Lesotho

Lesotho has a comprehensive data protection law that is in force but effectively unenforced. The Data Protection Act, 2011 (Act No. 5 of 2012), gazetted on 22 February 2012, applies to every organisation that collects, stores, or processes personal information in Lesotho and is now recorded in ATLPF's Instruments database (AI-draft). The Act draws on the pre-GDPR / Convention 108 model and establishes data-protection principles, obligations on those handling personal information, and a supervisory Data Protection Commission. The decisive feature of the regime, however, is an enforcement vacuum: the Commission established by the Act has never been appointed. The law is therefore technically in force, and on some readings fully enforceable once a Commission exists, potentially even as to past conduct, but in practice there is no operational regulator and the statute goes largely unenforced. Because the Commission has never been constituted, no Regulator record is on file. With an instrument on file but no operational regulator, Lesotho scores in the one-instrument-without-an-operational-regulator band. The record is AI-drafted from a June 2026 verification search; detailed provisions await confirmation against the LesothoLII text.