Mauritius runs one of the most GDPR-like data protection regimes in Africa, and its Data Protection Act 2017 adds two things the GDPR does not: mandatory registration of every controller and processor, and criminal penalties for most breaches of the Act. The Act (Act 20 of 2017) came into force on 15 January 2018 and is enforced by the Data Protection Commissioner through the Data Protection Office. For the financial services, global business, BPO and technology firms that use Mauritius as a regional hub, this means a registration certificate to renew every three years, a 72-hour breach clock, and a security duty that names encryption and pseudonymisation. This guide covers scope, the core obligations by section, current status including the new Data Protection Officer regulations, enforcement, what the Act means for AI agents and machine credentials, and a phased compliance plan. It is written for security, privacy and engineering leads at organisations established in Mauritius or processing personal data there.
Key takeaways
- Registration is mandatory: section 14 requires every controller and processor to register with the Commissioner, certificates last three years under section 16(3), and renewal must be applied for at least three months before expiry.
- 72 hours where feasible: section 25 requires breach notification to the Commissioner without undue delay and, where feasible, within 72 hours, with reasons given for any delay.
- Security is spelled out: section 31 names pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience, timely restoration and regular testing of controls.
- Offences carry prison terms: unlawful processing can lead to a fine of up to Rs 100,000 and up to five years' imprisonment, and the general offence in section 43 reaches Rs 200,000 and five years.
- DPO rules tighten from 2027: new Data Protection Officer regulations made in 2026 are reported to take effect on 1 January 2027, requiring a certified DPO drawn from the controller's own staff.
Scope: who and what is covered
The Act binds the State and applies to automated processing and to manual processing of data that forms, or is intended to form, part of a filing system (section 3). It covers controllers and processors established in Mauritius, and those established elsewhere that use equipment in Mauritius for processing other than mere transit. A foreign controller caught by the equipment test must appoint a representative in Mauritius. A person ordinarily resident in Mauritius, or operating through an office, branch or agency there, counts as established. Purely personal or household activity is excluded, as are need-to-know exchanges between public bodies.
| Element | Mauritian position | Section |
|---|---|---|
| Personal data | Any information relating to an identified or identifiable individual | s2 |
| Special categories | Racial or ethnic origin, political or religious views, trade union membership, health, sexual orientation, genetic and biometric data, and offences or related proceedings; the Commissioner may add categories | s2, s29 |
| Controller | Person or public body that determines the purposes and means of processing | s2 |
| Processor | Person or public body that processes on the controller's behalf | s2 |
| Personal data breach | A breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data | s2 |
| Territorial reach | Established in Mauritius, or using equipment in Mauritius other than for transit (with a local representative) | s3 |
| Children | Parental consent needed for processing data of a child below 16 | s30 |
The equipment test is narrower than the GDPR's targeting test in Article 3(2): a foreign SaaS provider that merely sells to Mauritian customers is not obviously caught, but one that runs servers or other processing equipment in Mauritius is. Group companies with a Mauritian management company or global business licence are established there and fully in scope. For the GDPR comparison in depth, see the GDPR Compliance Guide for Security Teams.
Key obligations
Registration with the Data Protection Office
Section 14 makes registration a precondition for acting as a controller or processor, subject only to the section 44 exceptions. Applications go to the Data Protection Office using its controller and processor application forms. The register is public, and certified extracts can be requested.
| Item | Rule | Fee (Rs), Fees Regulations 2020 |
|---|---|---|
| Registration certificate | Valid three years (s16(3)) | 1,000 for up to 5 employees; 1,500 for 6 to 25; 2,500 for more than 25 |
| Renewal | Apply no later than three months before expiry (s18(1)) | Same tiers as registration |
| Change of particulars | Notify within 14 days of the change (s17(1)); failure is an offence with a fine up to Rs 50,000 | None stated |
| Cancellation | Commissioner gives 14 days to show cause (s19(2)) | None stated |
| Certified register extract | On request (s20(3)(b)) | 100 |
| Manifestly excessive access request | Fee may be charged (s37(7)) | 100 |
| Appeal | To the Tribunal within 21 days (s51) | 500 |
The fees are set by the Data Protection (Fees) Regulations 2020 (GN No. 152 of 2020), in force since 1 August 2020, and are tiered by headcount, not turnover. Knowingly giving false or misleading information in an application is an offence carrying up to Rs 100,000 and five years (s15(3)).
