{"name":"Priva help centre","description":"Public guidance on the Mauritius Data Protection Act 2017 and on using Priva, data protection software for organisations in Mauritius.","disclaimer":"Priva is software, not legal advice. Each controller remains responsible for meeting the Act.","origin":"https://www.priva.mu","generated_at":"2026-11-09T11:37:37.005Z","count":16,"articles":[{"slug":"is-priva-a-law-firm","url":"https://www.priva.mu/support/is-priva-a-law-firm","title":"Is Priva legal advice?","summary":"No. Priva is a compliance management tool. You remain responsible for your own compliance.","category":"About Priva","kind":"faq","audience":"public","keywords":["legal advice","disclaimer","responsibility","liability"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"No. Priva is a compliance management platform, not a law firm, and nothing it produces is legal advice.\r\n\r\nThe documents Priva generates are built from the information you enter. Priva does not audit, inspect or independently verify that information, and it has no means of doing so. You remain solely responsible for the accuracy and truthfulness of what your records say, and for your organisation's compliance with the Act.\r\n\r\nEvery document carries a certification that says exactly this, so that anyone receiving one understands what it is and what it is not. Where your situation is genuinely uncertain, or where a regulator has already contacted you, speak to a qualified adviser.","steps":[]},{"slug":"who-can-see-my-data","url":"https://www.priva.mu/support/who-can-see-my-data","title":"Who at Priva can see the data I put into the platform?","summary":"Your data is isolated per tenant at the database level, and access is logged.","category":"About Priva","kind":"faq","audience":"public","keywords":["security","privacy","access","isolation","staff access","confidentiality"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"Every record you create belongs to your organisation and is isolated at the database level by row level security, not merely hidden by the interface. Another customer of Priva cannot read your records even if they were to query the database directly.\r\n\r\nPriva support staff can view a tenant workspace only through an explicit, banner flagged session, and those sessions are written to an audit log that you can read.\r\n\r\nPriva acts as a processor for the personal data you put into the platform, under the data processing agreement you accepted when your account was created. That agreement sets out what we may and may not do with it.\r\n\r\nThe published list of sub-processors, the third parties that can technically come into contact with your data, is kept current and available on request.","steps":[]},{"slug":"verify-a-document","url":"https://www.priva.mu/support/verify-a-document","title":"How do I check that a Priva document is genuine?","summary":"Every generated document carries an ID. Enter it at priva.mu/verify.","category":"About Priva","kind":"faq","audience":"public","keywords":["verify","authentic","document id","fingerprint","certification"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"Every document Priva generates carries a document ID and a content fingerprint, printed on the page under a Priva Certified Authentic badge.\r\n\r\nEnter the ID at **priva.mu/verify** and Priva will confirm which organisation the document was issued to, what kind of document it is, and the date it was produced. No account is needed.\r\n\r\nIf the fingerprint shown when verifying differs from the one printed on the copy you are holding, that copy has been altered since it left the platform.\r\n\r\nVerification confirms where a document came from. It does not confirm that the contents are accurate, because those come from the organisation's own records, which Priva does not audit.","steps":[]},{"slug":"free-trial","url":"https://www.priva.mu/support/free-trial","title":"What happens when my trial ends?","summary":"Your data stays. Access drops to the Starter feature set until you subscribe.","category":"Billing","kind":"faq","audience":"public","keywords":["trial","expiry","subscription","downgrade","pricing"],"updated_at":"2026-10-17T04:38:51.058726+00:00","body":"During the trial you have the full product, including features that belong to the higher plans, so you can decide with real information rather than a feature list.\r\n\r\nWhen the trial ends nothing is deleted. Your account drops to the Starter feature set, and anything that belongs to a higher plan is locked rather than removed: its records stay where they are and open again, exactly as you left them, when you subscribe.\r\n\r\nYou are not asked for a card to start the trial, and nothing charges automatically at the end of it.","steps":[]},{"slug":"change-plan","url":"https://www.priva.mu/support/change-plan","title":"Can I change or cancel my plan?","summary":"Yes, at any time and from inside the platform.","category":"Billing","kind":"faq","audience":"public","keywords":["upgrade","downgrade","cancel","billing","plan","refund"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"Yes. Plan changes are made in Settings, under Subscription and Billing, and take effect immediately.