Question 1

What is the Mauritius Data Protection Act 2017?

Accepted Answer

The Data Protection Act 2017 is the law governing how personal data is handled in Mauritius. It replaced the 2004 Act and came into force on 15 January 2018, and it closely follows the structure of the European GDPR. It applies to any organisation that decides how and why personal data is used, which in practice means almost every business with customers, employees or suppliers. Size is not a threshold: a five person company holding customer records is covered in the same way a bank is. The obligations that matter most in daily operation are registration with the Data Protection Commissioner, keeping a record of your processing activities, having a lawful basis for each use of personal data, responding to data subject requests within 30 days, reporting serious breaches within 72 hours, and taking appropriate security measures. Penalties reach 200,000 rupees and up to 5 years imprisonment for the more serious offences.

Question 2

Does my business need to register with the Data Protection Commissioner?

Accepted Answer

Yes, in almost all cases. Under the Act, both controllers and processors must register with the Data Protection Office before processing personal data, and registration is renewed periodically. A controller decides why and how personal data is used. A processor handles it on someone else's instructions. Many businesses are both: you are a controller for your own staff records and a processor for a client whose data you handle. Registration is a form plus a fee, not an inspection. The Commissioner is not asking you to prove you are perfect, only to declare who you are and what you do with personal data. Priva walks you through the details you need and keeps them in one place, so the information you submit matches what your records actually say.

Question 3

What counts as personal data?

Accepted Answer

Personal data is any information relating to an identified or identifiable living individual. A name and an email address obviously qualify. So do a national identity number, a photograph, a vehicle registration, an IP address, a CCTV image, and a customer reference that can be tied back to a person using other information you hold. The Act also recognises special category data, which needs stronger protection and usually explicit consent or a specific legal basis. That covers racial or ethnic origin, political opinions, religious beliefs, trade union membership, physical or mental health, sexual life, and genetic or biometric data. A useful test: if you could use the information, alone or with something else in your systems, to work out which person it refers to, treat it as personal data.

Question 4

What is a data subject access request, and how long do I have?

Accepted Answer

A data subject access request is a person asking you what personal data you hold about them, why you hold it, who you share it with, and how long you keep it. They can also ask you to correct it, delete it, restrict its use, hand it over in a portable format, or object to a particular use. You have 30 days from receiving the request to respond. The clock runs from when the request arrives, not from when you get round to it, and not from when you finish verifying identity, so verification needs to happen quickly. A request does not have to use the words "data subject access request", cite the Act, or arrive on a form. An email saying "please send me everything you have about me" is a valid request, and so is one made verbally. You may refuse a request in limited circumstances, but you must tell the person why and let them know they can complain to the Commissioner.

Question 5

When do I have to report a data breach?

Accepted Answer

A personal data breach is any security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data. A laptop left in a taxi counts. So does an email sent to the wrong recipient, a misconfigured folder, and a ransomware infection. Where the breach is likely to result in a risk to people's rights and freedoms, you must notify the Data Protection Commissioner within 72 hours of becoming aware of it. Where the risk is high, you must also tell the affected individuals, without undue delay. If you cannot assemble every detail within 72 hours, notify anyway and supply the rest afterwards. A late complete report is worse than a prompt partial one. Every breach must be recorded internally, including those you decide are not notifiable, together with your reasoning. That internal record is the first thing an investigator asks for.

Question 6

What is a record of processing activities, and do I need one?

Accepted Answer

A record of processing activities, usually shortened to RoPA, is a written inventory of what personal data your organisation holds, why it holds it, where it is stored, who it is shared with and how long it is kept. It is the document the Commissioner is most likely to ask for first, because everything else follows from it. You cannot honestly answer a data subject request, set a retention period or assess a breach if you do not know what you hold. Building it is mostly an interviewing exercise: each department knows its own systems. Priva gives you a link you can send to department heads so they can describe their own records without needing an account, and assembles the answers into a single register.

Question 7

What is a lawful basis, and which one should I use?

Accepted Answer

Every use of personal data needs a lawful basis. There are six: consent, performance of a contract, a legal obligation, vital interests, a public task, and legitimate interests. Consent is the one people reach for first and it is frequently the wrong choice. Consent must be freely given, specific, informed and unambiguous, and it must be as easy to withdraw as it was to give. If you cannot honour a withdrawal, for example because you are legally required to keep the record anyway, consent was never the right basis. Paying an employee is performance of a contract. Keeping accounting records is a legal obligation. Sending a marketing newsletter is usually consent. Fraud prevention is often legitimate interests. Pick the basis before you start processing, write it down in your RoPA, and tell people what it is in your privacy notice. Switching basis later because the first one became inconvenient is not permitted.

Question 8

Do I need to appoint a Data Protection Officer?