Principles, lawful processing and consent
Section 21 sets the principles: lawful and transparent processing, specified purposes, minimisation, accuracy, storage limitation and respect for data subject rights. Section 28 lists the lawful bases, and processing without one is an offence under section 28(2). Section 24 requires the controller to prove consent for each specified purpose, allows withdrawal at any time, and treats consent as not freely given where a service is made conditional on processing it does not need. Section 23 sets the notice content at collection: controller identity, purposes, recipients, whether supply is voluntary, rights, retention and any transfer abroad.
Accountability duties under section 22
Controllers must adopt policies and measures that ensure and demonstrate compliance, including:
- Security: the section 31 measures described below.
- Records: section 33 records of processing covering purposes, data and subject categories, recipients including overseas ones, transfers and safeguards, retention and compliance mechanisms, produced to the Office on request. Processors keep records too.
- Impact assessments: a section 34 DPIA before processing likely to result in high risk, such as large-scale automated evaluation with significant effects, large-scale special category processing, or large-scale monitoring of public areas.
- Prior authorisation or consultation: section 35 authorisation for transfers without adequate safeguards, and consultation where a DPIA shows high risk. The Office can block processing that does not address the risks.
- Designated officer: section 22(2)(e) requires an officer responsible for data protection compliance, now detailed by the 2026 DPO regulations.
- Verification: mechanisms to verify that the measures are effective, which in practice means audits and control testing.
The DPIA Guide and the DPIA Template fit section 34 with minor relabelling: the Mauritian test lists the same three large-scale triggers as GDPR Article 35(3).
Security of processing (section 31)
Controllers and processors must implement measures that prevent unauthorised access, alteration, disclosure, accidental loss and destruction, appropriate to the harm that could result and the nature of the data. The Act lists pseudonymisation and encryption, the ability to ensure ongoing confidentiality, integrity, availability and resilience, the ability to restore availability and access in a timely manner after an incident, and a process for regularly testing and evaluating effectiveness. Cost, the state of technology and specific risks are to be weighed. Where a processor is used, the controller must choose one giving sufficient guarantees and bind it by a written contract to act only on instructions and to meet the same security duties. A processor that processes outside instructions is treated as a controller for that processing. Staff must be made aware of the security measures.
Breach notification (sections 25 and 26)
| Duty | Who | Deadline | Content |
|---|---|---|---|
| Notify the Commissioner | Controller | Without undue delay, where feasible within 72 hours of becoming aware; reasons if later | Nature of the breach, approximate numbers of data subjects and records, contact point, recommended mitigation |
| Notify the controller | Processor | Without undue delay | Enough for the controller to notify |
| Communicate to data subjects | Controller | Without undue delay where high risk | Clear and plain language description |
| Record the breach | Controller | Always | Facts, effects and remedial action |
Data subject notice is not required where the data was rendered unintelligible, for example by encryption, where later measures removed the high risk, or where it would involve disproportionate effort and a public communication is equally effective. The Commissioner can order notice where the controller has not given it. Unlike some laws, the 72-hour notice to the Commissioner has no risk threshold in the text summarised here, so plan to notify every qualifying breach. Compare the clocks in other countries in the Breach Notification Laws by Country Guide.
