed by reproduction in the press or in a broadcast or cable programme, provided the right of reproduction has not been expressly reserved and sufficient acknowledgement is given; neither exception applies where it conflicts with a normal exploitation of the work or unreasonably prejudices the copyright owner's legitimate interests (s. 22(3)).

Section 21 excuses fair dealing for the purposes of criticism or review of a work, or of reporting current events, subject to sufficient acknowledgement, except where the work is used to report current events by means of an audio-visual work, a sound recording, a broadcast, or a programme-carrying signal, and except that using a photograph to report current events is never fair dealing.

Section 23 excuses a quotation from a literary or musical work, including a quotation from an article in a journal that summarizes the work, where the quotation is compatible with fair practice, does not exceed the extent justified by the purpose, and is sufficiently acknowledged. The Act's neighbouring-rights provisions protect only performers, producers of sound recordings, and broadcasting organisations (ss.

53-60), not a print or online news publisher as such, so no publisher-side neighbouring right exists, and the Act contains no text-and-data-mining exception, no reference to hyperlinking or framing, and no compelled-bargaining mechanism. Section 1(2) provides that the Act comes into operation on a date the Minister appoints by notice in the Gazette, and no such commencement notice has been located.