Data Protection Act, 2023

# DATA PROTECTION ACT, 2023

(Act 24 of 2023)

# ARRANGEMENT OF SECTIONS

# PART I - PRELIMINARY

# Sections

1.Short title 2. Interpretation 3. Application 4. Exemptions

# PART II - INFORMATION COMMISSION

1. Information Commission
2. Powers and duties of Commission
3. Investigations and audits

.Enforcement notice and corrective powers . Preliminary injunction 10. Disclosure 11. Liability 12. Powers and duties of Chief Executive Officer 13.Right of appeal 14. Cooperation

# PART III - DATA PROTECTION

15.Processing personal data 16. Data retention 17. Data minimization 18.Data quality 19. Access, requests and correction of data Data security and confidentiality 21.Accountability for data processing activities

# PART IV - PROCESSING SPECIAL CATEGORIES OF PERSONAL DATA

1. Sensitive data
2. Data related to minors
3. Processing of personal data relating to offences and criminal conviction

# PART V - DATA SUBJECTS RIGHTS

1. Rights of data subjects
2. Right to be informed

2.Right to access data 28.Right of rectification or correction 29. Right to cancel or delete data Right to object the processing of data for a specific purpose 31. Right to data portability 3.Right to compensation

# PART VI - OBLIGATIONS OF DATA CONTROLLERS AND DATA PROCESSORS

1. Safe custody
2. Transparency

35.Privacy by design 36. Data processors 37.Records of processing activities 38. Logging 39.Blocking data 40.Data protection impact assessment 41. Prior consultation Security of processing 43. Notification of a personal data breach to the Commission 44. Communication of a personal data breach to the data subject 45. Data protection officer 46.Tasks of data protection officer

# PART VII - TRANSFER OF DATA TO THIRD PARTIES

1. Cross-border data flows

# PART VIII - OFFENCES AND PENALTIES

1. Unlawful disclosure of personal data
2. Obstruction
3. Offence for which no penalty provided

51.General conditions for imposing administrative fines

# PART IX - MISCELLANEOUS

1. Cooperation with other authorities
2. Compliance audit
3. Regulations
4. Repeal of (Cap 57)
5. Transitional Provisions


# DATA PROTECTION ACT, 2023

(Act 24 of 2023)


I assent


Wavel Ramkalawan President

19th December, 2023

AN ACT FOR THE PROTECTION OF INDIVIDUALS WITH REGARD TO THE PROCESSING OF PERSONAL DATA, TO RECOGNISE THE RIGHT TO PRIVACY ENVISAGED IN ARTICLE 20 OF THE CONSTITUTION, TO PROMOTE AND FACILITATE RESPONSIBLE AND TRANSPARENT FLOW OF INFORMATION BY PRIVATE AND PUBLIC ENTITIES AND TO PROVIDE FOR OTHER RELATED MATTERS.

ENACTED by the President and the National Assembly.

# PART I - PRELIMINARY

# Short title

1. This Act may be cited as the Data Protection Act, 2023.

# Interpretation

1. In this Act unless context otherwise requires —

"biometrics" means personal data resulting from specific technical processing relating to the physical, physiological or behavioral characteristics of a natural person, which allows or confirms the unique identification of that natural person;

"Chief Executive Officer" means the Chief Executive Officer appointed under section 41 of the Access to Information Act;

"Commission" means the Information Commission established under section 36 of the Access to Information Act;