Transfers abroad (section 36)
A transfer is allowed where the controller has given proof of appropriate safeguards to the Commissioner, or where the data subject has given explicit consent after being informed of the risks. Other grounds include contract performance, legal claims, important public interest, vital interests, transfers from public registers, and limited non-repetitive transfers for compelling legitimate interests with proof of safeguards. The Commissioner can ask for proof and can prohibit, suspend or condition transfers. Note the active element: safeguards must be shown to the Commissioner, not just signed. See the International Data Transfers Map.
Data subject rights
Access requests must be answered within one month, extendable by a further month, and refusals explained in writing within one month (s37). Section 38 gives a right not to be subject to decisions based solely on automated processing, including profiling, with legal or similarly significant effects, subject to contract, law and explicit consent exceptions with safeguards, and such decisions must not be based on special categories. Rectification, erasure and restriction sit in section 39, and the right to object in section 40, absolute for direct marketing.
Timeline and current status
| Date | Event | Status as checked 8 November 2026 |
|---|---|---|
| 15 January 2018 | Data Protection Act 2017 (Act 20 of 2017) in force | In force |
| 1 August 2020 | Data Protection (Fees) Regulations 2020, GN No. 152 of 2020 | In force; listed by the Data Protection Office |
| 2026 | Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 made | Published by the Office; reported commencement 1 January 2027 |
The Data Protection Office lists the Act without amendment notes. The 2026 regulations are posted on its website as a scanned PDF; the details here (DPO drawn from staff, certification by the Office or an accredited training institution, reporting to the highest management level, protection from dismissal for performing the role, a lead DPO where several are appointed) come from a law firm summary dated 30 June 2026 and should be confirmed against the gazetted text before you rely on them. Office guidance worth reading includes the Guide on Data Protection for Health Data and Artificial Intelligence Solutions and the Roles and Responsibilities of Data Protection Officer note.
Enforcement and penalties
The Commissioner can investigate complaints, issue information notices, apply for preservation orders of up to 90 days (s8), and issue enforcement notices giving not less than 21 days to comply (s9). Decisions can be appealed to the Tribunal within 21 days. The Act relies on criminal offences rather than administrative fines.
| Offence | Maximum fine (Rs) | Maximum imprisonment | Section |
|---|---|---|---|
| Failing to comply with an information notice, or giving false information | 50,000 | 2 years | s7(2) |
| Failing to comply with an enforcement notice | 50,000 | 2 years | s9(6) |
| Obstructing the Commissioner or an authorised officer | 50,000 | 2 years | s12 |
| False or misleading registration information | 100,000 | 5 years | s15(3) |
| Failing to notify a change of particulars | 50,000 | Not stated | s17(3) |
| Processing without a lawful basis | 100,000 | 5 years | s28(2) |
| Unlawful processing of special categories | 100,000 | 5 years | s29(3) |
| Any other offence without a specific penalty | 200,000 | 5 years | s43(1) |
The fines are small next to GDPR levels, but the criminal exposure, the public register and the Office's power to cancel a registration matter more to a licensed financial or global business entity than the fine itself.
What it means for AI agents and non-human identities
The Act does not mention AI agents, but several sections bite directly on automated systems and the machine credentials they run on.
- Section 31 covers machine access: "prevent unauthorised access" applies to service accounts, API keys and agent tokens that can read personal data. Inventory them, scope them to purpose and rotate them. See the Service Account Security Guide.
- Leaked credentials can start the 72-hour clock: a token exposed in a repository that grants access to customer records is a potential section 25 breach once you are aware. Triage within hours and keep access logs to show whether data was read.
- Agents may trigger section 38: an AI agent that approves, declines or prices for individuals without a human decision is making a solely automated decision. Document the exception relied on, offer human review, and keep special categories out of the inputs.
- DPIA for large-scale automated evaluation: section 34 expressly lists systematic and extensive automated evaluation with significant effects, so agentic decisioning at scale needs a DPIA before launch.
- AI vendors are processors or controllers: a hosted model provider processing prompts that contain personal data needs a section 31(4) contract, and if it uses the data for its own training outside instructions it becomes a controller for that processing. Prompts sent abroad are section 36 transfers.
