Data Protection in Mauritius: Obligations Under the Data Protection Act 2017

The Data Protection Act 2017 establishes a comprehensive framework for the protection of personal data in Mauritius. The Act applies to data controllers established in Mauritius and to data controllers not established in Mauritius where they process personal data of data subjects who are in Mauritius. The Data Protection Commissioner, established under Section 5, oversees compliance.

Data Protection Principles

Section 8 of the Data Protection Act 2017 sets out eight data protection principles:

1. Personal data shall be processed lawfully, fairly, and in a transparent manner
2. Personal data shall be collected for specified, explicit, and legitimate purposes
3. Personal data shall be adequate, relevant, and limited to what is necessary
4. Personal data shall be accurate and, where necessary, kept up to date
5. Personal data shall not be kept longer than necessary
6. Personal data shall be processed securely
7. The data controller shall be responsible for, and able to demonstrate compliance with, the above principles
8. Personal data shall not be transferred outside Mauritius unless adequate protection is ensured

Data Subject Rights

Part IV confers the following rights: the right of access (Section 25), the right to rectification (Section 26), the right to erasure (Section 27), the right to restrict processing (Section 28), the right to data portability (Section 29), and the right to object (Section 30).

Breach Notification

Section 32 requires a data controller to notify the Data Protection Commissioner of a personal data breach within seventy-two hours. Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, those data subjects must also be notified without undue delay.

Data Protection Impact Assessments

Section 33 requires data controllers to carry out a Data Protection Impact Assessment where processing is likely to result in a high risk to the rights and freedoms of data subjects. This includes systematic and extensive profiling, processing of sensitive data on a large scale, and systematic monitoring of public areas.

Penalties

The Act provides for criminal penalties of up to MUR 5 million or imprisonment for up to five years for serious offences. Administrative penalties may be imposed by the Data Protection Commissioner under Part VIII of the Act.

This article is for general information purposes only and does not constitute legal advice.