The Data Protection Act 2017

THE DATA PROTECTION ACT 2017

Act 20/2017

Proclaimed by [Proclamation No. 3 of 2018] w.e.f. 15 January 2018

Government Gazette of Mauritius No. 120 of 23 December 2017

I assent

BIBI AMEENAH FIRDAUS GURIB-FAKIM

22 December 2017 President of the Republic

ARRANGEMENT OF SECTIONS

Section

PART I – PRELIMINARY

1. Short title
2. Interpretation

1. Application of Act

PART II – DATA PROTECTION OFFICE

Sub-Part A – Establishment of Data Protection Office

1. Establishment of Office

Sub-Part B – Functions and Powers of Commissioner

1. Functions of Commissioner
2. Investigation of complaints
3. Power to require information
4. Preservation Order
5. Enforcement notice
6. Power to seek assistance

Sub-Part C – Powers of Authorised Officers

1. Power of entry and search
2. Obstruction of Commissioner or authorised officer

Sub-Part D – Delegation of Power

1. Delegation of power by Commissioner

PART III – REGISTRATION OF CONTROLLERS AND PROCESSORS

1. Controller and Processor

1. Application for registration
2. Issue of registration certificate
3. Change in particulars
4. Renewal of registration certificate
5. Cancellation or variation of terms and conditions of registration certificate
6. Register of controllers and processors

PART IV – OBLIGATIONS ON CONTROLLERS AND PROCESSORS

1. Principles relating to processing of personal data
2. Duties of controller
3. Collection of personal data
4. Conditions for consent
5. Notification of personal data breach
6. Communication of personal data breach to data subject
7. Duty to destroy personal data
8. Lawful processing
9. Special categories of personal data
10. Personal data of child
11. Security of processing
12. Prior security check
13. Record of processing operations

PART V – PROCESSING OPERATIONS LIKELY TO

PRESENT RISK

1. Data protection impact assessment
2. Prior authorisation and consultation

PART VI – TRANSFER OF PERSONAL DATA OUTSIDE MAURITIUS

1. Transfer of personal data outside Mauritius

PART VII – RIGHTS OF DATA SUBJECTS

1. Right of access
2. Automated individual decision making
3. Rectification, erasure or restriction of processing
4. Right to object
5. Exercise of rights

PART VIII – OTHER OFFENCES AND PENALTIES

1. Unlawful disclosure of personal data
2. Offence for which no specific penalty provided

PART IX – MISCELLANEOUS

1. Exceptions and restrictions
2. Annual report
3. Compliance audit
4. Codes and guidelines
5. Certification

1. Confidentiality and oath
2. Protection from liability
3. Right of appeal
4. Special jurisdiction of Tribunal
5. Prosecution and jurisdiction
6. Certificate issued by Commissioner
7. Regulations
8. Repeal
9. Transitional provisions
10. Commencement

SCHEDULE

An Act

To provide for new legislation to strengthen the control and personal autonomy of data subjects over their personal data, in line with current relevant international standards, and for matters related thereto

ENACTED by the Parliament of Mauritius, as follows –

PART I – PRELIMINARY

1. Short title

This Act may be cited as the Data Protection Act 2017.

1. Interpretation

In this Act – “authorised officer” means an officer to whom the Commissioner has delegated his powers under section 13;