The Data Protection Act 2017 comes into force today in Mauritius, replacing the 2004 Act with a modern regime closely aligned to the EU General Data Protection Regulation (GDPR).
Key points
- Controllers and processors must register with the Data Protection Office.
- Organisations must implement appropriate security measures and be able to demonstrate compliance.
- Data protection impact assessments are required for processing likely to result in high risk.
- Personal data breaches must be notified to the Data Protection Commissioner within 72 hours.
- Transfers of personal data outside Mauritius are restricted unless appropriate safeguards apply.
Mauritius is a significant hub for financial services, business process outsourcing and offshore structures. UK organisations using Mauritian service providers, or operating entities there, should confirm registration and ensure contracts and security controls meet the new standard.
Source: Data Protection Act 2017 (Mauritius Data Protection Office)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
