Mauritius

Mauritius has one of the more modern data protection regimes on the continent. Its primary instrument, the Data Protection Act 2017 (Act No. 20 of 2017), was published on 23 December 2017 and entered into force on 15 January 2018, repealing and replacing the Data Protection Act 2004. The 2017 Act was deliberately aligned with the EU GDPR, reflecting the country's role as a regional financial-services hub with substantial cross-border data flows. It applies to any person who controls the collection, holding, processing, or use of personal data in Mauritius, and to controllers outside Mauritius that use equipment located in the country, with exemptions for purely personal or household processing, journalism, artistic expression, and certain national-security activities. All controllers must register with the Data Protection Commissioner before processing; failure to register is a criminal offence carrying a fine of up to MUR 200,000 and imprisonment of up to five years. The Act enshrines eight data protection principles and grants data subjects rights of access, rectification, erasure, objection to direct marketing, and protection against automated decision-making with significant effects. Breach notification to the Commissioner is required without undue delay and, where feasible, within 72 hours, with direct notice to affected individuals for high-risk breaches. Cross-border transfers are permitted only to countries assessed as adequate by the Commissioner, or under specific safeguards such as standard contractual clauses or binding corporate rules. Enforcement rests with the Data Protection Commissioner, who heads an independent Data Protection Office that is not subject to the direction of any other authority and may issue enforcement notices, stop-processing orders, and conduct audits and investigations. Having modernised to a GDPR-style standard relatively early (2017 - 18), Mauritius operates one of the more sophisticated single-statute regimes in the East Africa / Indian Ocean grouping.