Mauritius Data Protection Act compliance and requirements, so your data handling holds up when someone asks.

What it is

What is Mauritius's Data Protection Act and what is it used for?

The Data Protection Act 2017 (Act 20/2017) is Mauritius's general law on personal data, proclaimed with effect from 15 January 2018. Subject to its exceptions, no one may act as a controller or processor unless registered with the Data Protection Commissioner. The Act sets principles of lawful, fair and transparent processing, notice at collection and consent conditions, gives people rights to access, correct, erase and object, and requires security measures fitting the risk, written processor contracts, records of processing, impact assessments for high-risk processing, breach notification and safeguards for transfers abroad.

The Data Protection Office, headed by the Data Protection Commissioner, regulates the Act, keeps the register, carries out compliance audits and handles complaints. Data protection officer regulations made in 2026 come into operation on 1 January 2027 and require every controller to designate an officer from its staff. The practical test: for any personal data you hold, could you show your registration, its basis, who was told, how it is protected and where it goes?

Current law. The Data Protection Act 2017 was proclaimed with effect from 15 January 2018; section 44 was amended in 2020. The Data Protection (Designation, Tasks and Position of Data Protection Officers) Regulations 2026 come into operation on 1 January 2027. Confirm current wording and the Office's guidance with your legal advisers.

Who it is for

Who needs to comply with the Mauritius Data Protection Act?

The Act applies to controllers and processors established in Mauritius, whatever their size, including employers holding staff records, and to those outside it that use equipment there. Organisations usually come to Sterling for a structured programme from one of four directions:

• You must register with the Data Protection Office. Subject to the Act's exceptions, no one may act as a controller or processor unless registered with the Commissioner, describing the data, the people, the purposes, the recipients and any countries of transfer.
• You must designate a data protection officer. From 1 January 2027 every controller must designate an officer from its staff, send the particulars to the Office, publish the contact details and support the officer's independence.
• You process data for others. BPOs, cloud and software providers act under a written contract that keeps them to the controller's instructions and its security obligations, so clients ask for that evidence first.
• You send personal data abroad. Groups need each transfer backed by proof of safeguards given to the Commissioner, explicit informed consent or another listed ground, and the Commissioner can suspend or condition a transfer.

The aim is handling of personal information that you control and can evidence. Compliance depends on how the rules are applied every day, not on a policy document alone.

Requirements

What are the main Mauritius DPA requirements?

Strip away the vocabulary and Mauritius's Data Protection Act requires a business to comply in six areas of personal data handling. The list below puts each one in business terms; the Act and the regulator's guidance give the full wording and exceptions.

• Processing is lawful, fair and transparent: personal data is collected for a lawful purpose, used only as far as needed, kept accurate, and people are told how it is used and by whom.
• Registration with the Data Protection Office: controllers and processors register with the Commissioner before acting, describing the data, the people, the purposes, the recipients and any countries of transfer.
• People can exercise their rights: individuals can access, correct, erase or object to the use of their data, are not left with unsafe automated decisions, and get a written answer within one month.
• Data is secured, recorded and assessed: security measures fit the risk, processors work under written contracts, records of processing are kept, a data protection officer is designated, and high-risk processing is assessed first.
• Breaches are reported promptly: a breach goes to the Commissioner without undue delay, where feasible within 72 hours, and to affected people in clear language when the risk to them is high.
• Transfers abroad are safeguarded: personal data leaves Mauritius only with proof of safeguards given to the Commissioner, explicit informed consent, or another listed ground, and the Commissioner can suspend a transfer.

Compliance route

How do you achieve Mauritius DPA compliance?

There is no certificate at the end of this route. Compliance is something your organisation demonstrates, to the Data Protection Office if a complaint or incident arises, and to customers who ask. Sterling helps you build and run the programme; interpretation of the law in contested cases remains with your legal advisers and, ultimately, the regulator and the courts.

1. 01
   Map the personal information you handle.Customers, staff, patients, users and suppliers: what is collected, for which purpose, on which basis, where it is stored, who processes it for you, whether it is registered with the Office and whether it leaves Mauritius.
2. 02
   Gap analysis: compare current practice with the Act.Each area of the Act reviewed against what actually happens, with actions, owners and dates agreed.
3. 03
   Put the controls and routines in place.Complete or update the registration, rewrite notices and consent wording, put security measures and processor contracts in place, set up the record of processing and impact assessments, prepare the officer designation and agree a breach procedure.
4. 04
   Test the programme and review the results.Internal review of samples, a simulated incident or data-subject request, and a management review that closes findings with evidence.
5. 05
   Operate, demonstrate and keep it current.Answer requests, record incidents and notify where the Act requires it, keep the registration current, review transfers, refresh training and follow the Office's guidance as it is issued.

Check the route before you sign. The Act creates no certificate of compliance, so treat any offer of a "DPA certificate" with suspicion; a voluntary certification mechanism laid down by the Office does not alter your responsibility under the Act. If a customer wants independent assurance, ISO/IEC 27701 or ISO/IEC 27001 is certifiable by an accredited certification body; confirm the body's accreditation scope directly with the accreditation body concerned.

Cost

How much does Mauritius DPA compliance cost?

The cost of a Mauritius DPA programme is driven by how much personal information you hold, how many systems and suppliers touch it, and how much already works. Your proposal shows each component, with what is included and what remains for your legal advisers.

Timeline

How long does Mauritius DPA compliance take?

Timing depends on how scattered your personal information is, how quickly system owners respond and how much has to change. Your proposal sets out the phases for your scope, long enough to map the information, fix the gaps and show that requests and incidents are handled the way the procedures say.

If a customer or contract has set a date, tell us at the outset and we will say plainly what can be in place by then and what should follow.

Your engagement

What your Mauritius DPA engagement includes

Your scope covers the full programme, from the information map to evidence that runs. Sterling does not certify, attest or validate compliance with the Act, and the Act creates no certificate of compliance; the Data Protection Office supervises it, and we work alongside your legal advisers.

• Information map, gap analysis and plan

  Sources, systems, suppliers and overseas flows, with actions and owners agreed.

• Policies, notices and procedures

  Notices, consent wording, request, security, impact assessment and breach procedures, processor contract terms and transfer documents, drafted from Sterling's own templates with your teams.

• Effivity ISO & GRC software

  Registers, requests and incidents managed in Effivity, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Internal review and management review

  Sample testing, an incident exercise and findings closed with evidence.

• Registration and officer support

  Help preparing the registration particulars and the data protection officer designation, with findings closed with evidence.

Sterling OS™ sets how we deliver. Design™ is guided support, where your team builds the programme with our consultants' direction; Drive™ is managed support, where our consultants do most of the work with your input. You choose one of the two, not both in sequence. Once the programme is operating, Sustain™ keeps reviews, training and updates on schedule, and Automate™ is Effivity, where the records live.

The Data Protection Office, headed by the Data Protection Commissioner, acts with independence and impartiality under the Act.

Often combined with

Standards organisations pair with Data Protection Act (Mauritius)

• ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
• APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
• APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
• Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
• CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
• Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.