Guide

DPA 2017: A Plain Guide

The Data Protection Act 2017 is the main data protection law of Mauritius. This guide sums up what it asks of organisations, with the section of the Act for each point. It is a summary, not legal advice: read the Act on dataprotection.govmu.org for the full text.

1. Overview & Scope

  • The Data Protection Act 2017 governs the processing of personal data in Mauritius, in line with current international standards
  • It applies to a controller or processor established in Mauritius that processes personal data in the context of that establishment (s.3(5)(a))
  • It also applies to one not established in Mauritius that uses equipment in Mauritius to process personal data, other than for transit, which must nominate a representative established in Mauritius (s.3(5)(b) and (6))
  • Anyone ordinarily resident in Mauritius, or processing through an office, branch or agency in Mauritius, is treated as established in Mauritius (s.3(7))
  • Administered and enforced by the Data Protection Office, headed by the Data Protection Commissioner (s.4)

2. Key Definitions

  • Personal data: any information relating to a data subject, an identified or identifiable individual (s.2)
  • Controller: determines the purposes and means of processing
  • Processor: processes data on behalf of the controller
  • Special categories: racial or ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, physical or mental health, sexual orientation, genetic or biometric data, and offences or alleged offences (s.2)

3. Lawful Bases for Processing (s.28)

  • Consent of the data subject for one or more specified purposes
  • Performance of a contract with the data subject, or steps taken at their request before entering into one
  • Compliance with a legal obligation of the controller
  • Protection of the vital interests of the data subject or another person
  • A task carried out in the public interest or in the exercise of official authority
  • Legitimate interests of the controller or a third party, unless unwarranted given the harm to the data subject
  • Historical, statistical or scientific research

4. Data Subject Rights

  • Right of access to their personal data, free of charge unless a request is manifestly excessive (s.37)
  • A written reply within 30 days of the request
  • Right not to be subject to a decision based solely on automated processing, including profiling (s.38)
  • Right to rectification of inaccurate or incomplete data (s.39(1))
  • Right to erasure, in the cases set out in s.39(2)
  • Right to restriction of processing, in the cases set out in s.39(5)
  • Right to object to processing (s.40)
  • Right to withdraw consent at any time (s.24(2))

5. Controller Obligations

  • Transparency: tell data subjects at collection who you are, why you collect their data and what their rights are (s.23)
  • Designate an officer responsible for data protection compliance issues (s.22(2)(e))
  • Carry out a data protection impact assessment before processing likely to result in a high risk (s.34)
  • Notify the Commissioner of a personal data breach without undue delay and, where feasible, within 72 hours (s.25)
  • Keep a record of all processing operations (s.33)
  • Implement appropriate security and organisational measures (s.31)

6. DPO Requirements

  • Every controller must designate an officer responsible for data protection compliance issues (s.22(2)(e))
  • Must have expert knowledge of data protection law and practices
  • Tasks: inform, advise, monitor compliance, cooperate with DPC, act as DPC contact point
  • Must be independent: no conflict of interest
  • Until 31 December 2026 the DPO may be internal or external; from 1 January 2027 (GN No. 117 of 2026) the DPO must be an in-house staff member

7. Cross-Border Transfers (s.36)

  • Personal data may be transferred to another country only on one of the grounds in s.36(1)
  • Proof of appropriate safeguards for the data has been given to the Commissioner (s.36(1)(a))
  • The data subject gave explicit consent after being told of the possible risks of the transfer (s.36(1)(b))
  • The transfer is necessary for a contract with or in the interest of the data subject, for public interest reasons provided by law, for a legal claim, to protect vital interests, or, for a limited one-off transfer, for compelling legitimate interests (s.36(1)(c))
  • The data comes from a register that the law opens to the public, used within the conditions the law sets for it (s.36(1)(d))
  • The Commissioner may ask for proof that the safeguards work, and may prohibit, suspend or attach conditions to a transfer (s.36(4))

8. Enforcement & Penalties

  • The Commissioner may require information by written notice (s.7) and may apply to a Judge for a preservation order (s.8)
  • The Commissioner may serve an enforcement notice setting out the steps to take, with at least 21 days to take them; failing to comply is an offence (s.9)
  • The Commissioner may carry out periodical audits of the systems of controllers and processors (s.46)
  • Where no specific penalty is set, a contravention is an offence punishable by a fine of up to Rs 200,000 and imprisonment for up to 5 years (s.43)
  • A controller must be able to demonstrate that its processing meets the Act, so keep your records, assessments and decisions (s.22(1))

Priva helps you put the DPA 2017 into practice

From DSAR management to breach notification and DPO tools: everything in one platform.

Get Started