Loi n° 15 de 2022 sur la protection des données

# Eswatini

# GOVERNMENT GAZETTE

# Extraordinary

VOL. LX]

MBABANE, Friday, MARCH 4tħh 2022

[No. 41

# CONTENTS

No.

Page

PART B - AN ACT

1. The Data Protection Act, 2022

THE DATA PROTECTION ACT, 2022

(Act No. 5 of 2022)


I ASSENT

MSWATI III KING OF THE KINGDOM OF ESWATINI

, 2022

# AN ACT ENTITLED

AN ACT to provide for the collection, processing, disclosure and protection of personal data; balancing competing values of personal information privacy and sector-specific laws and other related matters.

ENACTED by the King and the Parliament of Eswatini.

AN ACT

Entitled

# ARRANGEMENT OF SECTIONS

# PART I PRELIMINARY PROVISIONS

1.Citation and commencement 2. Interpretation 3. Application 4. Exemptions

# PART II RESPONSIBILITIES OF THE COMMISSION

1. Functions of Commission

Powers of the Commission to impose sanctions 7Protection of Commission 8. Confidentiality

# PART III PROCESSING OF PERSONAL INFORMATION

1. Processing of personal information
2. Collection of personal information from data subject

Collection of personal information by data controller 12. Purpose specification and further processing limitation 13. Retention of records 14. Security measures on integrity of personal information 15. Processing of Information by data processor on behalf of data controller Security measures for information processed y adata processor 17. Notification of security compromises 18. Quality of information 19. Access to and challenging of personal information 20. Correction of personal information 21. Data controller to give effect to principles of this Act 22. Prohibition against processing of sensitive personal information

# PART IV EXEMPTIONS FROM PROTECTION ON PROCESSING OF PERSONAL INFORMATION

Exemption on spiritual, religious or philosophical beliefs of data subject 24. Exemption on race of data subject 25. Exemption on trade union membership 26. Exemption on political affiliation of data subject 27. Exemption on health or sexual life of data subject 28. Exemption on criminal behaviour of data subject 29. General exemption on sensitive personal information 30. Authorisation by the Commission Exemption for processing of personal data for historical, statisticaland research purposes

# PART V TRANS-BORDER FLOW OF PERSONAL INFORMATION OUTSIDE ESWATINI

1. Transfer of personal information within SADC Member States
2. Transfer of personal information to non-SADC Member States

# PART VI ENFORCEMENT

1. Complaints
2. Investigation by the Commission
3. Reasons for Commission not to take action
4. Pre-investigation by the Commission
5. Investigation proceedings by the Commission
6. Matters exempt from search and seizure

4Parties to be informed of developments and results of an investigation 41. Enforcement notice 42. Cancellation of enforcement notice 43. Civil remedies

# PART VII GENERAL PROVISIONS

1. Unsolicited electronic communications
2. Automated decision making
3. Notifications
4. Codes of Conduct

# PART VIII MISCELLANEOUS PROVISIONS

1. Appointment of Data Protection Officers
2. Appeals
3. Class Actions
4. Whistleblowing

1. Other Sanctions
2. Offences and penalties
3. Regulations
4. Transitional Arrangements

# PART I PRELIMINARY

# Citation and Commencement

1(1) This Act may be cited as the Data Protection Act, 2022. (2) This Act shall come into operation on the date of publication in the Gazette.