Key Facts
Overview
Mauritius's Data Protection Act 2017 (Act No. 20 of 2017) modernized the country's privacy framework by replacing the earlier 2004 Act with GDPR-aligned provisions. Effective January 15, 2018, it is enforced through a unique model where the Data Protection Office investigates but courts impose penalties. Mandatory registration with the DPO is required before any data processing begins. As a Council of Europe Convention 108 member, Mauritius demonstrates strong alignment with European data protection standards.
What This Means for Your Website
If your website processes personal data of Mauritius residents, you must register with the Data Protection Office before any processing, obtain consent as a legal basis for collection, and implement appropriate security measures. Data subjects have rights to information, access, rectification, and erasure. Cross-border data transfers require adequacy determinations.
Key Requirements
Registration with the Data Protection Office is mandatory before processing personal data. Consent is required for lawful processing. Data subjects have comprehensive rights including information, access, rectification, and erasure. Data security measures must be implemented. Cross-border transfers are subject to adequacy requirements. Certain processing activities require DPO appointment.
How ConsentStack Handles This
ConsentStack helps organizations comply with Mauritius's DPA 2017 by providing a consent management banner that captures lawful consent. It maintains detailed records of all consent decisions with timestamps for DPO registration compliance, supports data subject rights workflows, and provides audit trails that satisfy the court-enforced penalty framework.
Penalties
MUR 50,000 and/or 2 years imprisonment (general violations); MUR 100,000 and/or 5 years imprisonment (serious violations); MUR 200,000 and/or 5 years (failure to register)
Key Requirements
- Mandatory registration with Data Protection Office before processing
- Consent required for lawful processing
- Data subjects have rights to information, access, rectification, and erasure
- Data security measures mandatory
- Cross-border transfers subject to adequacy requirements
- DPO appointment required for certain processing activities
Notable Provisions
- Courts impose penalties rather than the DPO — unusual enforcement model
- Council of Europe Convention 108 member, aligning with European standards
- Replaced the DPA 2004 with a GDPR-aligned framework
Other Sub-Saharan Africa Regulations
Frequently Asked Questions
Do I need to register before processing data in Mauritius?
Yes, mandatory registration with the Data Protection Office is required before any personal data processing begins.
What are the penalties under Mauritius's DPA 2017?
Penalties range from MUR 50,000 and/or 2 years imprisonment for general violations to MUR 200,000 and/or 5 years for failure to register. Courts impose penalties, not the DPO.
Is Mauritius aligned with European data protection standards?
Yes, Mauritius is a member of the Council of Europe Convention 108, signaling strong alignment with European data protection principles.
Does Mauritius's DPA apply to foreign companies?
The DPA applies to all data controllers and processors operating within Mauritius, which can include foreign entities processing data in the country.
Stay compliant with Mauritius DPA 2017
ConsentStack helps you implement Opt-in consent for Republic of Mauritius automatically.