\r\n\r\nUpgrading charges the difference for the remainder of the current period, prorated, so you pay only for the time you actually get. Downgrading does not produce a refund: the value you have already paid for is converted into additional time on the lower plan, so a downgrade extends your subscription rather than returning money.\r\n\r\nCancelling stops the renewal. You keep access until the end of the period you have already paid for, and your data remains available afterwards under the Starter feature set.","steps":[]},{"slug":"breach-72-hours","url":"https://www.priva.mu/support/breach-72-hours","title":"When do I have to report a data breach?","summary":"Within 72 hours to the Commissioner where there is a risk to people, and to the individuals themselves where the risk is high.","category":"Breaches","kind":"faq","audience":"public","keywords":["breach","72 hours","notification","incident","report","section 25"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. A laptop left in a taxi counts. So does an email sent to the wrong recipient, a misconfigured folder, and a ransomware infection.\r\n\r\nWhere the breach is likely to result in a risk to people's rights and freedoms, you must notify the Data Protection Commissioner **within 72 hours** of becoming aware of it. Where the risk is high, you must also tell the affected individuals, without undue delay.\r\n\r\nIf you cannot assemble every detail within 72 hours, notify anyway and supply the rest afterwards. A late complete report is worse than a prompt partial one.\r\n\r\nEvery breach must be recorded internally, including those you decide are not notifiable, together with your reasoning. That internal record is the first thing an investigator asks for.","steps":[]},{"slug":"cookie-consent-required","url":"https://www.priva.mu/support/cookie-consent-required","title":"Do I need a cookie banner on my website?","summary":"If your site uses anything beyond strictly necessary cookies, yes, and consent must be opt in.","category":"Consent","kind":"faq","audience":"public","keywords":["cookies","banner","consent","tracking","analytics","widget"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"If your website sets cookies that are not strictly necessary for it to function, you need consent before they are set. Analytics, advertising, embedded video and social media widgets all fall on the wrong side of that line.\r\n\r\nConsent has to be a positive action. A pre ticked box is not consent, and neither is a banner that says \"by continuing to browse you agree\". Refusing must be as easy as accepting, which means a reject button of equal prominence, not a link buried in a settings panel.\r\n\r\nYou also have to keep evidence of what each visitor chose, and let them change their mind later.\r\n\r\nPriva generates a banner you paste into your site, records every decision with a timestamp, and keeps the log in a form you can hand to the Commissioner.","steps":[]},{"slug":"what-is-a-dsar","url":"https://www.priva.mu/support/what-is-a-dsar","title":"What is a data subject access request, and how long do I have?","summary":"Someone asking what you hold about them. You have 30 days to respond.","category":"Data subject rights","kind":"faq","audience":"public","keywords":["dsar","access request","subject rights","30 days","deadline"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"A data subject access request is a person asking you what personal data you hold about them, why you hold it, who you share it with, and how long you keep it. They can also ask you to correct it, delete it, restrict its use, hand it over in a portable format, or object to a particular use.\r\n\r\nYou have **30 days** from receiving the request to respond. The clock runs from when the request arrives, not from when you get round to it, and not from when you finish verifying identity, so verification needs to happen quickly.\r\n\r\nA request does not have to use the words \"data subject access request\", cite the Act, or arrive on a form. An email saying \"please send me everything you have about me\" is a valid request, and so is one made verbally.\r\n\r\nYou may refuse a request in limited circumstances, but you must tell the person why and let them know they can complain to the Commissioner.","steps":[]},{"slug":"do-i-need-a-dpo","url":"https://www.priva.mu/support/do-i-need-a-dpo","title":"Do I need to appoint a Data Protection Officer?","summary":"Many organisations do, and it is worth appointing one even where it is not compulsory.","category":"Governance","kind":"faq","audience":"public","keywords":["dpo","data protection officer","appoint","designation","independence"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"A Data Protection Officer is required where your core activities involve regular and systematic monitoring of individuals on a large scale, or large scale processing of special category data, and for public authorities.