← Global Privacy Laws Research Library
Act 20/2017
Data Protection Act 2017 - Mauritius
Prepared by Shubhank Suman · Last reviewed
Enacted and commenced as recorded in the supplied Act
- Legal character
- National statute
- Region
- Africa
- Assent
- 22 December 2017
- Published
- 23 December 2017
- Date of commencement
- 15 January 2018 (Proclamation No. 3 of 2018)
What it covers
Personal-data processing through principles, controller/processor registration, Commissioner oversight, consent and other lawful bases, security, breach notifications, risk assessments, overseas transfers and individual rights. Includes high-risk new technology and solely automated decisions.
Why it matters
Provides Mauritius’s national privacy framework. Its own territorial, transfer and child-consent rules must be read directly rather than assumed to match GDPR wording.
Refer to it when
Research processing in Mauritius, controller/processor registration, sensitive or child data, security incidents, international transfers or significant automated decisions.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH RELEVANCE
Automated-decision safeguards and risk assessments for new technologies; not a general AI Act.
Privacy
VERY HIGH RELEVANCE
Comprehensive personal-data framework and individual rights.
Cybersecurity
HIGH RELEVANCE
Security, breach notification and risk assessment.
Applicability
Controllers and processors within section 3’s automated/filing-system and territorial/equipment tests, including State processing; check section 44 and the domestic-use/transit qualifications.
Read first
Sections 3, 14, 44 → 21-26 → 28-31 → 34-40 → 42-43 and 51.
Provisions / sections covered
Sections 3-20 - Application, Office and registration
State application, territorial/equipment and processing tests, domestic-use/transit qualifications and oversight. Controller/processor registration is subject to section 44; certificates last three years and changes are notified within 14 days.
Sections 21-31 - Principles, consent, breaches and security
Consent is one lawful basis. Section 25 provides Commissioner notice without undue delay and where feasible within 72 hours; section 26 addresses high-risk data-subject communication with exceptions. Section 30 requires parental/guardian consent for children below 16.
Sections 32-36 - Risk, records and transfers
Prior security checks, processing records, DPIAs, prior authorisation/consultation and overseas-transfer safeguards/alternatives; not a blanket localisation rule.
Sections 37-41 - Individual rights
Access, rectification, erasure/restriction and objection. Section 38 protects against solely automated decisions with legal or significant effects, subject to exceptions and applicable human-intervention safeguards.
Sections 42-58 and Schedule - Enforcement and closing provisions
Offences, restrictions, audit, certification, appeals, repeal, transition and commencement; the Schedule concerns the oath. The full closing text is included in the PDF.
Subject-matter tags
- Lawful basis
- Consent
- Children's data
- Erasure and deletion
- Automated decision-making
- Impact assessment
- Data breach
- Cross-border transfers
- Data localisation
- Controller and processor
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- Protection of Personal Information Act, 2013: POPIA: South AfricaLaw · CurrentComparative African data-protection framework, not governing law in Mauritius.
- Ghana Data Protection Bill, 2025 - DraftDraft Bill · ProposedComparison with Ghana’s proposed framework only; the Ghana attachment is a draft, not an applicable Mauritius law.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.