Eswatini

Eswatini regulates personal data through the Data Protection Act, 2022 (Act No. 41 of 2022), enacted and brought into force on 4 March 2022. The Act provides for the lawful collection, processing, disclosure, and protection of personal information and aligns the country's framework with regional and international standards. It applies to data controllers and processors that use automated means to process personal information in Eswatini, covering both public and private bodies. Controllers must process personal information in accordance with the Act's principles, lawfulness, purpose limitation, and data minimisation among them, and must register with the supervisory authority. Sensitive categories attract heightened protection, and controllers must report personal data breaches to the authority within 72 hours of becoming aware. Data subjects hold rights of access, correction, and objection to processing. Cross-border transfers are subject to adequacy and safeguard requirements. Sanctions escalate from warnings and compliance notices through suspension of processing authorisations to administrative fines of up to E5 million or 2% of global annual turnover, whichever is lower, with criminal liability for serious or repeated violations. A distinctive feature is the institutional design: rather than create a freestanding regulator, the Act designates the Eswatini Communications Commission (ESCCOM) as the National Data Protection Authority, operating under the brand name Eswatini Data Protection Authority (EDPA). The EDPA has been operationally active, issuing registration certificates and guidance, so unlike several regional peers whose authorities took years to stand up, Eswatini's supervisor has been functioning since relatively soon after enactment.