Data Protection Act, 2023

(Act 24 of 2023)

ARRANGEMENT OF SECTIONS

PART I - PRELIMINARY

1. Short title

2. Interpretation

3. Application

4. Exemptions

PART II - INFORMATION COMMISSION

1. Information Commission
2. Powers and duties of Commission
3. Investigations and audits
4. Enforcement notice and corrective powers
5. Preliminary injunction
6. Disclosure
7. Liability
8. Powers and duties of Chief Executive Officer
9. Right of appeal
10. Cooperation

PART III - DATA PROTECTION

1. Processing personal data
2. Data retention
3. Data minimization
4. Data quality
5. Access, requests and correction of data
6. Data security and confidentiality
7. Accountability for data processing activities

PART IV - PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

1. Sensitive data
2. Data related to minors
3. Processing of personal data relating to offences and criminal conviction

PART V - DATA SUBJECTS RIGHTS

1. Rights of data subjects
2. Right to be informed
3. Right to access data
4. Right of rectification or correction
5. Right to cancel or delete data
6. Right to object the processing of data for a specific purpose
7. Right to data portability
8. Right to compensation

PART VI - OBLIGATIONS OF DATA CONTROLLERS AND DATA PROCESSORS

1. Safe custody
2. Transparency
3. Privacy by design
4. Data processors
5. Records of processing activities
6. Logging
7. Blocking data
8. Data protection impact assessment
9. Prior consultation
10. Security of processing
11. Notification of a personal data breach to the Commission
12. Communication of a personal data breach to the data subject
13. Data protection officer
14. Tasks of data protection officer

PART VII - TRANSFER OF DATA TO THIRD PARTIES

1. Cross-border data flows

PART VIII - OFFENCES AND PENALTIES

1. Unlawful disclosure of personal data
2. Obstruction
3. Offence for which no penalty provided
4. General conditions for imposing administrative fines

PART IX - MISCELLANEOUS

1. Cooperation with other authorities
2. Compliance audit
3. Regulations
4. Repeal of (Cap 57)
5. Transitional Provisions

DATA PROTECTION ACT, 2023

(Act 24 of 2023)

I assent

Wavel Ramkalawan President

19th December, 2023

AN ACT FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA, TO RECOGNISE THE RIGHT TO PRIVACY ENVISAGED IN ARTICLE 20 OF THE CONSTITUTION, TO PROMOTE AND FACILITATE RESPONSIBLE AND TRANSPARENT FLOW OF INFORMATION BY PRIVATE AND PUBLIC ENTITIES AND TO PROVIDE FOR OTHER RELATED MATTERS.

ENACTED by the President and the National Assembly.

PART I - PRELIMINARY

Short title

1. This Act may be cited as the Data Protection Act, 2023.

Interpretation

1. In this Act unless context otherwise requires —

"biometrics" means personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allows or confirms the unique identification of that natural person;

"Chief Executive Officer" means the Chief Executive Officer appointed under section 41 of the Access to Information Act;