- Records should name agents: section 33 records should list each AI agent or automated pipeline as a processing operation with its purpose, data, recipients and retention. The Agent Identity and Access Guide covers per-agent identities that make this traceable.
Compliance steps
- Confirm scope and registration: list every Mauritian entity and every foreign entity using equipment in Mauritius; register each controller and processor, diarise renewal at 33 months and the 14-day change rule.
- Build the section 33 record: one entry per processing operation, including automated pipelines and AI agents, with transfer destinations and safeguards.
- Close security gaps against section 31: encryption at rest and in transit, pseudonymisation for analytics, least privilege for human and machine identities, backup restore tests and a control testing calendar.
- Fix processor contracts: written terms requiring instruction-only processing, section 31 security, prompt breach notice to you and support for data subject requests.
- Prepare the breach runbook: a 72-hour path to the Commissioner with the four content items pre-drafted, a high-risk test for data subject notice, and a breach register. The Customer Breach Notification Letter Template is a starting point.
- Evidence transfers: per destination, record the section 36 ground and the proof of safeguards supplied to the Commissioner; seek section 35 authorisation where safeguards are missing.
- Run DPIAs: for the listed high-risk processing and for any agentic decisioning, and consult the Office where residual risk stays high.
- Prepare for the DPO regulations: identify a staff member to designate, plan certification, and set a reporting line to senior management before 1 January 2027.
| Act requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| s31 access control for human and machine identities | PR.AA-01, PR.AA-05 | AC-2 |
| s31 encryption and protection at rest and in transit | PR.DS-01, PR.DS-02 | SC-28 |
| s33 records of processing | ID.AM-07 | CM-8 |
| s25 and s26 breach notification | RS.CO-02 | IR-6 |
| s31(4) processor contracts | GV.SC-05 | SA-9, SR-6 |
| s23 notice at collection | Not mapped | PT-5 |
| s31 detection and evidence of access | Not mapped | AU-2 |
Common failure patterns
- Letting the certificate lapse: renewal is due three months before expiry, and processing while unregistered breaches section 14.
- Forgetting processor registration: BPO and shared service centres in Mauritius are processors and must register in their own right.
- Treating 72 hours as optional: "where feasible" allows a late notice with reasons, not silence.
- Signing transfer clauses without proof: section 36 expects proof of safeguards provided to the Commissioner.
- Ignoring machine credentials: security reviews that cover staff accounts but not API keys and service accounts leave the easiest path to personal data uncontrolled.
Practitioner checklist
- Register every controller and processor entity and diarise renewals three months ahead.
- Notify changes in registered particulars within 14 days, including new purposes such as AI use.
- Maintain section 33 records that list AI agents and automated pipelines.
- Encrypt personal data at rest and in transit and pseudonymise analytics data.
- Inventory and scope service accounts, API keys and agent tokens with access to personal data.
- Rehearse a 72-hour notification to the Commissioner with the four required content items.
- Put written section 31(4) terms in every processor and AI vendor contract.
- Record the section 36 ground and safeguards evidence for each transfer destination.
- Run a DPIA before large-scale automated decisioning and offer human review under section 38.
- Designate and train a staff DPO ahead of the 1 January 2027 regulations.
Standards and references
- Republic of Mauritius: Data Protection Act 2017
- Data Protection Office: The Data Protection Act 2017
- Republic of Mauritius: Data Protection (Fees) Regulations 2020
- Data Protection Office: Data Protection Regulations 2026
- Data Protection Office: Registration of controllers and processors
- Data Protection Office: Guidelines under the Data Protection Act 2017
- ENSafrica: The new DPO regulations, five things Mauritian organisations need to know
Related NHI Mgmt Group resources: Kenya Data Protection Act Guide · South Africa POPIA Guide · Global Privacy Regulatory Map · Morocco Law 09-08. This guide summarises the Mauritius Data Protection Act 2017 and its regulations as published at the date above and is not legal advice.