Accepted Answer

A Data Protection Officer is required where your core activities involve regular and systematic monitoring of individuals on a large scale, or large scale processing of special category data, and for public authorities. Plenty of smaller organisations fall outside that and still appoint one, because it gives a single accountable point of contact and is the clearest evidence that data protection is being taken seriously. The DPO must be able to act independently, report to the highest level of management, and must not be in a position where they would be marking their own homework. The head of IT or the head of marketing supervising their own processing is the classic conflict. A DPO can be an existing employee wearing a second hat, provided the independence and conflict requirements are genuinely met. Once appointed, you publish their contact details and inform the Data Protection Office.

Question 9

Do I need a cookie banner on my website?

Accepted Answer

If your website sets cookies that are not strictly necessary for it to function, you need consent before they are set. Analytics, advertising, embedded video and social media widgets all fall on the wrong side of that line. Consent has to be a positive action. A pre ticked box is not consent, and neither is a banner that says "by continuing to browse you agree". Refusing must be as easy as accepting, which means a reject button of equal prominence, not a link buried in a settings panel. You also have to keep evidence of what each visitor chose, and let them change their mind later. Priva generates a banner you paste into your site, records every decision with a timestamp, and keeps the log in a form you can hand to the Commissioner.

Question 10

Can I use cloud services hosted outside Mauritius?

Accepted Answer

Yes. The Act does not prohibit sending personal data abroad, it requires that the data stays protected when it gets there. A transfer outside Mauritius needs one of a defined set of mechanisms: the destination country having adequate protection, appropriate safeguards such as standard contractual clauses, binding corporate rules, the individual's explicit consent, or one of the narrow statutory derogations. In practice, most small businesses rely on contractual clauses with their cloud providers. The major providers publish these and you accept them as part of signing up, but you are expected to know which ones apply to you and to record them. Keep a list of every transfer: the destination, the recipient, the mechanism and the safeguards. Priva keeps this alongside your RoPA and prints it in the report you give the Commissioner.

Question 11

How long am I allowed to keep personal data?

Accepted Answer

The Act does not set a single number. It requires that personal data is kept no longer than is necessary for the purpose it was collected for, which means you decide the period, write down why, and then actually delete on schedule. Other laws frequently set the floor. Accounting and tax records generally have to be kept for several years, and employment records have their own requirements. Where a retention period is imposed by another law, that law wins and you record it as the reason. The failure mode regulators see most often is not keeping data too briefly, it is keeping everything forever because nobody decided. A retention schedule that says "customer enquiries, 2 years, then deleted" is defensible. "We have never deleted anything" is not.

Question 12

Is Priva legal advice?

Accepted Answer

No. Priva is a compliance management platform, not a law firm, and nothing it produces is legal advice. The documents Priva generates are built from the information you enter. Priva does not audit, inspect or independently verify that information, and it has no means of doing so. You remain solely responsible for the accuracy and truthfulness of what your records say, and for your organisation's compliance with the Act. Every document carries a certification that says exactly this, so that anyone receiving one understands what it is and what it is not. Where your situation is genuinely uncertain, or where a regulator has already contacted you, speak to a qualified adviser.

Question 13

Who at Priva can see the data I put into the platform?

Accepted Answer

Every record you create belongs to your organisation and is isolated at the database level by row level security, not merely hidden by the interface. Another customer of Priva cannot read your records even if they were to query the database directly. Priva support staff can view a tenant workspace only through an explicit, banner flagged session, and those sessions are written to an audit log that you can read. Priva acts as a processor for the personal data you put into the platform, under the data processing agreement you accepted when your account was created. That agreement sets out what we may and may not do with it. The published list of sub-processors, the third parties that can technically come into contact with your data, is kept current and available on request.

Question 14

What happens when my trial ends?

Accepted Answer

During the trial you have the full product, including features that belong to the higher plans, so you can decide with real information rather than a feature list. When the trial ends nothing is deleted. Your account drops to the Starter feature set, and anything that belongs to a higher plan is locked rather than removed: its records stay where they are and open again, exactly as you left them, when you subscribe. You are not asked for a card to start the trial, and nothing charges automatically at the end of it.

Question 15

Can I change or cancel my plan?

Accepted Answer

Yes. Plan changes are made in Settings, under Subscription and Billing, and take effect immediately. Upgrading charges the difference for the remainder of the current period, prorated, so you pay only for the time you actually get. Downgrading does not produce a refund: the value you have already paid for is converted into additional time on the lower plan, so a downgrade extends your subscription rather than returning money. Cancelling stops the renewal. You keep access until the end of the period you have already paid for, and your data remains available afterwards under the Starter feature set.

Question 16

How do I check that a Priva document is genuine?

Accepted Answer

Every document Priva generates carries a document ID and a content fingerprint, printed on the page under a Priva Certified Authentic badge. Enter the ID at priva.mu/verify and Priva will confirm which organisation the document was issued to, what kind of document it is, and the date it was produced. No account is needed. If the fingerprint shown when verifying differs from the one printed on the copy you are holding, that copy has been altered since it left the platform. Verification confirms where a document came from. It does not confirm that the contents are accurate, because those come from the organisation's own records, which Priva does not audit.

Frequently asked questions