Mauritius. Comprehensive data protection. Act
Mauritius DPAData Protection Act 2017 (Act No. 20 of 2017)
In force
Partly verified
Medium confidence.Convention 108+ ratification date and Act number from memory; not re-verified.
§1Summary
- Synopsis
Mauritius' GDPR-aligned data protection law, administered by the Data Protection Office. It requires registration of controllers and processors and mandates a DPO for all.
- Key themes
- Unique features
Every controller and processor must register (three-year certificate) and designate a DPO. Mauritius is a party to Convention 108 and 108+.
- SaaS relevance
SaaS providers established or using equipment in Mauritius (a common regional hub) must register and appoint a DPO.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Commissioner without undue delay, within 72h where feasible; data subjects if high risk
- DPO
- Yes
- Cross-border transfers
- Proof of appropriate safeguards to Commissioner, explicit consent, derogations
- Maximum penalty
- MUR 200,000 and/or 5 years' imprisonment
§3Dates
- Key dates
- Adopted
- In force
- Repealed DPA 2004; Mauritius ratified Council of Europe Convention 108+ (2020); 2025-26 budget announced reforms toward EU adequacy
§4Text and authority
- Text
- Authoritative text dataprotection.govmu.org
- Authority
- Data Protection Office (Data Protection Commissioner)
§5Where it applies
- Domestic law of
- Mauritius
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Convention 108+ ratification date and Act number from memory; not re-verified.