The Data Protection Act, 2022 (Act No. 5 of 2022)

!img-0.jpeg

# ESWATINI

# GOVERNMENT GAZETTE

# EXTRAORDINARY

VOL. LX] MBABANE, Friday, MARCH 4th 2022 [No. 41

# CONTENTS

No. Page

PART B - AN ACT

1. The Data Protection Act, 2022 S1

PUBLISHED BY AUTHORITY

PART B

THE DATA PROTECTION ACT, 2022

(Act No. 5 of 2022)

!img-1.jpeg

I ASSENT

MSWATI III

KING OF THE KINGDOM OF

ESWATINI

..., 2022

AN ACT

ENTITLED

AN ACT to provide for the collection, processing, disclosure and protection of personal data; balancing competing values of personal information privacy and sector-specific laws and other related matters.

ENACTED by the King and the Parliament of Eswatini.

AN ACT

Entitled

ARRANGEMENT OF SECTIONS

PART I

PRELIMINARY PROVISIONS

1. Citation and commencement
2. Interpretation
3. Application
4. Exemptions

PART II

RESPONSIBILITIES OF THE COMMISSION

1. Functions of Commission
2. Powers of the Commission to impose sanctions
3. Protection of Commission
4. Confidentiality

S2

PART III

PROCESSING OF PERSONAL INFORMATION

1. Processing of personal information
2. Collection of personal information from data subject
3. Collection of personal information by data controller
4. Purpose specification and further processing limitation
5. Retention of records
6. Security measures on integrity of personal information
7. Processing of Information by data processor on behalf of data controller
8. Security measures for information processed by a data processor
9. Notification of security compromises
10. Quality of information
11. Access to and challenging of personal information
12. Correction of personal information
13. Data controller to give effect to principles of this Act
14. Prohibition against processing of sensitive personal information

PART IV

EXEMPTIONS FROM PROTECTION ON PROCESSING OF PERSONAL INFORMATION

1. Exemption on spiritual, religious or philosophical beliefs of data subject
2. Exemption on race of data subject
3. Exemption on trade union membership
4. Exemption on political affiliation of data subject
5. Exemption on health or sexual life of data subject
6. Exemption on criminal behaviour of data subject
7. General exemption on sensitive personal information
8. Authorisation by the Commission
9. Exemption for processing of personal data for historical, statistical and research purposes

S3

PART V

TRANS-BORDER FLOW OF PERSONAL INFORMATION OUTSIDE ESWATINI

1. Transfer of personal information within SADC Member States
2. Transfer of personal information to non-SADC Member States

PART VI

ENFORCEMENT

1. Complaints
2. Investigation by the Commission
3. Reasons for Commission not to take action
4. Pre-investigation by the Commission
5. Investigation proceedings by the Commission
6. Matters exempt from search and seizure
7. Parties to be informed of developments and results of an investigation
8. Enforcement notice
9. Cancellation of enforcement notice
10. Civil remedies

PART VII

GENERAL PROVISIONS

1. Unsolicited electronic communications
2. Automated decision making
3. Notifications
4. Codes of Conduct

PART VIII

MISCELLANEOUS PROVISIONS

1. Appointment of Data Protection Officers
2. Appeals
3. Class Actions
4. Whistleblowing

S4

1. Other Sanctions
2. Offences and penalties
3. Regulations
4. Transitional Arrangements

PART I

PRELIMINARY

Citation and Commencement