# LESOTHO
# Government Gazette
Vol. 57
Wednesday - 22nd February, 2012
No. 19
CONTENTS
No.
Page
ACT
5 Data Protection Act, 2011 .247
GOVERNMENT NOTICE
10 Statement of Objects and Reasons of the .290 Data Protection Act, 2011
OTHER NOTICES
(See Supplement of the Gazette)
Published by the Authority of His Majesty the King
Price: M37.00
ACT NO. 5 OF 2012
Data Protection Act, 2011
Arrangement of Sections
# Sections
PART I PRELIMINARY
- Citation and commencement
- Interpretation
- Application of the Act
- Exemptions
- Sector specific legislation
PART II - DATA PROTECTION COMMISSION
- Establishment of the Data Protection Commission
- Disqualification from office
- Functions of the Commission
- Tenure of office
- Allowances of the members of the Commission
- Funds of the Commission
- Audit of accounts
- Protection of Commission
- Duty of confidentiality
PART III PROTECTION OF PERSONAL INFORMATION
- Processing of personal information
- Minimality
- Collection directly from the data subject
- Purpose specification and further processing limitation
- Retention of records
20.Security measures on integrity of personal information Information processed by an agent of the data controller Security measures regarding information processed by an agen 2.Notification of security compromises 24. Quality of Information
- Notification to the Commision and to the data subject
26 Access to and challenges of personal information 2.7. Correction of personal information 28 Data controller to give effect to principles 29. Prohibition on processing of sensitive personal information
# PART IV EXEMPTIONS FROM PROTECTION ON PROCESSING OF PERSONAL IMFORMATION
- Exemption on data subject's spiritual, religious or philosophical beliefs
- Exemption on data subject's race
- Exemption on data subject’s trade union membership
- Exemption on data subject’s political affiliation
- Exemption on data subject's health or sexual life
- Exemption on data subject’s criminal behaviour
- General exemption on sensitive personal information
- J T . Authorisation by the Commission
- Exemption for processing of personal data for historical, statistical and research purposes
# PART V ENFORCEMENT
- Complaints
- Investigation by the Commission
- No action by the Commission
42.. Pre-investigations by the Commission 43. Investigation proceedings of the Commission 44. • . Matters exempt from search and seizure 45. Parties to be informed of developments during and result ot investigation 46. − Enforcement notice 47. Cancellation of an enforcement notice 48. Reviews and appeals 49. Civil remedies
# PART VI GENERAL PROVISIONS
- Unsolicited electronic communications
- Automated decision making
- Transfer of personal information outside Lesotho
- Notifications
- Codes of conduct
- Offences and penalties
- Regulations
- Transitional arrangements
# ACT NO. 5 OF 2012
# Data Protection Act, 2011
An Act to establish the Data Protection Commission, provide for principles for regulation of processing of personal information in order to protect and reconcile the fundamental and competing values of personal information privacy under this Act and sector-specific legislation and other related matters.
Enacted by the Parliament of Lesotho.
# PART I - PRELIMINARY
# Citation and commencement