The law governing how organisations in Mauritius collect and use personal data, and what it requires of you.
The Data Protection Act 2017 is the law governing how personal data is handled in Mauritius. It replaced the 2004 Act and came into force on 15 January 2018, and it closely follows the structure of the European GDPR.
It applies to any organisation that decides how and why personal data is used, which in practice means almost every business with customers, employees or suppliers. Size is not a threshold: a five person company holding customer records is covered in the same way a bank is.
The obligations that matter most in daily operation are registration with the Data Protection Commissioner, keeping a record of your processing activities, having a lawful basis for each use of personal data, responding to data subject requests within 30 days, reporting serious breaches within 72 hours, and taking appropriate security measures.
Penalties reach 200,000 rupees and up to 5 years imprisonment for the more serious offences.