Eswatini. Comprehensive data protection. Act
Eswatini DPAData Protection Act, 2022 (Act No. 5 of 2022)
In force
Partly verified
Low confidence.Penalties and enforcement date from a vendor summary only; breach and DPO rules not verified.
§1Summary
- Synopsis
Eswatini's data protection law regulating processing by public and private bodies, with ESCCOM acting as the authority. It contains principles, rights, prior notification/authorisation and high penalties.
- Key themes
- Unique features
Reported criminal penalties up to E100m or 5% of turnover, among the highest in Africa; applies to foreign entities processing in Eswatini.
- SaaS relevance
SaaS providers processing Eswatini data may need to notify ESCCOM and comply with its transfer rules.
§2Obligations
- Extraterritorial
- Limited
- Cross-border transfers
- Adequacy-based
- Maximum penalty
- Administrative E5m or 2% turnover; criminal up to E100m or 5% turnover / 10 years
§3Dates
- Key dates
- Adopted
- In force
- Gazetted March 2022; enforcement reported to start September 2025
§4Text and authority
- Text
- Authoritative text gov.sz
- Authority
- Eswatini Communications Commission (ESCCOM) as Data Protection Authority
§5Where it applies
- Domestic law of
- Eswatini
§6Sources and verification
- Verification
Low confidence.
Partly verified
Low confidence.Penalties and enforcement date from a vendor summary only; breach and DPO rules not verified.