\r\n\r\nPlenty of smaller organisations fall outside that and still appoint one, because it gives a single accountable point of contact and is the clearest evidence that data protection is being taken seriously.\r\n\r\nThe DPO must be able to act independently, report to the highest level of management, and must not be in a position where they would be marking their own homework. The head of IT or the head of marketing supervising their own processing is the classic conflict.\r\n\r\nA DPO can be an existing employee wearing a second hat, provided the independence and conflict requirements are genuinely met. Once appointed, you publish their contact details and inform the Data Protection Office.","steps":[]},{"slug":"what-is-a-ropa","url":"https://www.priva.mu/support/what-is-a-ropa","title":"What is a record of processing activities, and do I need one?","summary":"A written inventory of what personal data you hold and why. Yes, you need one.","category":"Records","kind":"faq","audience":"public","keywords":["ropa","record of processing","inventory","article 30","section 22","data map"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"A record of processing activities, usually shortened to RoPA, is a written inventory of what personal data your organisation holds, why it holds it, where it is stored, who it is shared with and how long it is kept.\r\n\r\nIt is the document the Commissioner is most likely to ask for first, because everything else follows from it. You cannot honestly answer a data subject request, set a retention period or assess a breach if you do not know what you hold.\r\n\r\nBuilding it is mostly an interviewing exercise: each department knows its own systems. Priva gives you a link you can send to department heads so they can describe their own records without needing an account, and assembles the answers into a single register.","steps":[]},{"slug":"how-long-keep-data","url":"https://www.priva.mu/support/how-long-keep-data","title":"How long am I allowed to keep personal data?","summary":"Only as long as you need it for the purpose you collected it, and no longer.","category":"Records","kind":"faq","audience":"public","keywords":["retention","deletion","how long","storage limitation","schedule"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"The Act does not set a single number. It requires that personal data is kept no longer than is necessary for the purpose it was collected for, which means you decide the period, write down why, and then actually delete on schedule.\r\n\r\nOther laws frequently set the floor. Accounting and tax records generally have to be kept for several years, and employment records have their own requirements. Where a retention period is imposed by another law, that law wins and you record it as the reason.\r\n\r\nThe failure mode regulators see most often is not keeping data too briefly, it is keeping everything forever because nobody decided. A retention schedule that says \"customer enquiries, 2 years, then deleted\" is defensible. \"We have never deleted anything\" is not.","steps":[]},{"slug":"what-is-dpa-2017","url":"https://www.priva.mu/support/what-is-dpa-2017","title":"What is the Mauritius Data Protection Act 2017?","summary":"The law governing how organisations in Mauritius collect and use personal data, and what it requires of you.","category":"The law","kind":"faq","audience":"public","keywords":["dpa","data protection act","2017","law","mauritius","legislation"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"The Data Protection Act 2017 is the law governing how personal data is handled in Mauritius. It replaced the 2004 Act and came into force on 15 January 2018, and it closely follows the structure of the European GDPR.\r\n\r\nIt applies to any organisation that decides how and why personal data is used, which in practice means almost every business with customers, employees or suppliers. Size is not a threshold: a five person company holding customer records is covered in the same way a bank is.\r\n\r\nThe obligations that matter most in daily operation are registration with the Data Protection Commissioner, keeping a record of your processing activities, having a lawful basis for each use of personal data, responding to data subject requests within 30 days, reporting serious breaches within 72 hours, and taking appropriate security measures.