Loi n° 15 de 2022 sur la protection des données

Eswatini

GOVERNMENT GAZETTE

Extraordinary

VOL. LX]

MBABANE, Friday, MARCH 4th 2022

[No. 41

CONTENTS

No.

Page

PART B - AN ACT

1. The Data Protection Act, 2022

THE DATA PROTECTION ACT, 2022

(Act No. 5 of 2022)

I ASSENT

MSWATI III KING OF THE KINGDOM OF ESWATINI

, 2022

AN ACT ENTITLED

AN ACT to provide for the collection, processing, disclosure and protection of personal data; balancing competing values of personal information privacy and sector-specific laws and other related matters.

ENACTED by the King and the Parliament of Eswatini.

AN ACT

Entitled

ARRANGEMENT OF SECTIONS

PART I PRELIMINARY PROVISIONS

1. Citation and commencement
2. Interpretation
3. Application
4. Exemptions

PART II RESPONSIBILITIES OF THE COMMISSION

1. Functions of Commission

Powers of the Commission to impose sanctions 7Protection of Commission 8. Confidentiality

PART III PROCESSING OF PERSONAL INFORMATION

1. Processing of personal information
2. Collection of personal information from data subject

Collection of personal information by data controller 12. Purpose specification and further processing limitation 13. Retention of records 14. Security measures on integrity of personal information 15. Processing of Information by data processor on behalf of data controller Security measures for information processed y adata processor 17. Notification of security compromises 18. Quality of information 19. Access to and challenging of personal information 20. Correction of personal information 21. Data controller to give effect to principles of this Act 22. Prohibition against processing of sensitive personal information

PART IV EXEMPTIONS FROM PROTECTION ON PROCESSING OF PERSONAL INFORMATION

Exemption on spiritual, religious or philosophical beliefs of data subject 24. Exemption on race of data subject 25. Exemption on trade union membership 26. Exemption on political affiliation of data subject 27. Exemption on health or sexual life of data subject 28. Exemption on criminal behaviour of data subject 29. General exemption on sensitive personal information 30. Authorisation by the Commission Exemption for processing of personal data for historical, statistical and research purposes

PART V TRANS-BORDER FLOW OF PERSONAL INFORMATION OUTSIDE ESWATINI

1. Transfer of personal information within SADC Member States
2. Transfer of personal information to non-SADC Member States

PART VI ENFORCEMENT

34. Complaints

35. Investigation by the Commission

36. Reasons for Commission not to take action

37. Pre-investigation by the Commission

38. Investigation proceedings by the Commission

39. Matters exempt from search and seizure

40. Parties to be informed of developments and results of an investigation

41. Enforcement notice

42. Cancellation of enforcement notice

43. Civil remedies

PART VII GENERAL PROVISIONS

1. Unsolicited electronic communications
2. Automated decision making
3. Notifications
4. Codes of Conduct

PART VIII MISCELLANEOUS PROVISIONS

1. Appointment of Data Protection Officers
2. Appeals
3. Class Actions
4. Whistleblowing

1. Other Sanctions
2. Offences and penalties
3. Regulations
4. Transitional Arrangements

PART I PRELIMINARY

Citation and Commencement

1(1) This Act may be cited as the Data Protection Act, 2022.