\r\n\r\nPenalties reach 200,000 rupees and up to 5 years imprisonment for the more serious offences.","steps":[]},{"slug":"do-i-need-to-register","url":"https://www.priva.mu/support/do-i-need-to-register","title":"Does my business need to register with the Data Protection Commissioner?","summary":"Almost certainly yes, if you are a controller or processor operating in Mauritius.","category":"The law","kind":"faq","audience":"public","keywords":["register","registration","commissioner","dpc","controller","processor"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"Yes, in almost all cases. Under the Act, both controllers and processors must register with the Data Protection Office before processing personal data, and registration is renewed periodically.\r\n\r\nA controller decides why and how personal data is used. A processor handles it on someone else's instructions. Many businesses are both: you are a controller for your own staff records and a processor for a client whose data you handle.\r\n\r\nRegistration is a form plus a fee, not an inspection. The Commissioner is not asking you to prove you are perfect, only to declare who you are and what you do with personal data.\r\n\r\nPriva walks you through the details you need and keeps them in one place, so the information you submit matches what your records actually say.","steps":[]},{"slug":"what-is-personal-data","url":"https://www.priva.mu/support/what-is-personal-data","title":"What counts as personal data?","summary":"Anything that identifies a living person, directly or in combination with other information you hold.","category":"The law","kind":"faq","audience":"public","keywords":["personal data","definition","identifiable","special category","sensitive"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"Personal data is any information relating to an identified or identifiable living individual. A name and an email address obviously qualify. So do a national identity number, a photograph, a vehicle registration, an IP address, a CCTV image, and a customer reference that can be tied back to a person using other information you hold.\r\n\r\nThe Act also recognises special category data, which needs stronger protection and usually explicit consent or a specific legal basis. That covers racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health, sexual life, and genetic or biometric data.\r\n\r\nA useful test: if you could use the information, alone or with something else in your systems, to work out which person it refers to, treat it as personal data.","steps":[]},{"slug":"lawful-basis","url":"https://www.priva.mu/support/lawful-basis","title":"What is a lawful basis, and which one should I use?","summary":"The legal reason you are allowed to use someone data. Consent is only one of six, and often the weakest.","category":"The law","kind":"faq","audience":"public","keywords":["lawful basis","legal basis","consent","legitimate interest","contract"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"Every use of personal data needs a lawful basis. There are six: consent, performance of a contract, a legal obligation, vital interests, a public task, and legitimate interests.\r\n\r\nConsent is the one people reach for first and it is frequently the wrong choice. Consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give. If you cannot honour a withdrawal, for example because you are legally required to keep the record anyway, consent was never the right basis.\r\n\r\nPaying an employee is performance of a contract. Keeping accounting records is a legal obligation. Sending a marketing newsletter is usually consent. Fraud prevention is often legitimate interests.\r\n\r\nPick the basis before you start processing, write it down in your RoPA, and tell people what it is in your privacy notice. Switching basis later because the first one became inconvenient is not permitted.","steps":[]},{"slug":"cross-border-transfers","url":"https://www.priva.mu/support/cross-border-transfers","title":"Can I use cloud services hosted outside Mauritius?","summary":"Yes, with a lawful transfer mechanism in place and the transfer recorded.","category":"The law","kind":"faq","audience":"public","keywords":["transfer","cross border","cloud","international","scc","adequacy"],"updated_at":"2026-09-21T10:52:00.466843+00:00","body":"Yes. The Act does not prohibit sending personal data abroad, it requires that the data stays protected when it gets there.\r\n\r\nA transfer outside Mauritius needs one of a defined set of mechanisms: the destination country having adequate protection, appropriate safeguards such as standard contractual clauses, binding corporate rules, the individual's explicit consent, or one of the narrow statutory derogations.\r\n\r\nIn practice, most small businesses rely on contractual clauses with their cloud providers. The major providers publish these and you accept them as part of signing up, but you are expected to know which ones apply to you and to record them.\r\n\r\nKeep a list of every transfer: the destination, the recipient, the mechanism and the safeguards. Priva keeps this alongside your RoPA and prints it in the report you give the Commissioner.","steps":[]}]}